fad-checker 2.0.1 → 2.1.0

package/fad-checker.js

@@ -169,12 +169,27 @@ program
 	.option("-e, --exclude <exclude>", "regex of groupId to exclude, e.g. '^(client|private)\\.'")
 	.option("-v, --verbose", "verbose")
 	// Defaults: report + transitive + allLibs all ON. Use --no-* to disable.
-	.option("--no-report", "skip the CVE / EOL / obsolete report")
+	.option("--no-report", "write NO output files at all — the scan, terminal summary and --fail-on gate still run (gate-only / CI mode)")
 	.option("--no-transitive", "skip transitive dependency resolution")
 	.option("--no-all-libs", "skip Maven Central queries (outdated check + missing-on-central check)")
 	.option("--no-osv", "skip OSV.dev (Google/GitHub aggregated Maven CVE feed)")
 	.option("--no-nvd", "skip NIST NVD enrichment of matched CVEs")
-	.option("--offline", "no network: use cached CVE/OSV/NVD/POM data only")
+	.option("--no-epss", "skip EPSS (FIRST.org exploit-prediction) enrichment")
+	.option("--no-kev", "skip CISA KEV (known-exploited) enrichment")
+	// Output family: each --report-<type> takes an OPTIONAL path (omit → default name
+	// under --report-output). With NO --report-* flag at all, HTML + .doc are written
+	// by default. --no-report writes nothing (scan + gate only).
+	.option("--report-html [file]", "write the self-contained HTML report (default: <report-output>/cve-report.html)")
+	.option("--report-doc [file]", "write the Word-compatible .doc report (default: <report-output>/cve-report.doc)")
+	.option("--report-sbom [file]", "write a CycloneDX 1.6 SBOM, vulnerabilities inline (default: <report-output>/sbom.cdx.json)")
+	.option("--report-csaf [file]", "write a CSAF 2.0 VEX document (default: <report-output>/csaf-vex.json)")
+	.option("--report-json [file]", "write a flat machine-readable findings JSON (default: <report-output>/findings.json)")
+	.option("--report-sarif [file]", "write a SARIF 2.1.0 log for GitHub/GitLab code scanning (default: <report-output>/fad.sarif)")
+	.option("--fail-on <level>", "exit non-zero if a production finding meets <level>: low|medium|high|critical|kev|none", "none")
+	.option("--ignore <file>", "suppress findings listed in <file> (CVE ids / coords / globs, one per line)")
+	.option("--vex <file>", "ingest a CSAF VEX: suppress CVEs marked not_affected/fixed")
+	.option("--no-licenses", "skip license detection + copyleft policy check")
+	.option("--offline", "no network: use cached CVE/OSV/NVD/EPSS/KEV/POM data only")
 	.option("--set-nvd-key <key>", "save NVD API key to ~/.fad-checker/config.json (10× faster NVD enrichment)")
 	.option("--show-config", "print the persisted ~/.fad-checker/config.json")
 	.option("--export-cache <file>", "tar.gz/zip the ~/.fad-checker/ caches to <file> (excludes config.json by default)")
@@ -191,13 +206,16 @@ program
 	.option("--no-retire", "skip retire.js vendored-JS scan")
 	.option("--retire-refresh", "ignore retire cache and re-scan")
 	.option("--transitive-depth <n>", "max transitive depth", "6")
-	.option("--ecosystem <list>", "codecs to run: auto|all|<comma list> e.g. maven,npm,nuget,composer,pypi (default: auto = detected)", "auto")
+	.option("--ecosystem <list>", "codecs to run: auto|all|<comma list> e.g. maven,npm,nuget,composer,pypi,go,ruby (default: auto = detected)", "auto")
 	.option("--no-maven", "skip the Maven codec")
 	.option("--no-npm", "skip the npm codec")
 	.option("--no-yarn", "skip the Yarn codec")
 	.option("--no-nuget", "skip the NuGet (C#/.NET) codec")
 	.option("--no-composer", "skip the Composer (PHP) codec")
 	.option("--no-pypi", "skip the PyPI (Python) codec")
+	.option("--no-go", "skip the Go codec")
+	.option("--no-ruby", "skip the Ruby (Bundler) codec")
+	.option("--no-jars", "skip scanning embedded .jar/.war/.ear binaries for Maven coordinates")
 	.option("--no-js", "alias: skip JS/npm/yarn manifests even if present (Maven-only)")
 	.option("--repo <url...>", "extra Maven repository URL(s) to try before Maven Central. Supports https://user:pass@host/path/. Repeatable.")
 	.option("--add-repo <name>", "persist a Maven repo: --add-repo <name> <url> [--auth user:pass]")
@@ -209,6 +227,18 @@ program.parse(process.argv);
 const options = program.opts();
 const deps2Exclude = options.exclude ? new RegExp(options.exclude) : null;
 const verbose = !!options.verbose;
+
+// Validate --fail-on early: an unrecognised value (typo like "hgih", wrong case)
+// must HARD-FAIL, never silently disable the CI gate.
+if (options.failOn) {
+	const FAIL_ON_LEVELS = ["none", "low", "medium", "high", "critical", "kev"];
+	const lvl = String(options.failOn).toLowerCase();
+	if (!FAIL_ON_LEVELS.includes(lvl)) {
+		console.error(chalk.red(`❌  invalid --fail-on "${options.failOn}" — expected one of: ${FAIL_ON_LEVELS.join(", ")}`));
+		process.exit(2);
+	}
+	options.failOn = lvl;
+}
 // Read-only when no target is given. No need for an explicit --test flag.
 const readOnly = !options.target;
 
@@ -223,10 +253,18 @@ if (options.src && options.importAnonymized) {
 }
 
 if (options.src && options.target) {
-	const rel = path.relative(path.resolve(options.src), path.resolve(options.target));
-	const isSubdir = !rel || (!rel.startsWith("..") && !path.isAbsolute(rel));
-	if (isSubdir) {
-		console.error(chalk.red("❌  --target cannot be the same as or a subdirectory of --src"));
+	// --target is rimraf'd before being rewritten, so it must NOT overlap --src in
+	// EITHER direction: not the same dir, not a subdir of --src, and — the
+	// catastrophic case — not a PARENT of --src (which would delete the source tree
+	// and everything beside it).
+	const srcAbs = path.resolve(options.src);
+	const tgtAbs = path.resolve(options.target);
+	const relFromSrc = path.relative(srcAbs, tgtAbs); // target as seen from src
+	const relToSrc = path.relative(tgtAbs, srcAbs);   // src as seen from target
+	const targetInsideSrc = !relFromSrc || (!relFromSrc.startsWith("..") && !path.isAbsolute(relFromSrc));
+	const srcInsideTarget = !relToSrc || (!relToSrc.startsWith("..") && !path.isAbsolute(relToSrc));
+	if (targetInsideSrc || srcInsideTarget) {
+		console.error(chalk.red("❌  --target must not overlap --src (it cannot be the same as, a subdirectory of, or a parent of --src) — it is deleted before being rewritten"));
 		process.exit(1);
 	}
 }
@@ -295,7 +333,7 @@ async function checkMavenLibExist(groupId, artifactId, repos) {
 	const { resolveActiveCodecs } = require("./lib/codecs/select");
 	const eco = (options.ecosystem || "auto").toLowerCase();
 	const detected = (eco === "auto") ? detectCodecs(options.src).map(c => c.id) : allCodecs().map(c => c.id);
-	const noCodecs = ["maven", "npm", "yarn", "nuget", "composer", "pypi"].filter(id => options[id] === false);
+	const noCodecs = ["maven", "npm", "yarn", "nuget", "composer", "pypi", "go", "ruby"].filter(id => options[id] === false);
 	const activeIds = resolveActiveCodecs(eco, detected, { noCodecs, noJs: !options.js });
 	const runMaven = activeIds.includes("maven");
 	const runNpm = activeIds.includes("npm") || activeIds.includes("yarn");
@@ -309,7 +347,7 @@ async function checkMavenLibExist(groupId, artifactId, repos) {
 		const codec = getCodec(id);
 		let res;
 		try {
-			res = await codec.collect(options.src, { ignoreTest: !!options.ignoreTest, deps2Exclude, verbose });
+			res = await codec.collect(options.src, { ignoreTest: !!options.ignoreTest, deps2Exclude, verbose, scanJars: options.jars !== false, srcRoot: options.src });
 		} catch (err) {
 			console.warn(chalk.red(`❌  ${id} collect failed:`), chalk.dim(err.message));
 			continue;
@@ -322,13 +360,18 @@ async function checkMavenLibExist(groupId, artifactId, repos) {
 	// --- Collection summary ---
 	ui.section("Collection");
 	const ecoCount = {};
-	for (const d of resolved.values()) ecoCount[d.ecosystem] = (ecoCount[d.ecosystem] || 0) + 1;
+	let embeddedCount = 0;
+	for (const d of resolved.values()) {
+		if (d.provenance === "embedded") { embeddedCount++; continue; } // counted separately below
+		ecoCount[d.ecosystem] = (ecoCount[d.ecosystem] || 0) + 1;
+	}
 	if (runMaven) ui.ok(`${chalk.bold("Maven".padEnd(8))} ${mavenCtx ? mavenCtx.pomFiles.length + " module(s) · " : ""}${ecoCount.maven || 0} direct dep(s)`);
 	if (runNpm)   ui.ok(`${chalk.bold("npm/yarn".padEnd(8))} ${ecoCount.npm || 0} dep(s)`);
 	for (const [id, n] of Object.entries(ecoCount)) {
 		if (id === "maven" || id === "npm") continue;
 		ui.ok(`${chalk.bold(((getCodec(id)?.label) || id).padEnd(8))} ${n} dep(s)`);
 	}
+	if (embeddedCount) ui.ok(`${chalk.bold("Embedded".padEnd(8))} ${embeddedCount} coord(s) in .jar/.war/.ear`);
 	if (!ecoCount.maven && !ecoCount.npm && !Object.keys(ecoCount).length) ui.warn("no dependencies found in the source tree");
 	if (collectWarnings.length) {
 		ui.warn(`${collectWarnings.length} manifest warning(s) — best-effort / no lockfile:`);
@@ -429,10 +472,12 @@ async function checkMavenLibExist(groupId, artifactId, repos) {
 		else ui.info(chalk.dim(`${wrotePom} POM(s) cleanable (read-only — pass -t <dir> to write them)`));
 	}
 
-	// ---------- Report flow (CVE / EOL / Obsolete) ----------
-	if (options.report) {
-		await runReportFlow(resolved, { activeIds, runMaven, runNpm, privateLibIds, mavenRepos, collectWarnings });
-	} else if (!readOnly) {
+	// ---------- Scan flow (CVE / EOL / Obsolete) ----------
+	// The scan always runs — it feeds the terminal summary, the file outputs and the
+	// CI gate. Which files get written is decided by the --report-* family inside
+	// (HTML + .doc by default; --no-report writes nothing).
+	await runReportFlow(resolved, { activeIds, runMaven, runNpm, privateLibIds, mavenRepos, collectWarnings });
+	if (!readOnly) {
 		ui.section("Next step");
 		ui.info(`run Snyk on the cleaned tree:`);
 		console.log("    " + chalk.white(`cd ${options.target} && snyk test --json --all-projects | snyk-to-html -o ../snyk-deps-check.html`));
@@ -481,8 +526,13 @@ async function runReportFlow(resolved, ecoFlags = {}) {
 	const willOsv = !!options.osv;
 	const willOutdated = !!options.allLibs;
 	const willNvd = !!options.nvd;
+	const willEpss = !!options.epss;
+	const willKev = !!options.kev;
+	const willLicenses = !!options.licenses;
 	const willRetire = !!options.retire;
-	const totalSteps = [willTransitive, willCve, /*EOL*/ true, willOutdated, /*npm reg*/ true, ...otherRegistryIds.map(() => true), willOsv, willNvd, willRetire].filter(Boolean).length;
+	// License detection piggybacks on the registry passes (same fetched metadata),
+	// so it adds no progress step of its own.
+	const totalSteps = [willTransitive, willCve, /*EOL*/ true, willOutdated, /*npm reg*/ true, ...otherRegistryIds.map(() => true), willOsv, willNvd, willEpss, willKev, willRetire].filter(Boolean).length;
 	const progress = new ui.Progress(totalSteps);
 
 	if (willTransitive) {
@@ -520,6 +570,10 @@ async function runReportFlow(resolved, ecoFlags = {}) {
 		catch (err) { st.fail(err.message); }
 	}
 
+	// License findings accumulate from each registry pass (same fetched metadata)
+	// plus Maven's cached POMs — assessed against the copyleft policy below.
+	let licenseFindings = [];
+
 	// 3. Obsolete / deprecated — local curated list, instant (no network step).
 	let obsoleteResults = [];
 	try { obsoleteResults = outdated.checkObsoleteDeps(resolved); }
@@ -544,6 +598,7 @@ async function runReportFlow(resolved, ecoFlags = {}) {
 			const npmReg = await checkNpmRegistryDeps(resolved, { verbose, offline, allLibs: options.allLibs, onProgress: (p, t) => st.tick(p, t) });
 			obsoleteResults = obsoleteResults.concat(npmReg.deprecated);
 			outdatedResults = outdatedResults.concat(npmReg.outdated);
+			licenseFindings = licenseFindings.concat(npmReg.licensed || []);
 			st.done(`${npmReg.deprecated.length} deprecated, ${npmReg.outdated.length} outdated`);
 		} catch (err) { st.fail(err.message); }
 	}
@@ -556,6 +611,7 @@ async function runReportFlow(resolved, ecoFlags = {}) {
 			const reg = await codec.checkRegistry(resolved, { verbose, offline, allLibs: options.allLibs, onProgress: (p, t) => st.tick(p, t) });
 			obsoleteResults = obsoleteResults.concat(reg.deprecated || []);
 			outdatedResults = outdatedResults.concat(reg.outdated || []);
+			licenseFindings = licenseFindings.concat(reg.licensed || []);
 			st.done(`${(reg.deprecated || []).length} deprecated, ${(reg.outdated || []).length} outdated`);
 		} catch (err) { st.fail(err.message); }
 	}
@@ -605,6 +661,40 @@ async function runReportFlow(resolved, ecoFlags = {}) {
 		}
 	}
 
+	// 4e. EPSS — exploit-prediction percentile for each matched CVE (FIRST.org).
+	if (willEpss) {
+		const st = progress.start("EPSS (FIRST.org)");
+		if (!cveMatches.length) { st.skip("no CVE"); }
+		else {
+			try {
+				const { enrichEpss } = require("./lib/epss");
+				await enrichEpss(cveMatches, { verbose, offline, onProgress: (p, t) => st.tick(p, t) });
+				const scored = cveMatches.filter(m => m.cve?.epssPercentile != null).length;
+				st.done(`${scored} scored`);
+			} catch (err) { st.fail(err.message); }
+		}
+	}
+
+	// 4f. CISA KEV — flag CVEs known to be exploited in the wild.
+	if (willKev) {
+		const st = progress.start("CISA KEV");
+		if (!cveMatches.length) { st.skip("no CVE"); }
+		else {
+			try {
+				const { enrichKev } = require("./lib/kev");
+				await enrichKev(cveMatches, { verbose, offline });
+				const kevd = cveMatches.filter(m => m.cve?.kev).length;
+				st.done(`${kevd} known-exploited`);
+			} catch (err) { st.fail(err.message); }
+		}
+	}
+
+	// 4g. Composite priority (KEV > EPSS-weighted CVSS). Always — cheap, pure.
+	try {
+		const { attachPriority } = require("./lib/priority");
+		attachPriority(cveMatches);
+	} catch (err) { ui.warn(`priority scoring skipped: ${err.message}`); }
+
 	// 5. retire.js — native "vendored" scanner contributed by the npm codec. Scans
 	//    vendored JS files (jquery copies, bootstrap, pdf.js, …) that live in the
 	//    source tree without any lockfile to back them.
@@ -649,10 +739,34 @@ async function runReportFlow(resolved, ecoFlags = {}) {
 	// full per-bucket list (including cpeFiltered) so the HTML report can render
 	// its "Likely false positives" appendix — only the CLI headline excludes
 	// cpeFiltered to avoid alarming on triaged-out matches.
-	const prodMatches = cveMatches.filter(m => !m.dep?.isDev);
-	const devMatches  = cveMatches.filter(m =>  m.dep?.isDev);
-	const prodActive  = prodMatches.filter(m => !m.cpeFiltered);
-	const devActive   = devMatches.filter(m => !m.cpeFiltered);
+	// Triage — suppress accepted-risk / false-positive findings (--ignore / --vex).
+	// Marked in place; kept in the machine exports (flagged) but dropped from the
+	// human report's active chapters and from CI gating.
+	let suppressedCount = 0;
+	if (options.ignore || options.vex) {
+		try {
+			const { parseIgnoreFile, parseVex, applySuppressions } = require("./lib/suppress");
+			const rules = [];
+			if (options.ignore) rules.push(...parseIgnoreFile(fs.readFileSync(options.ignore, "utf8")));
+			if (options.vex) rules.push(...parseVex(JSON.parse(fs.readFileSync(options.vex, "utf8"))));
+			suppressedCount = applySuppressions(cveMatches, rules);
+			const via = [options.ignore && "--ignore", options.vex && "--vex"].filter(Boolean).join(" + ");
+			if (suppressedCount) ui.info(chalk.dim(`triage: ${suppressedCount} finding(s) suppressed by ${via}`));
+		} catch (err) { ui.warn(`suppression skipped: ${err.message}`); }
+	}
+
+	const { sortByPriority } = require("./lib/priority");
+	const isEmbedded  = m => m.dep?.provenance === "embedded";
+	// Embedded-binary findings get their own chapter, so keep them out of the
+	// declared prod/dev sets (a coord that's both declared AND embedded yields two
+	// distinct records — one in each — which is the intended, audit-useful split).
+	const prodMatches     = cveMatches.filter(m => !m.dep?.isDev && !m.suppressed && !isEmbedded(m));
+	const devMatches      = cveMatches.filter(m =>  m.dep?.isDev && !m.suppressed && !isEmbedded(m));
+	const embeddedMatches = cveMatches.filter(m => isEmbedded(m) && !m.suppressed);
+	const prodActive  = sortByPriority(prodMatches.filter(m => !m.cpeFiltered));
+	const devActive   = sortByPriority(devMatches.filter(m => !m.cpeFiltered));
+	const embeddedActive = sortByPriority(embeddedMatches.filter(m => !m.cpeFiltered));
+	const kevCount    = prodActive.filter(m => m.cve?.kev).length;
 	const cpeFilteredCount = (prodMatches.length - prodActive.length) + (devMatches.length - devActive.length);
 
 	const stats = computeStats(prodActive);
@@ -671,15 +785,26 @@ async function runReportFlow(resolved, ecoFlags = {}) {
 
 	ui.section("Results");
 
-	heading("CVE · production", prodActive.length, fmtStats(stats));
+	heading("CVE · production", prodActive.length, fmtStats(stats) + (kevCount ? "  " + chalk.bgRed.white(` ${kevCount} KEV `) : ""));
 	for (const m of prodActive.slice(0, 12)) {
-		console.log("    " + sev(m.cve.severity)((m.cve.severity || "UNKNOWN").padEnd(8)) + " " + chalk.white(m.cve.id) + "  " + chalk.dim(`${depLabel(m.dep)}:${m.dep.version}`));
+		const epss = m.cve?.epssPercentile != null ? chalk.dim(` epss ${Math.round(m.cve.epssPercentile * 100)}%`) : "";
+		const kev = m.cve?.kev ? " " + chalk.bgRed.white(" KEV ") : "";
+		console.log("    " + sev(m.cve.severity)((m.cve.severity || "UNKNOWN").padEnd(8)) + " " + chalk.white(m.cve.id) + "  " + chalk.dim(`${depLabel(m.dep)}:${m.dep.version}`) + epss + kev);
 	}
 	if (prodActive.length > 12) console.log(chalk.dim(`    …and ${prodActive.length - 12} more (see report)`));
 	if (cpeFilteredCount) console.log(chalk.dim(`    ${cpeFilteredCount} likely false positive(s) → report appendix`));
 
 	heading("CVE · dev", devActive.length, devActive.length ? fmtStats(devStats) : "");
 
+	if (embeddedActive.length) {
+		heading("CVE · embedded binaries", embeddedActive.length, fmtStats(computeStats(embeddedActive)));
+		for (const m of embeddedActive.slice(0, 8)) {
+			const top = (m.dep.manifestPaths?.[0] || "").split("!/")[0];
+			console.log("    " + sev(m.cve.severity)((m.cve.severity || "UNKNOWN").padEnd(8)) + " " + chalk.white(m.cve.id) + "  " + chalk.dim(`${depLabel(m.dep)}:${m.dep.version}`) + chalk.dim(`  ⊂ ${top}`));
+		}
+		if (embeddedActive.length > 8) console.log(chalk.dim(`    …and ${embeddedActive.length - 8} more (see report ch.1B)`));
+	}
+
 	heading("EOL frameworks", eolResults.length);
 	for (const e of eolResults.slice(0, 8)) console.log("    " + chalk.yellow(e.product.padEnd(18)) + " " + chalk.dim(`${coordOf(e.dep)}:${e.dep.version}`) + " " + chalk.dim(e.eol === true ? "EOL" : String(e.eol)));
 	if (eolResults.length > 8) console.log(chalk.dim(`    …and ${eolResults.length - 8} more`));
@@ -708,8 +833,27 @@ async function runReportFlow(resolved, ecoFlags = {}) {
 		}
 	}
 
+	// License assessment — Maven licenses come (network-free) from cached POMs;
+	// the registry passes already filled licenseFindings for the other ecosystems.
+	let licenseResults = null;
+	if (willLicenses) {
+		try {
+			if (runMaven) {
+				const { collectMavenLicenses } = require("./lib/maven-license");
+				licenseFindings = licenseFindings.concat(collectMavenLicenses(resolved));
+			}
+			const { assessLicenses } = require("./lib/license-policy");
+			licenseResults = assessLicenses(licenseFindings);
+			const flaggedN = licenseResults.flagged.length;
+			heading("Licenses", licenseResults.assessed.length, flaggedN ? chalk.yellow(`${flaggedN} to review`) : "");
+			for (const e of licenseResults.flagged.slice(0, 8)) {
+				console.log("    " + chalk.yellow((e.category).padEnd(16)) + " " + chalk.dim(`${coordOf(e.dep)}`) + " " + chalk.dim((e.ids.concat(e.raw)).join(", ") || "—"));
+			}
+			if (licenseResults.flagged.length > 8) console.log(chalk.dim(`    …and ${licenseResults.flagged.length - 8} more`));
+		} catch (err) { ui.warn(`license assessment skipped: ${err.message}`); }
+	}
+
 	const reportDir = options.reportOutput || "./fad-checker-report";
-	await fs.promises.mkdir(reportDir, { recursive: true });
 	// --import-anonymized has no source tree; keep the report path-free (consistent
 	// with the anonymized descriptor it was fed).
 	const srcResolved = options.src ? path.resolve(options.src) : null;
@@ -720,37 +864,116 @@ async function runReportFlow(resolved, ecoFlags = {}) {
 		toolVersion: pkg.version,
 		cveDataDate,
 	};
-	const { htmlPath, docPath } = await writeReports({
-		cveMatches: prodMatches,
-		devCveMatches: devMatches,
-		retireMatches,
-		eolResults,
-		obsoleteResults,
-		outdatedResults,
-		resolvedDeps: resolved,
-		projectInfo,
-		outputDir: reportDir,
-		warnings: [
-			...npmWarnings,
-			...scanWarnings,
-			...(privateLibIds.length ? [{
-				type: "private-libs",
-				count: privateLibIds.length,
-				// Enrich each private lib with the relative path(s) of the pom(s)
-				// that declare it, so the team knows where to look.
-				items: privateLibIds.map(id => {
-					const dep = resolved.get(id);
-					const paths = (dep?.pomPaths || []).map(p => path.relative(options.src, p));
-					return { id, manifestPaths: paths };
-				}),
-				message: `${privateLibIds.length} Maven coord(s) not found on Maven Central — they are private/internal libraries. Their CVEs (if any) cannot be detected by fad-checker; if you have an internal CVE feed, audit them separately.`,
-			}] : []),
-		],
-	});
-	ui.section("Report");
-	ui.ok(chalk.white(htmlPath));
-	ui.ok(chalk.white(docPath));
+
+	// --- Output target resolution -------------------------------------------------
+	// One --report-<type> flag per output, each taking an OPTIONAL path: a string is
+	// an explicit path, `true` means "use the default name under --report-output",
+	// undefined means "not requested". If NO --report-* flag is given at all, fall
+	// back to the historical default set (HTML + .doc). --no-report suppresses ALL
+	// file outputs (the scan, terminal summary and --fail-on gate still ran).
+	const DEFAULT_NAMES = { html: "cve-report.html", doc: "cve-report.doc", sbom: "sbom.cdx.json", csaf: "csaf-vex.json", json: "findings.json", sarif: "fad.sarif" };
+	const sel = { html: options.reportHtml, doc: options.reportDoc, sbom: options.reportSbom, csaf: options.reportCsaf, json: options.reportJson, sarif: options.reportSarif };
+	const anySpecified = Object.values(sel).some(v => v !== undefined);
+	const resolveOut = key => {
+		const v = sel[key];
+		if (v === undefined) return (!anySpecified && (key === "html" || key === "doc")) ? path.join(reportDir, DEFAULT_NAMES[key]) : null;
+		return (v === true) ? path.join(reportDir, DEFAULT_NAMES[key]) : v;
+	};
+	const out = options.report === false
+		? { html: null, doc: null, sbom: null, csaf: null, json: null, sarif: null }
+		: { html: resolveOut("html"), doc: resolveOut("doc"), sbom: resolveOut("sbom"), csaf: resolveOut("csaf"), json: resolveOut("json"), sarif: resolveOut("sarif") };
+	const ensureDir = async p => { if (p) await fs.promises.mkdir(path.dirname(path.resolve(p)), { recursive: true }); };
+
+	const reportWarnings = [
+		...(suppressedCount ? [{
+			type: "suppressed",
+			count: suppressedCount,
+			message: `${suppressedCount} finding(s) suppressed via triage (--ignore/--vex) — excluded from the chapters above and from CI gating, but retained (flagged) in the JSON/SBOM/CSAF exports.`,
+		}] : []),
+		...npmWarnings,
+		...scanWarnings,
+		...(privateLibIds.length ? [{
+			type: "private-libs",
+			count: privateLibIds.length,
+			items: privateLibIds.map(id => {
+				const dep = resolved.get(id);
+				const paths = (dep?.pomPaths || []).map(p => path.relative(options.src, p));
+				return { id, manifestPaths: paths };
+			}),
+			message: `${privateLibIds.length} Maven coord(s) not found on Maven Central — they are private/internal libraries. Their CVEs (if any) cannot be detected by fad-checker; if you have an internal CVE feed, audit them separately.`,
+		}] : []),
+	];
+
+	const wrote = [];
+	if (out.html || out.doc) {
+		await ensureDir(out.html); await ensureDir(out.doc);
+		const { htmlPath, docPath } = await writeReports({
+			cveMatches: prodMatches, devCveMatches: devMatches, embeddedMatches, retireMatches,
+			eolResults, obsoleteResults, outdatedResults, licenseResults,
+			resolvedDeps: resolved, projectInfo, warnings: reportWarnings,
+			htmlPath: out.html, docPath: out.doc,
+		});
+		if (htmlPath) wrote.push(["HTML report", htmlPath]);
+		if (docPath) wrote.push(["Word .doc", docPath]);
+	}
+
+	// Machine-readable exports. Use the full match set (prod + dev + cpe-filtered) so
+	// the artifacts are complete; cpeFiltered is marked as a property/flag, not dropped.
+	if (out.sbom) {
+		try {
+			const { writeCycloneDx } = require("./lib/sbom-export");
+			await ensureDir(out.sbom);
+			writeCycloneDx(resolved, cveMatches, out.sbom, { projectInfo, toolVersion: pkg.version, timestamp: projectInfo.generatedAt, licenseResults });
+			wrote.push(["CycloneDX SBOM", out.sbom]);
+		} catch (err) { ui.warn(`SBOM export failed: ${err.message}`); }
+	}
+	if (out.csaf) {
+		try {
+			const { writeCsaf } = require("./lib/csaf-export");
+			await ensureDir(out.csaf);
+			writeCsaf(resolved, cveMatches, out.csaf, { projectInfo, toolVersion: pkg.version, timestamp: projectInfo.generatedAt });
+			wrote.push(["CSAF 2.0 VEX", out.csaf]);
+		} catch (err) { ui.warn(`CSAF export failed: ${err.message}`); }
+	}
+	if (out.json) {
+		try {
+			const { writeFindings } = require("./lib/json-export");
+			await ensureDir(out.json);
+			writeFindings({ cveMatches, retireMatches, eolResults, obsoleteResults, outdatedResults, licenseResults, resolvedDeps: resolved, projectInfo, toolVersion: pkg.version }, out.json);
+			wrote.push(["Findings JSON", out.json]);
+		} catch (err) { ui.warn(`JSON export failed: ${err.message}`); }
+	}
+	if (out.sarif) {
+		try {
+			const { writeSarif } = require("./lib/sarif-export");
+			await ensureDir(out.sarif);
+			writeSarif(cveMatches.filter(m => !m.suppressed), out.sarif, { projectInfo, toolVersion: pkg.version });
+			wrote.push(["SARIF", out.sarif]);
+		} catch (err) { ui.warn(`SARIF export failed: ${err.message}`); }
+	}
+
+	if (wrote.length) {
+		ui.section("Output");
+		for (const [label, p] of wrote) ui.ok(`${label} → ${chalk.white(p)}`);
+	} else if (options.report === false) {
+		ui.info(chalk.dim("--no-report: no files written (scan + gate only)"));
+	}
 	console.log();
+
+	// CI gating — set a non-zero exit code (after all reports/exports are written)
+	// when a production finding meets the --fail-on threshold.
+	if (options.failOn && options.failOn !== "none") {
+		const { evaluateGate } = require("./lib/gate");
+		// Embedded-binary findings are real production risk → gate on them too.
+		const gate = evaluateGate([...prodActive, ...embeddedActive], options.failOn);
+		if (gate.failed) {
+			ui.section("Gate");
+			console.log(chalk.red(`✗ --fail-on ${options.failOn}: ${gate.reason}`));
+			process.exitCode = 1;
+		} else if (verbose) {
+			ui.info(chalk.dim(`--fail-on ${options.failOn}: no blocking finding`));
+		}
+	}
 }
 
 /**
@@ -760,7 +983,9 @@ async function runReportFlow(resolved, ecoFlags = {}) {
  */
 function mergeBySource(existing, additions) {
 	const byKey = new Map();
-	const k = m => `${m.dep.groupId}:${m.dep.artifactId}:${m.dep.version}|${m.cve.id}`;
+	// coordKey keeps embedded-binary findings distinct from a same-g:a:v declared dep
+	// (see cve-match dedup). Falls back to g:a for any match lacking a coordKey.
+	const k = m => `${m.dep.coordKey || (m.dep.groupId + ":" + m.dep.artifactId)}:${m.dep.version}|${m.cve.id}`;
 	for (const m of existing || []) byKey.set(k(m), { ...m, source: m.source || "fad" });
 	for (const m of additions || []) {
 		const key = k(m);

package/lib/cache-archive.js

@@ -12,6 +12,9 @@
  *
  * The format is selected from the file extension. Tar uses native `tar`
  * binary (zero new deps).
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
  */
 const fs = require("fs");
 const path = require("path");

package/lib/codecs/codec.interface.js

@@ -3,6 +3,9 @@
  *
  * Pas de classe imposée : un codec est un objet litéral exportant ces clés.
  * Voir docs/superpowers/specs/2026-05-29-codecs-multi-ecosystem-design.md.
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
  */
 const REQUIRED_KEYS = [
 	"id", "label", "osvEcosystem", "manifestNames",

package/lib/codecs/composer/parse.js

@@ -7,6 +7,9 @@
  *                   used only as a no-lock fallback (pinned exact versions).
  *
  * Composer names are "vendor/package", case-insensitive (lowercased by convention).
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
  */
 const fs = require("fs");
 

package/lib/codecs/composer/registry.js

@@ -6,6 +6,9 @@
  *   → { package: { abandoned: bool|string, versions: { "<v>": {...} } } }
  *
  * Cached in ~/.fad-checker/packagist-cache.json for 24h.
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
  */
 const fs = require("fs");
 const path = require("path");
@@ -30,14 +33,18 @@ function cmp(a, b) {
 
 // Extract {abandoned, outdated} from a Packagist `package` object.
 function packagistToFindings(pkg, { version }) {
-	const out = { abandoned: null, outdated: null };
+	const out = { abandoned: null, outdated: null, license: null };
 	if (pkg.abandoned === true) out.abandoned = { replacement: null };
 	else if (typeof pkg.abandoned === "string") out.abandoned = { replacement: pkg.abandoned };
-	const stable = Object.keys(pkg.versions || {}).map(v => v.replace(/^v/, "")).filter(isStable);
+	const versions = pkg.versions || {};
+	const stable = Object.keys(versions).map(v => v.replace(/^v/, "")).filter(isStable);
 	if (stable.length) {
 		const latest = stable.sort(cmp).at(-1);
 		if (latest && cmp(latest, String(version).replace(/^v/, "")) > 0) out.outdated = { latest };
 	}
+	// Packagist version objects carry a `license` array (e.g. ["MIT"]).
+	const vEntry = versions[version] || versions[`v${version}`] || versions[Object.keys(versions)[0]];
+	if (vEntry?.license && vEntry.license.length) out.license = vEntry.license;
 	return out;
 }
 
@@ -55,7 +62,7 @@ async function fetchPackage(name, { offline }) {
 async function checkComposerRegistryDeps(deps, opts = {}) {
 	const { verbose, offline, allLibs = true, concurrency = 8 } = opts;
 	const targets = [...deps.values()].filter(d => d.ecosystem === "composer" && d.version);
-	const result = { deprecated: [], outdated: [] };
+	const result = { deprecated: [], outdated: [], licensed: [] };
 	if (!targets.length) return result;
 	const cache = loadCache();
 	const fresh = cache.meta?.fetchedAt && (Date.now() - cache.meta.fetchedAt) < CACHE_MAX_AGE_MS;
@@ -69,12 +76,13 @@ async function checkComposerRegistryDeps(deps, opts = {}) {
 			const pkg = await fetchPackage(name, { offline });
 			if (pkg && !pkg.error) {
 				const f = packagistToFindings(pkg, { version: t.version });
-				ex = { abandoned: f.abandoned, latest: f.outdated?.latest || null };
+				ex = { abandoned: f.abandoned, latest: f.outdated?.latest || null, license: f.license || null };
 				cache.entries[key] = ex;
 			} else {
-				ex = { abandoned: null, latest: null };
+				ex = { abandoned: null, latest: null, license: null };
 			}
 		}
+		if (ex.license) result.licensed.push({ dep: t, licenses: ex.license, source: "packagist" });
 		if (ex.abandoned) {
 			result.deprecated.push({ dep: t, severity: "MEDIUM", replacement: ex.abandoned.replacement, reason: "Package marked abandoned on Packagist", source: "packagist" });
 			if (verbose) process.stdout.write(`  abandoned: ${name}@${t.version}\n`);

package/lib/codecs/composer.codec.js

@@ -4,6 +4,9 @@
  * Vuln scanning is OSV (ecosystem "Packagist", wired in Plan A). This codec adds
  * collection (composer.lock, composer.json fallback), Packagist registry
  * (abandoned + outdated), and EOL via endoflife.date.
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
  */
 const fs = require("fs");
 const path = require("path");

package/lib/codecs/go/parse.js

@@ -0,0 +1,65 @@
+/**
+ * lib/codecs/go/parse.js — parse go.mod (authoritative for selected versions on
+ * Go ≥1.17, which lists the full pruned module graph) with go.sum as fallback.
+ *
+ * Versions are stored WITHOUT the leading "v" (OSV's Go ecosystem and our
+ * version comparisons expect bare semver; the purl layer re-adds context).
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
+ */
+const fs = require("fs");
+const { compareMavenVersions } = require("../../maven-version");
+
+function stripV(v) { return String(v || "").replace(/^v/, ""); }
+
+/** Parse go.mod → { module, deps: [{ name, version, scope, isDev }] }. */
+function parseGoMod(text) {
+	const out = { module: null, deps: [] };
+	const lines = String(text || "").split(/\r?\n/);
+	let inRequire = false;
+	const seen = new Set();
+	const addReq = (name, ver, indirect) => {
+		if (!name || !ver) return;
+		const key = `${name}@${ver}`;
+		if (seen.has(key)) return;
+		seen.add(key);
+		out.deps.push({ name, version: stripV(ver), scope: indirect ? "transitive" : "compile", isDev: false });
+	};
+	for (let raw of lines) {
+		const noComment = raw.split("//")[0].trim();
+		const indirect = /\/\/\s*indirect/.test(raw);
+		if (noComment.startsWith("module ")) { out.module = noComment.slice(7).trim(); continue; }
+		if (noComment === "require (") { inRequire = true; continue; }
+		if (inRequire && noComment === ")") { inRequire = false; continue; }
+		if (inRequire) {
+			const m = noComment.match(/^(\S+)\s+(\S+)/);
+			if (m) addReq(m[1], m[2], indirect);
+			continue;
+		}
+		const single = noComment.match(/^require\s+(\S+)\s+(\S+)/);
+		if (single) addReq(single[1], single[2], indirect);
+	}
+	return out;
+}
+
+/** Parse go.sum → deps (fallback when go.mod has no require list). Highest version per module. */
+function parseGoSum(text) {
+	const byMod = new Map();
+	for (const raw of String(text || "").split(/\r?\n/)) {
+		const m = raw.trim().match(/^(\S+)\s+(v\S+?)(\/go\.mod)?\s+h1:/);
+		if (!m) continue;
+		const name = m[1];
+		const ver = stripV(m[2]);
+		// go.sum lists every version in the module graph; keep the highest (the
+		// comment promised this but the code kept the first one encountered).
+		const prev = byMod.get(name);
+		if (!prev || compareMavenVersions(ver, prev) > 0) byMod.set(name, ver);
+	}
+	return { deps: [...byMod.entries()].map(([name, version]) => ({ name, version, scope: "transitive", isDev: false })) };
+}
+
+function parseGoModFile(fp) { return parseGoMod(fs.readFileSync(fp, "utf8")); }
+function parseGoSumFile(fp) { return parseGoSum(fs.readFileSync(fp, "utf8")); }
+
+module.exports = { parseGoMod, parseGoSum, parseGoModFile, parseGoSumFile, stripV };