fad-checker 2.0.0 → 2.1.0

package/lib/codecs/pypi/registry.js

@@ -6,6 +6,9 @@
  *   → { info: { version, classifiers[] }, releases: { "<v>": [{ yanked, yanked_reason }] } }
  *
  * Cached in ~/.fad-checker/pypi-cache.json for 24h.
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
  */
 const fs = require("fs");
 const path = require("path");
@@ -26,8 +29,22 @@ function cmp(a, b) {
 	return 0;
 }
 
+// PyPI's info.license is notoriously free-form (sometimes the full license text),
+// so prefer the structured "License :: …" trove classifiers; fall back to a short
+// info.license string only.
+function pypiLicense(info) {
+	const fromClassifiers = (info?.classifiers || [])
+		.filter(c => /^License ::/.test(c) && !/OSI Approved$/.test(c))
+		.map(c => c.split("::").pop().trim())
+		.filter(Boolean);
+	if (fromClassifiers.length) return fromClassifiers;
+	const raw = (info?.license || "").trim();
+	if (raw && raw.length <= 50 && !raw.includes("\n")) return raw;
+	return null;
+}
+
 function pypiToFindings(data, { version }) {
-	const out = { outdated: null, yanked: null, inactive: false };
+	const out = { outdated: null, yanked: null, inactive: false, license: null };
 	const latest = data.info?.version;
 	if (latest && cmp(latest, version) > 0) out.outdated = { latest };
 	const rel = data.releases?.[version];
@@ -35,6 +52,7 @@ function pypiToFindings(data, { version }) {
 		out.yanked = { reason: rel.find(f => f.yanked_reason)?.yanked_reason || null };
 	}
 	if ((data.info?.classifiers || []).some(c => /Development Status :: 7 - Inactive/i.test(c))) out.inactive = true;
+	out.license = pypiLicense(data.info);
 	return out;
 }
 
@@ -51,7 +69,7 @@ async function fetchProject(name, { offline }) {
 async function checkPypiRegistryDeps(deps, opts = {}) {
 	const { verbose, offline, allLibs = true, concurrency = 8 } = opts;
 	const targets = [...deps.values()].filter(d => d.ecosystem === "pypi" && d.version);
-	const result = { deprecated: [], outdated: [] };
+	const result = { deprecated: [], outdated: [], licensed: [] };
 	if (!targets.length) return result;
 	const cache = loadCache();
 	const fresh = cache.meta?.fetchedAt && (Date.now() - cache.meta.fetchedAt) < CACHE_MAX_AGE_MS;
@@ -64,12 +82,13 @@ async function checkPypiRegistryDeps(deps, opts = {}) {
 			const data = await fetchProject(t.name, { offline });
 			if (data && !data.error) {
 				const f = pypiToFindings(data, { version: t.version });
-				ex = { yanked: f.yanked, inactive: f.inactive, latest: f.outdated?.latest || null };
+				ex = { yanked: f.yanked, inactive: f.inactive, latest: f.outdated?.latest || null, license: f.license || null };
 				cache.entries[key] = ex;
 			} else {
-				ex = { yanked: null, inactive: false, latest: null };
+				ex = { yanked: null, inactive: false, latest: null, license: null };
 			}
 		}
+		if (ex.license) result.licensed.push({ dep: t, licenses: ex.license, source: "pypi" });
 		if (ex.yanked) {
 			result.deprecated.push({ dep: t, severity: "HIGH", replacement: null, reason: `Version yanked on PyPI${ex.yanked.reason ? `: ${ex.yanked.reason}` : ""}`, source: "pypi" });
 			if (verbose) process.stdout.write(`  yanked: ${t.name}@${t.version}\n`);
@@ -86,4 +105,4 @@ async function checkPypiRegistryDeps(deps, opts = {}) {
 	return result;
 }
 
-module.exports = { pypiToFindings, checkPypiRegistryDeps };
+module.exports = { pypiToFindings, pypiLicense, checkPypiRegistryDeps };

package/lib/codecs/pypi.codec.js

@@ -5,6 +5,9 @@
  * collection (poetry.lock/Pipfile.lock/uv.lock/pdm.lock, requirements.txt
  * fallback), PyPI registry (yanked/inactive + outdated), and EOL.
  * Per-directory precedence: a lockfile wins; else requirements.txt best-effort.
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
  */
 const fs = require("fs");
 const path = require("path");
@@ -19,6 +22,8 @@ const LOCKS = [
 	["pdm.lock", P.parsePdmLock],
 ];
 
+const FALLBACK_MANIFESTS = ["pyproject.toml", "requirements.txt"];
+
 function findPyDirs(dir) {
 	const groups = [];
 	const stack = [dir];
@@ -26,7 +31,7 @@ function findPyDirs(dir) {
 		const cur = stack.pop();
 		let entries; try { entries = fs.readdirSync(cur, { withFileTypes: true }); } catch { continue; }
 		const names = new Set(entries.filter(e => e.isFile()).map(e => e.name));
-		if ([...LOCKS.map(l => l[0]), "requirements.txt"].some(n => names.has(n))) groups.push({ dir: cur, names });
+		if ([...LOCKS.map(l => l[0]), ...FALLBACK_MANIFESTS].some(n => names.has(n))) groups.push({ dir: cur, names });
 		for (const e of entries) if (e.isDirectory() && !SKIP.has(e.name)) stack.push(path.join(cur, e.name));
 	}
 	return groups;
@@ -36,7 +41,7 @@ module.exports = {
 	id: "pypi",
 	label: "PyPI",
 	osvEcosystem: "PyPI",
-	manifestNames: ["poetry.lock", "Pipfile.lock", "uv.lock", "pdm.lock", "requirements.txt"],
+	manifestNames: ["poetry.lock", "Pipfile.lock", "uv.lock", "pdm.lock", "pyproject.toml", "requirements.txt"],
 
 	detect(dir) { return findPyDirs(dir).length > 0; },
 
@@ -55,14 +60,33 @@ module.exports = {
 				const fp = path.join(g.dir, lock[0]);
 				try { const { deps } = lock[1](fp); for (const d of deps) add(d, fp); }
 				catch (e) { warnings.push({ type: "parse-error", manifestPath: fp, message: `${lock[0]} parse failed: ${e.message}` }); }
-			} else if (g.names.has("requirements.txt")) {
+				continue;   // lockfile is authoritative for this directory
+			}
+			// No lockfile → best-effort from pyproject.toml and/or requirements.txt.
+			let pinned = 0, skipped = 0;
+			const sources = [];
+			if (g.names.has("pyproject.toml")) {
+				const fp = path.join(g.dir, "pyproject.toml");
+				try {
+					const r = P.parsePyprojectToml(fp);
+					for (const d of r.deps) add(d, fp);
+					pinned += r.deps.length; skipped += r.skipped;
+					if (r.deps.length || r.skipped) sources.push("pyproject.toml");
+				} catch (e) { warnings.push({ type: "parse-error", manifestPath: fp, message: `pyproject.toml parse failed: ${e.message}` }); }
+			}
+			if (g.names.has("requirements.txt")) {
 				const fp = path.join(g.dir, "requirements.txt");
 				try {
-					const { deps, skipped } = P.parseRequirementsTxt(fp);
-					for (const d of deps) add(d, fp);
-					warnings.push({ type: "no-lockfile", manifestPath: fp, message: `requirements.txt (no lockfile) — best-effort: ${deps.length} pinned, ${skipped} range(s) skipped` });
+					const r = P.parseRequirementsTxt(fp);
+					for (const d of r.deps) add(d, fp);
+					pinned += r.deps.length; skipped += r.skipped;
+					sources.push("requirements.txt");
+					for (const miss of (r.missing || [])) warnings.push({ type: "missing-include", manifestPath: fp, message: `referenced requirements file not found: ${miss}` });
 				} catch (e) { warnings.push({ type: "parse-error", manifestPath: fp, message: `requirements.txt parse failed: ${e.message}` }); }
 			}
+			if (sources.length) {
+				warnings.push({ type: "no-lockfile", manifestPath: g.dir, message: `no lockfile (${sources.join(" + ")}) — best-effort: ${pinned} pinned, ${skipped} range(s) skipped` });
+			}
 		}
 		return { deps: out, warnings };
 	},

package/lib/codecs/recipes.js

@@ -4,6 +4,9 @@
  * Extrait de lib/cve-report.js (ECO_RECIPE + snippet helpers). Clés = id de codec
  * (== ecosystemType). Chaque recette : { label, pinSection, pinIntro(cnt),
  * snippet(items), directSection }. `items` = [{ groupId, artifactId, fixVersion }].
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
  */
 function esc(s) {
 	if (s == null) return "";
@@ -105,4 +108,28 @@ const nuget = {
 	directSection: "B. Then restore and commit packages.lock.json",
 };
 
-module.exports = { maven, npm, yarn, composer, pypi, nuget, dependencyManagementSnippet, npmOverridesSnippet, yarnResolutionsSnippet, composerRequireSnippet, pipInstallSnippet, dotnetAddSnippet };
+function goGetSnippet(items) {
+	return items.map(it => `go get ${esc(it.artifactId)}@v${esc(it.fixVersion)}`).join("\n");
+}
+
+const go = {
+	label: "Go",
+	pinSection: "A. Upgrade the affected modules",
+	pinIntro: cnt => `Run for the ${cnt} affected module${cnt > 1 ? "s" : ""}, then commit go.mod / go.sum (go mod tidy):`,
+	snippet: goGetSnippet,
+	directSection: "B. Or bump them in go.mod and run go mod tidy",
+};
+
+function bundleUpdateSnippet(items) {
+	return items.map(it => `bundle update ${esc(it.artifactId)} --conservative   # to >= ${esc(it.fixVersion)}`).join("\n");
+}
+
+const ruby = {
+	label: "Ruby",
+	pinSection: "A. Update the affected gems",
+	pinIntro: cnt => `Run for the ${cnt} affected gem${cnt > 1 ? "s" : ""}, then commit Gemfile.lock:`,
+	snippet: bundleUpdateSnippet,
+	directSection: "B. Or pin them in the Gemfile and run bundle update",
+};
+
+module.exports = { maven, npm, yarn, composer, pypi, nuget, go, ruby, dependencyManagementSnippet, npmOverridesSnippet, yarnResolutionsSnippet, composerRequireSnippet, pipInstallSnippet, dotnetAddSnippet, goGetSnippet, bundleUpdateSnippet };

package/lib/codecs/ruby/parse.js

@@ -0,0 +1,42 @@
+/**
+ * lib/codecs/ruby/parse.js — parse Gemfile.lock.
+ *
+ * The GEM section's `specs:` block lists resolved gems at 4-space indent
+ * (`name (version)`); their transitive requirements sit at 6-space indent and
+ * are skipped (they reappear as their own 4-space spec entry).
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
+ */
+const fs = require("fs");
+
+/** Parse Gemfile.lock text → { deps: [{ name, version, scope, isDev }] }. */
+function parseGemfileLock(text) {
+	const deps = [];
+	const seen = new Set();
+	const lines = String(text || "").split(/\r?\n/);
+	let inSpecs = false;
+	for (const raw of lines) {
+		const trimmed = raw.trim();
+		if (/^(GEM|GIT|PATH|PLATFORMS|DEPENDENCIES|BUNDLED WITH|CHECKSUMS)\b/.test(trimmed) && !raw.startsWith(" ")) {
+			inSpecs = false;
+		}
+		if (trimmed === "specs:") { inSpecs = true; continue; }
+		if (!inSpecs) continue;
+		// Exactly 4 leading spaces = a resolved gem; 6+ = its dependency (skip).
+		const m = raw.match(/^ {4}([A-Za-z0-9._-]+) \(([^)]+)\)\s*$/);
+		if (!m) continue;
+		const name = m[1];
+		// Version may carry a platform suffix ("1.2.3-x86_64-linux"); keep the version.
+		const version = m[2].split(/[ -]/)[0];
+		const key = `${name}@${version}`;
+		if (seen.has(key)) continue;
+		seen.add(key);
+		deps.push({ name, version, scope: "compile", isDev: false });
+	}
+	return { deps };
+}
+
+function parseGemfileLockFile(fp) { return parseGemfileLock(fs.readFileSync(fp, "utf8")); }
+
+module.exports = { parseGemfileLock, parseGemfileLockFile };

package/lib/codecs/ruby/registry.js

@@ -0,0 +1,76 @@
+/**
+ * lib/codecs/ruby/registry.js — query RubyGems for latest version + licenses.
+ *
+ * API: https://rubygems.org/api/v1/gems/<gem>.json → { version, licenses[] }
+ * One call yields both outdated (latest stable) and the SPDX-ish license list.
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
+ */
+const fs = require("fs");
+const path = require("path");
+const os = require("os");
+let pLimit; try { pLimit = require("p-limit"); } catch { pLimit = () => (fn) => fn(); }
+
+const CACHE_DIR = path.join(os.homedir(), ".fad-checker");
+const CACHE_PATH = path.join(CACHE_DIR, "rubygems-cache.json");
+const CACHE_MAX_AGE_MS = 24 * 3600 * 1000;
+const API = "https://rubygems.org/api/v1/gems";
+
+function loadCache() { try { return JSON.parse(fs.readFileSync(CACHE_PATH, "utf8")); } catch { return { entries: {}, meta: {} }; } }
+function saveCache(d) { try { fs.mkdirSync(CACHE_DIR, { recursive: true }); fs.writeFileSync(CACHE_PATH, JSON.stringify(d)); } catch { /* ignore */ } }
+function isStable(v) { return /^\d+(\.\d+)*$/.test(String(v || "")); }
+function cmp(a, b) {
+	const pa = String(a).split(/[.\-+]/).map(n => parseInt(n, 10) || 0);
+	const pb = String(b).split(/[.\-+]/).map(n => parseInt(n, 10) || 0);
+	for (let i = 0; i < Math.max(pa.length, pb.length); i++) { const d = (pa[i] || 0) - (pb[i] || 0); if (d) return d > 0 ? 1 : -1; }
+	return 0;
+}
+
+// Pure extractor: RubyGems gem JSON → { latest, license }.
+function gemToFindings(data) {
+	const out = { latest: null, license: null };
+	if (data?.version && isStable(data.version)) out.latest = data.version;
+	const lic = data?.licenses;
+	if (Array.isArray(lic) && lic.length) out.license = lic;
+	return out;
+}
+
+async function fetchGem(name, { offline }) {
+	if (offline) return null;
+	try {
+		const res = await fetch(`${API}/${encodeURIComponent(name)}.json`, { headers: { "User-Agent": "fad-checker-rubygems" } });
+		if (!res.ok) return { error: `HTTP ${res.status}` };
+		return await res.json();
+	} catch (e) { return { error: e.message }; }
+}
+
+async function checkRubyRegistryDeps(deps, opts = {}) {
+	const { verbose, offline, allLibs = true, concurrency = 8 } = opts;
+	const targets = [...deps.values()].filter(d => d.ecosystem === "ruby" && d.version);
+	const result = { deprecated: [], outdated: [], licensed: [] };
+	if (!targets.length) return result;
+	const cache = loadCache();
+	const fresh = cache.meta?.fetchedAt && (Date.now() - cache.meta.fetchedAt) < CACHE_MAX_AGE_MS;
+	if (!fresh && !offline) cache.entries = {};
+	const limit = pLimit(concurrency);
+	await Promise.all(targets.map(t => limit(async () => {
+		const key = `${t.name}@${t.version}`;
+		let ex = cache.entries[key];
+		if (!ex) {
+			const data = await fetchGem(t.name, { offline });
+			ex = (data && !data.error) ? gemToFindings(data) : { latest: null, license: null };
+			if (data && !data.error) cache.entries[key] = ex;
+		}
+		if (ex.license) result.licensed.push({ dep: t, licenses: ex.license, source: "rubygems" });
+		if (allLibs && ex.latest && cmp(ex.latest, t.version) > 0) {
+			result.outdated.push({ dep: t, latest: ex.latest, releaseDate: null });
+			if (verbose) process.stdout.write(`  outdated: ${t.name} ${t.version} → ${ex.latest}\n`);
+		}
+	})));
+	cache.meta = { fetchedAt: Date.now() };
+	saveCache(cache);
+	return result;
+}
+
+module.exports = { gemToFindings, checkRubyRegistryDeps };

package/lib/codecs/ruby.codec.js

@@ -0,0 +1,66 @@
+/**
+ * lib/codecs/ruby.codec.js — codec Ruby (Bundler).
+ *
+ * Reads Gemfile.lock (authoritative resolved versions). Vuln recall via OSV
+ * (ecosystem "RubyGems"); outdated + licenses via the RubyGems API.
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
+ */
+const fs = require("fs");
+const path = require("path");
+const { makeDepRecord, coordKeyFor } = require("../dep-record");
+const R = require("./ruby/parse");
+
+const SKIP = new Set([".git", ".idea", ".vscode", "node_modules", "dist", "build", "out", "target", "vendor", "tmp"]);
+
+function findGemfileLocks(dir) {
+	const found = [];
+	const stack = [dir];
+	while (stack.length) {
+		const cur = stack.pop();
+		let entries; try { entries = fs.readdirSync(cur, { withFileTypes: true }); } catch { continue; }
+		for (const e of entries) {
+			if (e.isFile() && e.name === "Gemfile.lock") found.push(path.join(cur, e.name));
+			else if (e.isDirectory() && !SKIP.has(e.name)) stack.push(path.join(cur, e.name));
+		}
+	}
+	return found;
+}
+
+module.exports = {
+	id: "ruby",
+	label: "Ruby",
+	osvEcosystem: "RubyGems",
+	manifestNames: ["Gemfile.lock"],
+
+	detect(dir) { return findGemfileLocks(dir).length > 0; },
+
+	async collect(dir, opts = {}) {
+		const { deps2Exclude } = opts;
+		const out = new Map();
+		const warnings = [];
+		for (const fp of findGemfileLocks(dir)) {
+			try {
+				const { deps } = R.parseGemfileLockFile(fp);
+				for (const d of deps) {
+					if (deps2Exclude && deps2Exclude.test(d.name)) continue;
+					out.set(coordKeyFor("ruby", "", d.name), makeDepRecord({ ecosystem: "ruby", namespace: "", name: d.name, version: d.version, manifestPath: fp, scope: d.scope, isDev: false }));
+				}
+			} catch (e) { warnings.push({ type: "parse-error", manifestPath: fp, message: `Gemfile.lock parse failed: ${e.message}` }); }
+		}
+		return { deps: out, warnings };
+	},
+
+	coordKey(d) { return coordKeyFor("ruby", "", d.name); },
+	formatCoord(d) { return d.name; },
+	osvPackageName(d) { return d.name; },
+
+	async checkRegistry(deps, opts = {}) {
+		const { checkRubyRegistryDeps } = require("./ruby/registry");
+		return checkRubyRegistryDeps(deps, opts);
+	},
+	resolveEolProduct() { return null; },
+	recipe: require("./recipes").ruby,
+	nativeScanners: [],
+};

package/lib/codecs/select.js

@@ -5,6 +5,9 @@
  *   requested  : "auto" | "all" | "maven" | "maven,npm,pypi" | (legacy "both"|"npm")
  *   available  : ids candidats — pour "auto", les codecs détectés ; sinon tous.
  *   flags      : { noCodecs: ["npm", ...], noJs: bool }
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
  */
 function resolveActiveCodecs(requested, available, flags = {}) {
 	const { noCodecs = [], noJs = false } = flags;

package/lib/codecs/yarn.codec.js

@@ -6,6 +6,9 @@
  * recette (`resolutions`) au report. Le scan JS est fait UNE SEULE FOIS par le
  * codec npm (qui ramasse package-lock ET yarn.lock) — yarn.collect est un no-op
  * pour éviter le double scan ; le registre des codecs ne l'appelle pas.
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
  */
 const npm = require("./npm.codec");
 

package/lib/config.js

@@ -3,6 +3,9 @@
  *
  * Stores credentials and per-user preferences that should survive across runs.
  * Currently: NVD API key (so users don't have to re-export the env var).
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
  */
 const fs = require("fs");
 const path = require("path");

package/lib/core.js

@@ -1,6 +1,9 @@
 /**
  * lib/core.js — pure logic for parsing and cleaning Maven POMs.
  * No CLI, no console formatting. Callers pass options explicitly.
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
  */
 const fs = require("fs");
 const path = require("path");
@@ -99,10 +102,20 @@ async function parsePom(pomPath, allPomMetadata) {
 		groupId,
 		artifactId,
 		version,
+		// Maven model expressions for the current project. These are built-ins,
+		// not <properties> — ${project.version} always means THIS project's
+		// version (never overridable by a property or an imported BOM). The
+		// pom.* aliases mirror Maven's legacy synonyms.
 		localVars: {
 			"project.groupId": groupId,
 			"project.artifactId": artifactId,
 			"project.version": version,
+			"pom.groupId": groupId,
+			"pom.artifactId": artifactId,
+			"pom.version": version,
+			...(parentInfo?.groupId ? { "project.parent.groupId": parentInfo.groupId } : {}),
+			...(parentInfo?.artifactId ? { "project.parent.artifactId": parentInfo.artifactId } : {}),
+			...(parentInfo?.version ? { "project.parent.version": parentInfo.version } : {}),
 		},
 	};
 
@@ -199,7 +212,31 @@ async function getAllInheritedProps(pomPath, allPomMetadata, cache) {
 		merged.dependencyManagement.push(...imported.dependencyManagement);
 	}
 
-	resolveParentPath(pomPath, parentInfo, allPomMetadata);
+	// Cache the (still-mutating) object BEFORE recursing into the parent so a
+	// malformed parent cycle (A→B→A) returns this partial result instead of
+	// recursing forever. `merged` is mutated in place afterwards, so the cached
+	// reference ends up fully populated.
+	cache[pomPath] = merged;
+
+	// Inherit <properties> from a LOCAL parent POM as the BASE layer — the child
+	// overrides the parent, exactly like native Maven. (dependencyManagement and
+	// parent <dependencies> need no special handling here: collectResolvedDeps
+	// already merges them across the whole tree by g:a.) External parents
+	// (e.g. spring-boot-starter-parent) aren't in the source tree, so their
+	// properties can't be inherited without a network fetch — those versions
+	// still surface as unresolved, as before.
+	const parentPath = resolveParentPath(pomPath, parentInfo, allPomMetadata);
+	if (parentPath && parentPath !== pomPath) {
+		const parentMerged = await getAllInheritedProps(parentPath, allPomMetadata, cache);
+		merged.properties = { ...parentMerged.properties, ...merged.properties };
+	}
+
+	// Built-in project.* coordinates (${project.version}, ${project.groupId}, …).
+	// Applied LAST so the current POM's own values win — even over an inherited
+	// parent property or an imported BOM's project.* — letting an intra-reactor
+	// dep declared "<version>${project.version}</version>" resolve to THIS
+	// module's version.
+	merged.properties = { ...merged.properties, ...(meta.localVars || {}) };
 
 	cache[pomPath] = merged;
 	return merged;

package/lib/cpe.js

@@ -14,6 +14,9 @@
  *      and whether we can upgrade the match confidence.
  *   2. Given a dep coord, find CVEs in the index whose CPE configurations
  *      it satisfies. (Future use — kept compatible with the data shape.)
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
  */
 const { compareMavenVersions } = require("./maven-version");
 
@@ -144,6 +147,21 @@ function nodeAffectsDep(node, dep, cpeCoordMap) {
 	return false;
 }
 
+/**
+ * A node is "context-only" when it carries no vulnerable cpeMatch (recursively) —
+ * e.g. the "…AND runs on linux_kernel" platform node, whose CPEs are all
+ * `vulnerable: false`. In an AND configuration those nodes are runtime context we
+ * deliberately ignore (we assume the library is in use), so they must NOT be
+ * required for the config to count as affecting the dep.
+ */
+function nodeIsContextOnly(node) {
+	if (!node) return true;
+	const matches = node.cpeMatch || node.cpe_match || [];
+	if (matches.some(m => m.vulnerable !== false)) return false;
+	if (Array.isArray(node.children) && node.children.some(c => !nodeIsContextOnly(c))) return false;
+	return true;
+}
+
 /**
  * Decide whether a CPE (parsed) refers to the same artifact as a dep.
  * Lookup order:
@@ -221,11 +239,18 @@ function evaluateCveForDep(cveRecord, dep, cpeCoordMap) {
 	for (const cfg of configs) {
 		const nodes = cfg.nodes || [];
 		const op = (cfg.operator || "OR").toUpperCase();
-		const evals = nodes.map(n => {
-			const hit = nodeAffectsDep(n, dep, map);
-			return hit;
-		});
-		const passes = op === "AND" ? evals.every(Boolean) : evals.some(Boolean);
+		let passes;
+		if (op === "AND") {
+			// AND configs are typically (vulnerable software) AND (platform/runtime
+			// context). We assume the library is in use, so context-only nodes are not
+			// required — only the vulnerable node(s) must match the dep version. Without
+			// this, a "vulnerable:false" platform node makes .every() false and the real
+			// finding is wrongly dropped as a CPE false-positive.
+			const vulnNodes = nodes.filter(n => !nodeIsContextOnly(n));
+			passes = vulnNodes.length > 0 && vulnNodes.every(n => nodeAffectsDep(n, dep, map));
+		} else {
+			passes = nodes.some(n => nodeAffectsDep(n, dep, map));
+		}
 		if (passes) {
 			// Determine confidence: scan vulnerable cpeMatches that hit
 			for (const n of nodes) {