fad-checker 2.0.0 → 2.1.0

package/lib/codecs/npm/collect.js

@@ -13,10 +13,13 @@
  *   - lockfile entries WIN over package.json range specs (concrete version)
  *   - if two lockfiles disagree, keep the highest semver-comparable version
  *   - dev/optional/peer downgrade to prod if any manifest puts the dep in prod
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
  */
 const path = require("path");
 const fs = require("fs");
-const { parsePackageJson, parsePackageLock, parseYarnLockV1, findJsManifests } = require("./parse");
+const { parsePackageJson, parsePackageLock, parseYarnLockV1, parsePnpmLock, findJsManifests } = require("./parse");
 const { makeDepRecord } = require("../../dep-record");
 
 const SCOPE_RANK = { prod: 4, peer: 3, optional: 2, dev: 1, transitive: 0 };
@@ -91,6 +94,14 @@ function upsert(out, dep, manifestPath, lockType) {
 	} else if (!have && incoming) {
 		existing.version = incoming;
 	}
+	// Every DISTINCT concrete version is scanned, not just the highest: a JS tree
+	// routinely pins the same package at several versions (nested node_modules),
+	// and a CVE may affect only a lower one. cve-match.js / osv.js iterate
+	// dep.versions, so we union them here (makeDepRecord seeds `versions` with the
+	// record's own concrete version).
+	for (const v of record.versions || []) {
+		if (!existing.versions.includes(v)) existing.versions.push(v);
+	}
 	// Stronger scope wins (prod > peer > optional > dev)
 	if (rankScope(record.scope) > rankScope(existing.scope)) existing.scope = record.scope;
 	// A dep is "dev" overall only if every occurrence is dev. Any prod use → not dev.
@@ -133,7 +144,8 @@ function collectNpmDeps(rootDir, opts = {}) {
 		const pj = group.packageJson ? safeParse(parsePackageJson, group.packageJson, verbose) : null;
 		const pl = group.packageLock ? safeParse(parsePackageLock, group.packageLock, verbose) : null;
 		const yl = group.yarnLock ? safeParse(parseYarnLockV1, group.yarnLock, verbose) : null;
-		const hasLock = !!(pl || yl);
+		const pn = group.pnpmLock ? safeParse(parsePnpmLock, group.pnpmLock, verbose) : null;
+		const hasLock = !!(pl || yl || pn);
 
 		// package.json without lockfile → best-effort fallback (changed contract):
 		// scan pinned exact versions ("1.2.3"), skip ranges ("^1.0.0"), and warn
@@ -159,14 +171,14 @@ function collectNpmDeps(rootDir, opts = {}) {
 			if (verbose) console.warn(`⚠️  ${group.packageJson}: no lockfile — best-effort (${pinned} pinned, ${ranges} ranges skipped)`);
 		}
 
-		// Yarn-Berry lockfile detected but unsupported → warning, skip.
-		if (yl?.unsupported === "yarn-berry") {
+		// Yarn-Berry lockfile that failed to parse → warning (deps still empty).
+		if (yl?.parseError) {
 			warnings.push({
-				type: "yarn-berry-unsupported",
+				type: "parse-error",
 				manifestPath: group.yarnLock,
-				message: `yarn 2+/Berry lockfile not yet supported — skipped`,
+				message: `yarn 2+/Berry lockfile parse failed: ${yl.parseError}`,
 			});
-			if (verbose) console.warn(`⚠️  ${group.yarnLock}: yarn-berry not supported, skipped`);
+			if (verbose) console.warn(`⚠️  ${group.yarnLock}: yarn-berry parse failed — ${yl.parseError}`);
 		}
 
 		// Used only as a source of scope info — never emits deps on its own.
@@ -185,15 +197,23 @@ function collectNpmDeps(rootDir, opts = {}) {
 		}
 		if (yl) {
 			parsedCount++;
-			// yarn-berry warning already pushed above; only emit deps for v1
-			if (yl.unsupported !== "yarn-berry") {
-				for (const d of yl.deps) {
-					const explicit = directScopes?.get(d.name);
-					const scope = explicit || "prod";
-					if (ignoreTest && (scope === "dev" || scope === "optional")) continue;
-					if (deps2Exclude && deps2Exclude.test(d.name)) continue;
-					upsert(out, { ...d, scope }, group.yarnLock, "yarn-v1");
-				}
+			const lockType = yl.lockfileVersion === "berry" ? "yarn-berry" : "yarn-v1";
+			for (const d of yl.deps) {
+				const explicit = directScopes?.get(d.name);
+				const scope = explicit || d.scope || "prod";
+				if (ignoreTest && (scope === "dev" || scope === "optional")) continue;
+				if (deps2Exclude && deps2Exclude.test(d.name)) continue;
+				upsert(out, { ...d, scope }, group.yarnLock, lockType);
+			}
+		}
+		if (pn) {
+			parsedCount++;
+			for (const d of pn.deps) {
+				const explicit = directScopes?.get(d.name);
+				const scope = explicit || d.scope || "prod";
+				if (ignoreTest && (scope === "dev" || scope === "optional")) continue;
+				if (deps2Exclude && deps2Exclude.test(d.name)) continue;
+				upsert(out, { ...d, scope }, group.pnpmLock, "pnpm");
 			}
 		}
 	}
@@ -251,7 +271,7 @@ function hasJsManifests(rootDir) {
 			try { entries = fs.readdirSync(cur, { withFileTypes: true }); }
 			catch { continue; }
 			for (const e of entries) {
-				if (e.isFile() && (e.name === "package.json" || e.name === "package-lock.json" || e.name === "yarn.lock")) return true;
+				if (e.isFile() && (e.name === "package.json" || e.name === "package-lock.json" || e.name === "yarn.lock" || e.name === "pnpm-lock.yaml")) return true;
 				if (e.isDirectory() && !skip.has(e.name)) stack.push(path.join(cur, e.name));
 			}
 		}

package/lib/codecs/npm/parse.js

@@ -21,9 +21,13 @@
  *
  * The collector (lib/npm/collect.js) is responsible for merging across
  * files and applying exclusion rules.
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
  */
 const fs = require("fs");
 const path = require("path");
+const yaml = require("js-yaml");
 
 function isWorkspaceVersion(v) {
 	// npm v9+ uses "*" / "" for workspace-local refs; yarn uses "workspace:*"
@@ -189,14 +193,8 @@ function parsePackageLock(filePath) {
 function parseYarnLockV1(filePath) {
 	const raw = fs.readFileSync(filePath, "utf8");
 	if (raw.includes("__metadata:")) {
-		// Berry / yarn 2+ uses YAML. Punt for now — return empty deps + a flag.
-		return {
-			manifestPath: filePath,
-			manifestType: "yarn.lock",
-			lockfileVersion: "berry",
-			deps: [],
-			unsupported: "yarn-berry",
-		};
+		// Berry / yarn 2+ uses YAML — parse it with js-yaml.
+		return parseYarnBerry(raw, filePath);
 	}
 	const out = {
 		manifestPath: filePath,
@@ -247,6 +245,112 @@ function parseYarnLockV1(filePath) {
 	return out;
 }
 
+/* -------- yarn.lock v2+ (Berry) ----------
+   Berry lockfiles are YAML. Top-level keys are comma-separated descriptor lists
+   ("lodash@npm:^4.17.0, lodash@npm:^4.17.21:") whose value carries `version` and
+   `resolution`. The workspace's own packages resolve to "@workspace:" — skipped.
+*/
+function identFromDescriptor(d) {
+	const s = String(d || "").trim().replace(/^"|"$/g, "");
+	const scoped = s.startsWith("@");
+	const at = s.indexOf("@", scoped ? 1 : 0);   // the @ before the range/protocol
+	if (at <= 0) return null;
+	return s.slice(0, at);
+}
+
+function parseYarnBerry(raw, filePath) {
+	const out = { manifestPath: filePath, manifestType: "yarn.lock", lockfileVersion: "berry", deps: [] };
+	let doc;
+	try { doc = yaml.load(raw) || {}; }
+	catch (e) { out.parseError = e.message; return out; }
+	const seen = new Set();
+	for (const [key, val] of Object.entries(doc)) {
+		if (key === "__metadata") continue;
+		if (!val || typeof val !== "object" || !val.version) continue;
+		if (/@workspace:/.test(val.resolution || "")) continue;   // the local package itself
+		const version = String(val.version);
+		const names = new Set();
+		for (const desc of String(key).split(",")) {
+			const name = identFromDescriptor(desc);
+			if (name) names.add(name);
+		}
+		for (const name of names) {
+			const k = `${name}@${version}`;
+			if (seen.has(k)) continue; seen.add(k);
+			out.deps.push({ name, version, scope: "prod", depth: 0, resolved: val.resolution || null });
+		}
+	}
+	return out;
+}
+
+/* -------- pnpm-lock.yaml ----------
+   YAML. The full resolved set lives in `packages` (v5/v6) and `snapshots` (v9);
+   `importers.*` carry the per-workspace direct deps with dev classification.
+   Package keys vary by lockfileVersion:
+     v9:  "name@1.2.3"            / "@scope/name@1.2.3"
+     v6:  "/name@1.2.3(peers)"    / "/@scope/name@1.2.3(peers)"
+     v5:  "/name/1.2.3"           / "/@scope/name/1.2.3"
+*/
+function pnpmNameVersion(key) {
+	let k = String(key || "");
+	if (k.startsWith("/")) k = k.slice(1);
+	const paren = k.indexOf("(");           // strip peer-deps suffix
+	if (paren !== -1) k = k.slice(0, paren);
+	const at = k.lastIndexOf("@");          // @-form (v6/v9)
+	if (at > 0 && /^\d/.test(k.slice(at + 1))) return { name: k.slice(0, at), version: k.slice(at + 1) };
+	const slash = k.lastIndexOf("/");       // slash-form (v5)
+	if (slash > 0 && /^\d/.test(k.slice(slash + 1))) return { name: k.slice(0, slash), version: k.slice(slash + 1) };
+	return null;
+}
+
+function parsePnpmLock(filePath) {
+	const raw = fs.readFileSync(filePath, "utf8");
+	let doc;
+	try { doc = yaml.load(raw) || {}; }
+	catch (e) { throw new Error(`pnpm-lock parse failed (${filePath}): ${e.message}`); }
+	const out = { manifestPath: filePath, manifestType: "pnpm-lock", lockfileVersion: doc.lockfileVersion || null, deps: [] };
+	const seen = new Set();
+	const push = (name, version, scope, isDev) => {
+		if (!name || !version) return;
+		const v = String(version).split("(")[0];          // peer-resolved suffix
+		if (!/^\d/.test(v)) return;
+		const k = `${name}@${v}`;
+		if (seen.has(k)) return; seen.add(k);
+		out.deps.push({ name, version: v, scope: scope || "prod", isDev: !!isDev, depth: 0 });
+	};
+	// Direct deps from importers FIRST (v6/v9) — these carry the authoritative
+	// dev/optional classification. In v9 the `packages` section has no dev flag,
+	// so seeding dev/optional here (dedup by name@version) keeps the right scope.
+	const importers = doc.importers || ((doc.dependencies || doc.devDependencies) ? { ".": doc } : null);
+	if (importers && typeof importers === "object") {
+		const readDir = (obj, scope, isDev) => {
+			for (const [name, spec] of Object.entries(obj || {})) {
+				const version = typeof spec === "string" ? spec : (spec && (spec.version || spec.specifier));
+				push(name, version, scope, isDev);
+			}
+		};
+		for (const imp of Object.values(importers)) {
+			if (!imp || typeof imp !== "object") continue;
+			readDir(imp.devDependencies, "dev", true);
+			readDir(imp.optionalDependencies, "optional", false);
+			readDir(imp.dependencies, "prod", false);
+		}
+	}
+	// Full resolved set (direct + transitive) fills in anything not already seen.
+	for (const sec of [doc.packages, doc.snapshots]) {
+		if (!sec || typeof sec !== "object") continue;
+		for (const [key, entry] of Object.entries(sec)) {
+			const nv = pnpmNameVersion(key);
+			if (!nv) continue;
+			const name = (entry && entry.name) || nv.name;
+			const version = (entry && entry.version) || nv.version;
+			const isDev = !!(entry && entry.dev);          // v6 carries a dev flag
+			push(name, version, isDev ? "dev" : "prod", isDev);
+		}
+	}
+	return out;
+}
+
 /* -------- discovery ---------- */
 // Dirs that hold packaged / generated content — never our own source.
 // Conservative list: only well-known build-output / package-cache dirs.
@@ -266,7 +370,7 @@ function findJsManifests(rootDir, opts = {}) {
 		try { entries = fs.readdirSync(cur, { withFileTypes: true }); }
 		catch { continue; }
 		// Group lockfile per directory so we can prefer lock > package.json
-		const here = { dir: cur, packageJson: null, packageLock: null, yarnLock: null };
+		const here = { dir: cur, packageJson: null, packageLock: null, yarnLock: null, pnpmLock: null };
 		for (const e of entries) {
 			const p = path.join(cur, e.name);
 			if (e.isDirectory()) {
@@ -276,9 +380,10 @@ function findJsManifests(rootDir, opts = {}) {
 				if (e.name === "package.json") here.packageJson = p;
 				else if (e.name === "package-lock.json") here.packageLock = p;
 				else if (e.name === "yarn.lock") here.yarnLock = p;
+				else if (e.name === "pnpm-lock.yaml") here.pnpmLock = p;
 			}
 		}
-		if (here.packageJson || here.packageLock || here.yarnLock) found.push(here);
+		if (here.packageJson || here.packageLock || here.yarnLock || here.pnpmLock) found.push(here);
 	}
 	return found;
 }
@@ -287,5 +392,7 @@ module.exports = {
 	parsePackageJson,
 	parsePackageLock,
 	parseYarnLockV1,
+	parseYarnBerry,
+	parsePnpmLock,
 	findJsManifests,
 };

package/lib/codecs/npm/registry.js

@@ -12,6 +12,9 @@
  *
  * `packumentToFindings` is the pure extractor (unit-tested without network);
  * `checkNpmRegistryDeps` is the cached, concurrent driver.
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
  */
 const fs = require("fs");
 const path = require("path");
@@ -49,10 +52,13 @@ function replacementFromMessage(msg) {
  * Pure — no network, no cache. Either field is null when not applicable.
  */
 function packumentToFindings(packument, dep) {
-	const out = { deprecated: null, outdated: null };
+	const out = { deprecated: null, outdated: null, license: null };
 	if (!packument || typeof packument !== "object") return out;
 
 	const versionEntry = packument.versions?.[dep.version];
+	// License: prefer the resolved version's field, fall back to the packument root.
+	const lic = versionEntry?.license ?? versionEntry?.licenses ?? packument.license ?? packument.licenses;
+	if (lic) out.license = lic;
 	const depMsg = versionEntry && typeof versionEntry.deprecated === "string"
 		? versionEntry.deprecated.trim()
 		: "";
@@ -118,7 +124,7 @@ async function fetchPackument(name, opts = {}) {
  * opts: { verbose, offline, allLibs, concurrency = 8 }
  */
 async function checkNpmRegistryDeps(resolvedDeps, opts = {}) {
-	const { verbose, offline, allLibs = true, concurrency = 8 } = opts;
+	const { verbose, offline, allLibs = true, concurrency = 8, onProgress } = opts;
 	// Targets = npm deps (queried by their own name) + WebJars (queried by their
 	// derived npm-equivalent name; version matches upstream). The original dep
 	// is kept for display/results so the report shows e.g. org.webjars:angularjs.
@@ -129,7 +135,7 @@ async function checkNpmRegistryDeps(resolvedDeps, opts = {}) {
 		const wj = webjarToNpm(d);
 		if (wj?.name) targets.push({ dep: d, npmName: wj.name, version: d.version });
 	}
-	const result = { deprecated: [], outdated: [] };
+	const result = { deprecated: [], outdated: [], licensed: [] };
 	if (!targets.length) return result;
 
 	const cache = loadCache();
@@ -138,7 +144,7 @@ async function checkNpmRegistryDeps(resolvedDeps, opts = {}) {
 
 	const cacheKey = t => `${t.npmName}@${t.version}`;
 	const liveCount = offline ? 0 : targets.filter(t => !cache.entries[cacheKey(t)]).length;
-	if (liveCount && !offline) {
+	if (liveCount && !offline && !onProgress) {
 		console.log(`📦 npm registry: checking ${targets.length} packages for deprecation${allLibs ? " + outdated" : ""} (${liveCount} live, ${targets.length - liveCount} cached)…`);
 	}
 
@@ -147,6 +153,7 @@ async function checkNpmRegistryDeps(resolvedDeps, opts = {}) {
 	let processed = 0;
 	const startedAt = Date.now();
 	const printProgress = (final = false) => {
+		if (onProgress) { onProgress(processed, targets.length); return; }
 		if (!liveCount) return;
 		const elapsed = Math.round((Date.now() - startedAt) / 1000);
 		const pct = Math.round((processed / targets.length) * 100);
@@ -168,6 +175,7 @@ async function checkNpmRegistryDeps(resolvedDeps, opts = {}) {
 					deprecated: f.deprecated ? { reason: f.deprecated.reason, replacement: f.deprecated.replacement } : null,
 					latest: f.outdated ? f.outdated.latest : null,
 					latestDate: f.outdated ? f.outdated.releaseDate : null,
+					license: f.license || null,
 				};
 				cache.entries[key] = extracted;
 			} else {
@@ -191,6 +199,7 @@ async function checkNpmRegistryDeps(resolvedDeps, opts = {}) {
 			result.outdated.push({ dep, latest: extracted.latest, releaseDate: extracted.latestDate || null });
 			if (verbose) process.stdout.write(`  outdated: ${npmName} ${version} → ${extracted.latest}\n`);
 		}
+		if (extracted.license) result.licensed.push({ dep, licenses: extracted.license, source: "npm" });
 	})));
 	if (liveCount) printProgress(true);
 
@@ -199,7 +208,7 @@ async function checkNpmRegistryDeps(resolvedDeps, opts = {}) {
 
 	result.deprecated.sort((a, b) => a.dep.artifactId.localeCompare(b.dep.artifactId));
 	result.outdated.sort((a, b) => a.dep.artifactId.localeCompare(b.dep.artifactId));
-	if (liveCount && !offline) console.log(`   npm registry: ${result.deprecated.length} deprecated, ${result.outdated.length} outdated`);
+	if (liveCount && !offline && !onProgress) console.log(`   npm registry: ${result.deprecated.length} deprecated, ${result.outdated.length} outdated`);
 	return result;
 }
 

package/lib/codecs/npm.codec.js

@@ -8,6 +8,9 @@
  * npm.collect ramasse package-lock ET yarn.lock — chaque dep porte son
  * `ecosystemType` ("npm" | "yarn"). Le codec yarn (yarn.codec.js) n'existe que
  * pour fournir son label/recette au report ; il ne re-scanne pas.
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
  */
 const { collectNpmDeps, hasJsManifests } = require("./npm/collect");
 const { coordKeyFor } = require("../dep-record");
@@ -25,7 +28,7 @@ const retireScanner = {
 
 const base = {
 	osvEcosystem: "npm",
-	manifestNames: ["package.json", "package-lock.json", "yarn.lock"],
+	manifestNames: ["package.json", "package-lock.json", "yarn.lock", "pnpm-lock.yaml"],
 	detect(dir) { return hasJsManifests(dir); },
 	coordKey(d) { return coordKeyFor("npm", "", d.name || d.artifactId); },
 	formatCoord(d) { return d.name || d.artifactId; },

package/lib/codecs/nuget/parse.js

@@ -9,6 +9,9 @@
  *   packages.config        — XML legacy, <package id version targetFramework />.
  *
  * NuGet ids are case-insensitive (lowercased for the key; original case kept for display).
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
  */
 const fs = require("fs");
 const xml2js = require("xml2js");

package/lib/codecs/nuget/registry.js

@@ -6,6 +6,9 @@
  *   → { items: [ { items: [ { catalogEntry: { version, deprecation } } ] } ] }
  *
  * Cached in ~/.fad-checker/nuget-cache.json for 24h.
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
  */
 const fs = require("fs");
 const path = require("path");
@@ -31,11 +34,14 @@ function cmp(a, b) {
 function nugetRegistrationToFindings(reg, { version }) {
 	const entries = [];
 	for (const page of reg.items || []) for (const leaf of page.items || []) if (leaf.catalogEntry) entries.push(leaf.catalogEntry);
-	const out = { outdated: null, deprecated: null };
+	const out = { outdated: null, deprecated: null, license: null };
 	const stable = entries.map(e => e.version).filter(isStable);
 	if (stable.length) { const latest = stable.sort(cmp).at(-1); if (latest && cmp(latest, version) > 0) out.outdated = { latest }; }
 	const mine = entries.find(e => String(e.version) === String(version));
 	if (mine?.deprecation) out.deprecated = { reason: (mine.deprecation.reasons || []).join(", ") || "deprecated", replacement: mine.deprecation.alternatePackage?.id || null };
+	// Modern packages expose an SPDX licenseExpression; older ones only a licenseUrl (→ unknown).
+	const licEntry = mine || entries.at(-1);
+	if (licEntry?.licenseExpression) out.license = licEntry.licenseExpression;
 	return out;
 }
 
@@ -52,7 +58,7 @@ async function fetchRegistration(name, { offline }) {
 async function checkNugetRegistryDeps(deps, opts = {}) {
 	const { verbose, offline, allLibs = true, concurrency = 8 } = opts;
 	const targets = [...deps.values()].filter(d => d.ecosystem === "nuget" && d.version);
-	const result = { deprecated: [], outdated: [] };
+	const result = { deprecated: [], outdated: [], licensed: [] };
 	if (!targets.length) return result;
 	const cache = loadCache();
 	const fresh = cache.meta?.fetchedAt && (Date.now() - cache.meta.fetchedAt) < CACHE_MAX_AGE_MS;
@@ -65,12 +71,13 @@ async function checkNugetRegistryDeps(deps, opts = {}) {
 			const reg = await fetchRegistration(t.name, { offline });
 			if (reg && !reg.error) {
 				const f = nugetRegistrationToFindings(reg, { version: t.version });
-				ex = { deprecated: f.deprecated, latest: f.outdated?.latest || null };
+				ex = { deprecated: f.deprecated, latest: f.outdated?.latest || null, license: f.license || null };
 				cache.entries[key] = ex;
 			} else {
-				ex = { deprecated: null, latest: null };
+				ex = { deprecated: null, latest: null, license: null };
 			}
 		}
+		if (ex.license) result.licensed.push({ dep: t, licenses: ex.license, source: "nuget" });
 		if (ex.deprecated) {
 			result.deprecated.push({ dep: t, severity: "MEDIUM", replacement: ex.deprecated.replacement, reason: ex.deprecated.reason, source: "nuget" });
 			if (verbose) process.stdout.write(`  deprecated: ${t.name}@${t.version}\n`);

package/lib/codecs/nuget.codec.js

@@ -6,6 +6,9 @@
  * else packages.config), NuGet registration registry (deprecation + outdated),
  * and EOL. NuGet ids are case-insensitive: the key is lowercased, dep.name keeps
  * the original casing for display / OSV.
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
  */
 const fs = require("fs");
 const path = require("path");
@@ -13,6 +16,8 @@ const { makeDepRecord, coordKeyFor } = require("../dep-record");
 const N = require("./nuget/parse");
 
 const SKIP = new Set([".git", ".idea", ".vscode", "node_modules", "dist", "build", "out", "bin", "obj", "target", "packages"]);
+// MSBuild project files share the same <PackageReference> schema — C#, F#, VB.
+const PROJ_RE = /\.(csproj|fsproj|vbproj)$/i;
 
 function findNugetDirs(dir) {
 	const groups = [];
@@ -21,7 +26,7 @@ function findNugetDirs(dir) {
 		const cur = stack.pop();
 		let entries; try { entries = fs.readdirSync(cur, { withFileTypes: true }); } catch { continue; }
 		const files = entries.filter(e => e.isFile()).map(e => e.name);
-		const csprojs = files.filter(f => f.toLowerCase().endsWith(".csproj"));
+		const csprojs = files.filter(f => PROJ_RE.test(f));
 		if (files.includes("packages.lock.json") || files.includes("packages.config") || csprojs.length) {
 			groups.push({ dir: cur, files, csprojs });
 		}
@@ -34,7 +39,7 @@ module.exports = {
 	id: "nuget",
 	label: "NuGet",
 	osvEcosystem: "NuGet",
-	manifestNames: ["packages.lock.json", "*.csproj", "packages.config"],
+	manifestNames: ["packages.lock.json", "*.csproj", "*.fsproj", "*.vbproj", "packages.config"],
 
 	detect(dir) { return findNugetDirs(dir).length > 0; },
 

package/lib/codecs/pypi/parse.js

@@ -3,12 +3,19 @@
  *
  *   poetry.lock / uv.lock / pdm.lock — TOML, [[package]] name/version arrays.
  *   Pipfile.lock                     — JSON, { default:{}, develop:{} }, version "==x".
+ *   pyproject.toml                   — TOML, PEP 621 [project] + poetry table (fallback).
  *   requirements.txt                 — text; only "==" pins are queryable (fallback).
+ *                                      -r/-c includes are followed recursively;
+ *                                      a -c constraint pin upgrades a range to scannable.
  *
  * All names are PEP 503 normalized (lowercase, runs of -_. → single -) so they
  * match OSV / PyPI / the resolved-deps key.
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
  */
 const fs = require("fs");
+const path = require("path");
 const TOML = require("smol-toml");
 
 function pep503(name) { return String(name || "").toLowerCase().replace(/[-_.]+/g, "-"); }
@@ -17,6 +24,15 @@ function stripOp(v) { return String(v || "").replace(/^[=~!<>]+/, "").trim(); }
 function isPinned(spec) { return /^==\s*\d[\w.\-+!]*$/.test(String(spec || "").trim()); }
 function isConcrete(v) { return /^\d+(\.\d+)*([.\-+]\S+)?$/.test(String(v || "")); }
 
+// Split a PEP 508 requirement string ("requests[extra]==2.31.0 ; marker") into
+// { name, spec } — env markers (after ";") and extras ("[...]") are dropped.
+function splitPep508(req) {
+	const s = String(req || "").split(";")[0].trim();
+	const m = s.match(/^([A-Za-z0-9._-]+)\s*(\[[^\]]*\])?\s*(.*)$/);
+	if (!m) return { name: null, spec: "" };
+	return { name: m[1], spec: m[3].trim() };
+}
+
 // poetry.lock / uv.lock / pdm.lock all use [[package]] name/version arrays.
 function parseTomlPackages(filePath, type) {
 	const data = TOML.parse(fs.readFileSync(filePath, "utf8"));
@@ -24,9 +40,11 @@ function parseTomlPackages(filePath, type) {
 	const deps = [];
 	for (const p of pkgs) {
 		if (!p.name || !p.version) continue;
-		// pdm marks groups; poetry/uv don't reliably → default prod.
+		// pdm/poetry≥1.5 use `groups`; classic poetry.lock (≤1.4) uses `category = "dev"`.
 		const groups = Array.isArray(p.groups) ? p.groups : null;
-		const isDev = groups ? groups.every(g => g === "dev") : false;
+		const isDev = groups
+			? groups.every(g => g === "dev")
+			: (p.category ? String(p.category).toLowerCase() === "dev" : false);
 		deps.push({ name: pep503(p.name), version: String(p.version), scope: isDev ? "dev" : "prod", isDev });
 	}
 	return { manifestPath: filePath, manifestType: type, deps };
@@ -50,22 +68,101 @@ function parsePipfileLock(filePath) {
 	return { manifestPath: filePath, manifestType: "Pipfile.lock", deps };
 }
 
-function parseRequirementsTxt(filePath) {
-	const lines = fs.readFileSync(filePath, "utf8").split(/\r?\n/);
+// pyproject.toml — fallback when no lockfile. Reads PEP 621 [project] and the
+// poetry tool table. Only exact pins are scannable (PEP 621 "==x"; poetry exact
+// "x"); ranges (^/~/>=/wildcards) are counted in `skipped` like requirements.txt.
+function parsePyprojectToml(filePath) {
+	const data = TOML.parse(fs.readFileSync(filePath, "utf8"));
 	const deps = [];
 	let skipped = 0;
+	const seen = new Set();
+	const push = (rawName, version, scope) => {
+		const name = pep503(rawName);
+		if (!name || name === "python") return;
+		const k = `${name}@${version}`;
+		if (seen.has(k)) return; seen.add(k);
+		deps.push({ name, version, scope, isDev: scope === "dev" });
+	};
+	// PEP 508 specs ("requests==2.31.0") — exact "==" pins only.
+	const addSpec = (req, scope) => {
+		const { name, spec } = splitPep508(req);
+		if (!name) return;
+		if (isPinned(spec)) push(name, stripOp(spec), scope);
+		else skipped++;
+	};
+	// Poetry constraints ("^2.0" / "==4.2" / bare exact "4.2.0" / { version }).
+	const addPoetry = (name, val, scope) => {
+		if (pep503(name) === "python") return;            // the interpreter, not a dep
+		const spec = typeof val === "string" ? val : (val && typeof val === "object" ? (val.version || "") : "");
+		const s = String(spec || "").trim();
+		if (isConcrete(s)) push(name, s, scope);          // poetry: bare version == exact
+		else if (isPinned(s)) push(name, stripOp(s), scope);
+		else skipped++;
+	};
+
+	// PEP 621 [project]
+	const proj = data.project || {};
+	for (const req of (Array.isArray(proj.dependencies) ? proj.dependencies : [])) addSpec(req, "prod");
+	for (const [group, arr] of Object.entries(proj["optional-dependencies"] || {})) {
+		const isDev = /^(dev|test|tests|lint|docs|typing|type|check)$/i.test(group);
+		for (const req of (Array.isArray(arr) ? arr : [])) addSpec(req, isDev ? "dev" : "prod");
+	}
+	// Poetry [tool.poetry]
+	const poetry = (data.tool && data.tool.poetry) || {};
+	for (const [name, v] of Object.entries(poetry.dependencies || {})) addPoetry(name, v, "prod");
+	for (const [name, v] of Object.entries(poetry["dev-dependencies"] || {})) addPoetry(name, v, "dev");
+	for (const grp of Object.values(poetry.group || {})) {
+		for (const [name, v] of Object.entries((grp && grp.dependencies) || {})) addPoetry(name, v, "dev");
+	}
+	return { manifestPath: filePath, manifestType: "pyproject.toml", deps, skipped };
+}
+
+// Walk a requirements.txt graph, following -r/--requirement (deps) and
+// -c/--constraint (version pins) includes recursively. `kind` is "req" for the
+// dependency graph and "constraint" for files reached via -c.
+function collectReqGraph(filePath, seen, kind, acc) {
+	const real = path.resolve(filePath);
+	if (seen.has(real)) return;          // cycle / re-include guard
+	seen.add(real);
+	if (seen.size > 200) return;         // sanity bound
+	let lines;
+	try { lines = fs.readFileSync(real, "utf8").split(/\r?\n/); }
+	catch { acc.missing.push(real); return; }
+	const dir = path.dirname(real);
 	for (const raw of lines) {
-		const line = raw.replace(/#.*$/, "").trim();
+		const line = raw.replace(/(^|\s)#.*$/, "").trim();
 		if (!line) continue;
-		if (line.startsWith("-")) continue;                 // -e ., -r other.txt, --flags
-		const m = line.match(/^([A-Za-z0-9._-]+)\s*(\[[^\]]*\])?\s*(.*)$/);
-		if (!m) continue;
-		const name = pep503(m[1]);
-		const spec = m[3].split(";")[0].trim();              // drop env markers
-		if (isPinned(spec)) deps.push({ name, version: stripOp(spec), scope: "prod", isDev: false });
-		else skipped++;
+		const rMatch = line.match(/^(?:-r|--requirement)[=\s]+(.+)$/);
+		if (rMatch) { collectReqGraph(path.resolve(dir, rMatch[1].trim()), seen, kind, acc); continue; }
+		const cMatch = line.match(/^(?:-c|--constraint)[=\s]+(.+)$/);
+		if (cMatch) { collectReqGraph(path.resolve(dir, cMatch[1].trim()), seen, "constraint", acc); continue; }
+		if (line.startsWith("-")) continue;              // -e ., --hash, other flags
+		const { name, spec } = splitPep508(line);
+		if (!name) continue;
+		const n = pep503(name);
+		if (kind === "constraint") acc.constraints.set(n, spec);
+		else acc.reqs.push({ name: n, spec });
+	}
+}
+
+function parseRequirementsTxt(filePath) {
+	const acc = { reqs: [], constraints: new Map(), missing: [] };
+	collectReqGraph(filePath, new Set(), "req", acc);
+	const deps = [];
+	let skipped = 0;
+	const seen = new Set();
+	for (const r of acc.reqs) {
+		let version = null;
+		if (isPinned(r.spec)) version = stripOp(r.spec);
+		else if (acc.constraints.has(r.name) && isPinned(acc.constraints.get(r.name))) {
+			version = stripOp(acc.constraints.get(r.name));  // range pinned by -c constraint
+		}
+		if (!version) { skipped++; continue; }
+		const k = `${r.name}@${version}`;
+		if (seen.has(k)) continue; seen.add(k);
+		deps.push({ name: r.name, version, scope: "prod", isDev: false });
 	}
-	return { manifestPath: filePath, manifestType: "requirements.txt", deps, skipped };
+	return { manifestPath: filePath, manifestType: "requirements.txt", deps, skipped, missing: acc.missing };
 }
 
-module.exports = { pep503, isConcrete, parsePoetryLock, parseUvLock, parsePdmLock, parsePipfileLock, parseRequirementsTxt };
+module.exports = { pep503, isConcrete, splitPep508, parsePoetryLock, parseUvLock, parsePdmLock, parsePipfileLock, parsePyprojectToml, parseRequirementsTxt };