fad-checker 2.0.1 → 2.1.0

package/lib/codecs/pypi/registry.js

@@ -6,6 +6,9 @@
  *   → { info: { version, classifiers[] }, releases: { "<v>": [{ yanked, yanked_reason }] } }
  *
  * Cached in ~/.fad-checker/pypi-cache.json for 24h.
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
  */
 const fs = require("fs");
 const path = require("path");
@@ -26,8 +29,22 @@ function cmp(a, b) {
 	return 0;
 }
 
+// PyPI's info.license is notoriously free-form (sometimes the full license text),
+// so prefer the structured "License :: …" trove classifiers; fall back to a short
+// info.license string only.
+function pypiLicense(info) {
+	const fromClassifiers = (info?.classifiers || [])
+		.filter(c => /^License ::/.test(c) && !/OSI Approved$/.test(c))
+		.map(c => c.split("::").pop().trim())
+		.filter(Boolean);
+	if (fromClassifiers.length) return fromClassifiers;
+	const raw = (info?.license || "").trim();
+	if (raw && raw.length <= 50 && !raw.includes("\n")) return raw;
+	return null;
+}
+
 function pypiToFindings(data, { version }) {
-	const out = { outdated: null, yanked: null, inactive: false };
+	const out = { outdated: null, yanked: null, inactive: false, license: null };
 	const latest = data.info?.version;
 	if (latest && cmp(latest, version) > 0) out.outdated = { latest };
 	const rel = data.releases?.[version];
@@ -35,6 +52,7 @@ function pypiToFindings(data, { version }) {
 		out.yanked = { reason: rel.find(f => f.yanked_reason)?.yanked_reason || null };
 	}
 	if ((data.info?.classifiers || []).some(c => /Development Status :: 7 - Inactive/i.test(c))) out.inactive = true;
+	out.license = pypiLicense(data.info);
 	return out;
 }
 
@@ -51,7 +69,7 @@ async function fetchProject(name, { offline }) {
 async function checkPypiRegistryDeps(deps, opts = {}) {
 	const { verbose, offline, allLibs = true, concurrency = 8 } = opts;
 	const targets = [...deps.values()].filter(d => d.ecosystem === "pypi" && d.version);
-	const result = { deprecated: [], outdated: [] };
+	const result = { deprecated: [], outdated: [], licensed: [] };
 	if (!targets.length) return result;
 	const cache = loadCache();
 	const fresh = cache.meta?.fetchedAt && (Date.now() - cache.meta.fetchedAt) < CACHE_MAX_AGE_MS;
@@ -64,12 +82,13 @@ async function checkPypiRegistryDeps(deps, opts = {}) {
 			const data = await fetchProject(t.name, { offline });
 			if (data && !data.error) {
 				const f = pypiToFindings(data, { version: t.version });
-				ex = { yanked: f.yanked, inactive: f.inactive, latest: f.outdated?.latest || null };
+				ex = { yanked: f.yanked, inactive: f.inactive, latest: f.outdated?.latest || null, license: f.license || null };
 				cache.entries[key] = ex;
 			} else {
-				ex = { yanked: null, inactive: false, latest: null };
+				ex = { yanked: null, inactive: false, latest: null, license: null };
 			}
 		}
+		if (ex.license) result.licensed.push({ dep: t, licenses: ex.license, source: "pypi" });
 		if (ex.yanked) {
 			result.deprecated.push({ dep: t, severity: "HIGH", replacement: null, reason: `Version yanked on PyPI${ex.yanked.reason ? `: ${ex.yanked.reason}` : ""}`, source: "pypi" });
 			if (verbose) process.stdout.write(`  yanked: ${t.name}@${t.version}\n`);
@@ -86,4 +105,4 @@ async function checkPypiRegistryDeps(deps, opts = {}) {
 	return result;
 }
 
-module.exports = { pypiToFindings, checkPypiRegistryDeps };
+module.exports = { pypiToFindings, pypiLicense, checkPypiRegistryDeps };

package/lib/codecs/pypi.codec.js

@@ -5,6 +5,9 @@
  * collection (poetry.lock/Pipfile.lock/uv.lock/pdm.lock, requirements.txt
  * fallback), PyPI registry (yanked/inactive + outdated), and EOL.
  * Per-directory precedence: a lockfile wins; else requirements.txt best-effort.
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
  */
 const fs = require("fs");
 const path = require("path");

package/lib/codecs/recipes.js

@@ -4,6 +4,9 @@
  * Extrait de lib/cve-report.js (ECO_RECIPE + snippet helpers). Clés = id de codec
  * (== ecosystemType). Chaque recette : { label, pinSection, pinIntro(cnt),
  * snippet(items), directSection }. `items` = [{ groupId, artifactId, fixVersion }].
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
  */
 function esc(s) {
 	if (s == null) return "";
@@ -105,4 +108,28 @@ const nuget = {
 	directSection: "B. Then restore and commit packages.lock.json",
 };
 
-module.exports = { maven, npm, yarn, composer, pypi, nuget, dependencyManagementSnippet, npmOverridesSnippet, yarnResolutionsSnippet, composerRequireSnippet, pipInstallSnippet, dotnetAddSnippet };
+function goGetSnippet(items) {
+	return items.map(it => `go get ${esc(it.artifactId)}@v${esc(it.fixVersion)}`).join("\n");
+}
+
+const go = {
+	label: "Go",
+	pinSection: "A. Upgrade the affected modules",
+	pinIntro: cnt => `Run for the ${cnt} affected module${cnt > 1 ? "s" : ""}, then commit go.mod / go.sum (go mod tidy):`,
+	snippet: goGetSnippet,
+	directSection: "B. Or bump them in go.mod and run go mod tidy",
+};
+
+function bundleUpdateSnippet(items) {
+	return items.map(it => `bundle update ${esc(it.artifactId)} --conservative   # to >= ${esc(it.fixVersion)}`).join("\n");
+}
+
+const ruby = {
+	label: "Ruby",
+	pinSection: "A. Update the affected gems",
+	pinIntro: cnt => `Run for the ${cnt} affected gem${cnt > 1 ? "s" : ""}, then commit Gemfile.lock:`,
+	snippet: bundleUpdateSnippet,
+	directSection: "B. Or pin them in the Gemfile and run bundle update",
+};
+
+module.exports = { maven, npm, yarn, composer, pypi, nuget, go, ruby, dependencyManagementSnippet, npmOverridesSnippet, yarnResolutionsSnippet, composerRequireSnippet, pipInstallSnippet, dotnetAddSnippet, goGetSnippet, bundleUpdateSnippet };

package/lib/codecs/ruby/parse.js

@@ -0,0 +1,42 @@
+/**
+ * lib/codecs/ruby/parse.js — parse Gemfile.lock.
+ *
+ * The GEM section's `specs:` block lists resolved gems at 4-space indent
+ * (`name (version)`); their transitive requirements sit at 6-space indent and
+ * are skipped (they reappear as their own 4-space spec entry).
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
+ */
+const fs = require("fs");
+
+/** Parse Gemfile.lock text → { deps: [{ name, version, scope, isDev }] }. */
+function parseGemfileLock(text) {
+	const deps = [];
+	const seen = new Set();
+	const lines = String(text || "").split(/\r?\n/);
+	let inSpecs = false;
+	for (const raw of lines) {
+		const trimmed = raw.trim();
+		if (/^(GEM|GIT|PATH|PLATFORMS|DEPENDENCIES|BUNDLED WITH|CHECKSUMS)\b/.test(trimmed) && !raw.startsWith(" ")) {
+			inSpecs = false;
+		}
+		if (trimmed === "specs:") { inSpecs = true; continue; }
+		if (!inSpecs) continue;
+		// Exactly 4 leading spaces = a resolved gem; 6+ = its dependency (skip).
+		const m = raw.match(/^ {4}([A-Za-z0-9._-]+) \(([^)]+)\)\s*$/);
+		if (!m) continue;
+		const name = m[1];
+		// Version may carry a platform suffix ("1.2.3-x86_64-linux"); keep the version.
+		const version = m[2].split(/[ -]/)[0];
+		const key = `${name}@${version}`;
+		if (seen.has(key)) continue;
+		seen.add(key);
+		deps.push({ name, version, scope: "compile", isDev: false });
+	}
+	return { deps };
+}
+
+function parseGemfileLockFile(fp) { return parseGemfileLock(fs.readFileSync(fp, "utf8")); }
+
+module.exports = { parseGemfileLock, parseGemfileLockFile };

package/lib/codecs/ruby/registry.js

@@ -0,0 +1,76 @@
+/**
+ * lib/codecs/ruby/registry.js — query RubyGems for latest version + licenses.
+ *
+ * API: https://rubygems.org/api/v1/gems/<gem>.json → { version, licenses[] }
+ * One call yields both outdated (latest stable) and the SPDX-ish license list.
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
+ */
+const fs = require("fs");
+const path = require("path");
+const os = require("os");
+let pLimit; try { pLimit = require("p-limit"); } catch { pLimit = () => (fn) => fn(); }
+
+const CACHE_DIR = path.join(os.homedir(), ".fad-checker");
+const CACHE_PATH = path.join(CACHE_DIR, "rubygems-cache.json");
+const CACHE_MAX_AGE_MS = 24 * 3600 * 1000;
+const API = "https://rubygems.org/api/v1/gems";
+
+function loadCache() { try { return JSON.parse(fs.readFileSync(CACHE_PATH, "utf8")); } catch { return { entries: {}, meta: {} }; } }
+function saveCache(d) { try { fs.mkdirSync(CACHE_DIR, { recursive: true }); fs.writeFileSync(CACHE_PATH, JSON.stringify(d)); } catch { /* ignore */ } }
+function isStable(v) { return /^\d+(\.\d+)*$/.test(String(v || "")); }
+function cmp(a, b) {
+	const pa = String(a).split(/[.\-+]/).map(n => parseInt(n, 10) || 0);
+	const pb = String(b).split(/[.\-+]/).map(n => parseInt(n, 10) || 0);
+	for (let i = 0; i < Math.max(pa.length, pb.length); i++) { const d = (pa[i] || 0) - (pb[i] || 0); if (d) return d > 0 ? 1 : -1; }
+	return 0;
+}
+
+// Pure extractor: RubyGems gem JSON → { latest, license }.
+function gemToFindings(data) {
+	const out = { latest: null, license: null };
+	if (data?.version && isStable(data.version)) out.latest = data.version;
+	const lic = data?.licenses;
+	if (Array.isArray(lic) && lic.length) out.license = lic;
+	return out;
+}
+
+async function fetchGem(name, { offline }) {
+	if (offline) return null;
+	try {
+		const res = await fetch(`${API}/${encodeURIComponent(name)}.json`, { headers: { "User-Agent": "fad-checker-rubygems" } });
+		if (!res.ok) return { error: `HTTP ${res.status}` };
+		return await res.json();
+	} catch (e) { return { error: e.message }; }
+}
+
+async function checkRubyRegistryDeps(deps, opts = {}) {
+	const { verbose, offline, allLibs = true, concurrency = 8 } = opts;
+	const targets = [...deps.values()].filter(d => d.ecosystem === "ruby" && d.version);
+	const result = { deprecated: [], outdated: [], licensed: [] };
+	if (!targets.length) return result;
+	const cache = loadCache();
+	const fresh = cache.meta?.fetchedAt && (Date.now() - cache.meta.fetchedAt) < CACHE_MAX_AGE_MS;
+	if (!fresh && !offline) cache.entries = {};
+	const limit = pLimit(concurrency);
+	await Promise.all(targets.map(t => limit(async () => {
+		const key = `${t.name}@${t.version}`;
+		let ex = cache.entries[key];
+		if (!ex) {
+			const data = await fetchGem(t.name, { offline });
+			ex = (data && !data.error) ? gemToFindings(data) : { latest: null, license: null };
+			if (data && !data.error) cache.entries[key] = ex;
+		}
+		if (ex.license) result.licensed.push({ dep: t, licenses: ex.license, source: "rubygems" });
+		if (allLibs && ex.latest && cmp(ex.latest, t.version) > 0) {
+			result.outdated.push({ dep: t, latest: ex.latest, releaseDate: null });
+			if (verbose) process.stdout.write(`  outdated: ${t.name} ${t.version} → ${ex.latest}\n`);
+		}
+	})));
+	cache.meta = { fetchedAt: Date.now() };
+	saveCache(cache);
+	return result;
+}
+
+module.exports = { gemToFindings, checkRubyRegistryDeps };

package/lib/codecs/ruby.codec.js

@@ -0,0 +1,66 @@
+/**
+ * lib/codecs/ruby.codec.js — codec Ruby (Bundler).
+ *
+ * Reads Gemfile.lock (authoritative resolved versions). Vuln recall via OSV
+ * (ecosystem "RubyGems"); outdated + licenses via the RubyGems API.
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
+ */
+const fs = require("fs");
+const path = require("path");
+const { makeDepRecord, coordKeyFor } = require("../dep-record");
+const R = require("./ruby/parse");
+
+const SKIP = new Set([".git", ".idea", ".vscode", "node_modules", "dist", "build", "out", "target", "vendor", "tmp"]);
+
+function findGemfileLocks(dir) {
+	const found = [];
+	const stack = [dir];
+	while (stack.length) {
+		const cur = stack.pop();
+		let entries; try { entries = fs.readdirSync(cur, { withFileTypes: true }); } catch { continue; }
+		for (const e of entries) {
+			if (e.isFile() && e.name === "Gemfile.lock") found.push(path.join(cur, e.name));
+			else if (e.isDirectory() && !SKIP.has(e.name)) stack.push(path.join(cur, e.name));
+		}
+	}
+	return found;
+}
+
+module.exports = {
+	id: "ruby",
+	label: "Ruby",
+	osvEcosystem: "RubyGems",
+	manifestNames: ["Gemfile.lock"],
+
+	detect(dir) { return findGemfileLocks(dir).length > 0; },
+
+	async collect(dir, opts = {}) {
+		const { deps2Exclude } = opts;
+		const out = new Map();
+		const warnings = [];
+		for (const fp of findGemfileLocks(dir)) {
+			try {
+				const { deps } = R.parseGemfileLockFile(fp);
+				for (const d of deps) {
+					if (deps2Exclude && deps2Exclude.test(d.name)) continue;
+					out.set(coordKeyFor("ruby", "", d.name), makeDepRecord({ ecosystem: "ruby", namespace: "", name: d.name, version: d.version, manifestPath: fp, scope: d.scope, isDev: false }));
+				}
+			} catch (e) { warnings.push({ type: "parse-error", manifestPath: fp, message: `Gemfile.lock parse failed: ${e.message}` }); }
+		}
+		return { deps: out, warnings };
+	},
+
+	coordKey(d) { return coordKeyFor("ruby", "", d.name); },
+	formatCoord(d) { return d.name; },
+	osvPackageName(d) { return d.name; },
+
+	async checkRegistry(deps, opts = {}) {
+		const { checkRubyRegistryDeps } = require("./ruby/registry");
+		return checkRubyRegistryDeps(deps, opts);
+	},
+	resolveEolProduct() { return null; },
+	recipe: require("./recipes").ruby,
+	nativeScanners: [],
+};

package/lib/codecs/select.js

@@ -5,6 +5,9 @@
  *   requested  : "auto" | "all" | "maven" | "maven,npm,pypi" | (legacy "both"|"npm")
  *   available  : ids candidats — pour "auto", les codecs détectés ; sinon tous.
  *   flags      : { noCodecs: ["npm", ...], noJs: bool }
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
  */
 function resolveActiveCodecs(requested, available, flags = {}) {
 	const { noCodecs = [], noJs = false } = flags;

package/lib/codecs/yarn.codec.js

@@ -6,6 +6,9 @@
  * recette (`resolutions`) au report. Le scan JS est fait UNE SEULE FOIS par le
  * codec npm (qui ramasse package-lock ET yarn.lock) — yarn.collect est un no-op
  * pour éviter le double scan ; le registre des codecs ne l'appelle pas.
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
  */
 const npm = require("./npm.codec");
 

package/lib/config.js

@@ -3,6 +3,9 @@
  *
  * Stores credentials and per-user preferences that should survive across runs.
  * Currently: NVD API key (so users don't have to re-export the env var).
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
  */
 const fs = require("fs");
 const path = require("path");

package/lib/core.js

@@ -1,6 +1,9 @@
 /**
  * lib/core.js — pure logic for parsing and cleaning Maven POMs.
  * No CLI, no console formatting. Callers pass options explicitly.
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
  */
 const fs = require("fs");
 const path = require("path");

package/lib/cpe.js

@@ -14,6 +14,9 @@
  *      and whether we can upgrade the match confidence.
  *   2. Given a dep coord, find CVEs in the index whose CPE configurations
  *      it satisfies. (Future use — kept compatible with the data shape.)
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
  */
 const { compareMavenVersions } = require("./maven-version");
 
@@ -144,6 +147,21 @@ function nodeAffectsDep(node, dep, cpeCoordMap) {
 	return false;
 }
 
+/**
+ * A node is "context-only" when it carries no vulnerable cpeMatch (recursively) —
+ * e.g. the "…AND runs on linux_kernel" platform node, whose CPEs are all
+ * `vulnerable: false`. In an AND configuration those nodes are runtime context we
+ * deliberately ignore (we assume the library is in use), so they must NOT be
+ * required for the config to count as affecting the dep.
+ */
+function nodeIsContextOnly(node) {
+	if (!node) return true;
+	const matches = node.cpeMatch || node.cpe_match || [];
+	if (matches.some(m => m.vulnerable !== false)) return false;
+	if (Array.isArray(node.children) && node.children.some(c => !nodeIsContextOnly(c))) return false;
+	return true;
+}
+
 /**
  * Decide whether a CPE (parsed) refers to the same artifact as a dep.
  * Lookup order:
@@ -221,11 +239,18 @@ function evaluateCveForDep(cveRecord, dep, cpeCoordMap) {
 	for (const cfg of configs) {
 		const nodes = cfg.nodes || [];
 		const op = (cfg.operator || "OR").toUpperCase();
-		const evals = nodes.map(n => {
-			const hit = nodeAffectsDep(n, dep, map);
-			return hit;
-		});
-		const passes = op === "AND" ? evals.every(Boolean) : evals.some(Boolean);
+		let passes;
+		if (op === "AND") {
+			// AND configs are typically (vulnerable software) AND (platform/runtime
+			// context). We assume the library is in use, so context-only nodes are not
+			// required — only the vulnerable node(s) must match the dep version. Without
+			// this, a "vulnerable:false" platform node makes .every() false and the real
+			// finding is wrongly dropped as a CPE false-positive.
+			const vulnNodes = nodes.filter(n => !nodeIsContextOnly(n));
+			passes = vulnNodes.length > 0 && vulnNodes.every(n => nodeAffectsDep(n, dep, map));
+		} else {
+			passes = nodes.some(n => nodeAffectsDep(n, dep, map));
+		}
 		if (passes) {
 			// Determine confidence: scan vulnerable cpeMatches that hit
 			for (const n of nodes) {

package/lib/csaf-export.js

@@ -0,0 +1,159 @@
+/**
+ * lib/csaf-export.js — emit a CSAF 2.0 VEX (csaf_vex) document from the resolved
+ * deps + matches. buildCsaf is pure; writeCsaf writes the JSON to disk.
+ *
+ * Spec: https://docs.oasis-open.org/csaf/csaf/v2.0/csaf-v2.0.html
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
+ */
+const fs = require("fs");
+const { purlFor } = require("./purl");
+
+function humanName(dep) {
+	const ns = dep.namespace || dep.groupId || "";
+	const name = dep.name || dep.artifactId;
+	const base = dep.ecosystem === "composer" && ns ? `${ns}/${name}` : (ns && dep.ecosystem === "maven" ? `${ns}:${name}` : name);
+	return dep.version ? `${base}@${dep.version}` : base;
+}
+
+// NVD "CVSS:3.1" → CVSS v3 JSON `version` field, or null when not a v3 score.
+// Tolerates the legacy "CVSS:V31"/"CVSS:V30" labels still sitting in pre-fix NVD
+// caches (the producer now emits "CVSS:3.1"; this keeps offline caches working).
+function cvssV3Version(cvssVersion) {
+	const v = String(cvssVersion || "");
+	if (v.includes("3.1") || /v31\b/i.test(v)) return "3.1";
+	if (v.includes("3.0") || v === "CVSS:3" || /v30\b/i.test(v)) return "3.0";
+	return null;
+}
+
+// CVSS v3 `baseSeverity` is a closed enum (NONE|LOW|MEDIUM|HIGH|CRITICAL). OSV/GHSA
+// often yield "UNKNOWN", which fails CSAF schema validation — derive it from the
+// base score's standard v3 bands when the label isn't a valid enum value.
+function cvssV3Severity(severity, score) {
+	const s = String(severity || "").toUpperCase();
+	if (["NONE", "LOW", "MEDIUM", "HIGH", "CRITICAL"].includes(s)) return s;
+	if (typeof score !== "number") return "NONE";
+	if (score === 0) return "NONE";
+	if (score < 4) return "LOW";
+	if (score < 7) return "MEDIUM";
+	if (score < 9) return "HIGH";
+	return "CRITICAL";
+}
+
+/**
+ * Build a CSAF 2.0 csaf_vex object.
+ * opts: { projectInfo, toolVersion, timestamp }
+ */
+function buildCsaf(resolvedDeps, cveMatches, opts = {}) {
+	const { projectInfo = {}, toolVersion = "0", timestamp } = opts;
+	const now = timestamp || projectInfo.generatedAt || "1970-01-01T00:00:00Z";
+
+	// Stable product ids + coordKey → product_id lookup.
+	const full_product_names = [];
+	const productIdByCoord = new Map();
+	let n = 0;
+	for (const dep of resolvedDeps.values()) {
+		const pid = `PROD-${n++}`;
+		const purl = purlFor(dep);
+		productIdByCoord.set(dep.coordKey, pid);
+		full_product_names.push({
+			product_id: pid,
+			name: humanName(dep),
+			...(purl ? { product_identification_helper: { purl } } : {}),
+		});
+	}
+
+	// One vulnerability per CVE, listing every affected product id.
+	const byCve = new Map();
+	for (const m of cveMatches || []) {
+		const id = m.cve?.id;
+		if (!id) continue;
+		let pid = productIdByCoord.get(m.dep?.coordKey);
+		// A match whose dep isn't in resolvedDeps (e.g. a Snyk-only finding) has no
+		// product yet — register it on the fly so the CVE never ends up with an empty
+		// known_affected[] (which is schema-invalid: product_status lists need ≥1 item).
+		if (!pid && m.dep && m.dep.coordKey) {
+			pid = `PROD-${n++}`;
+			const purl = purlFor(m.dep);
+			productIdByCoord.set(m.dep.coordKey, pid);
+			full_product_names.push({
+				product_id: pid,
+				name: humanName(m.dep),
+				...(purl ? { product_identification_helper: { purl } } : {}),
+			});
+		}
+		let v = byCve.get(id);
+		if (!v) {
+			const cve = m.cve;
+			const notes = [];
+			if (cve.description) notes.push({ category: "description", text: cve.description, title: "Description" });
+			const extras = [];
+			if (cve.epssPercentile != null) extras.push(`EPSS percentile ${Math.round(cve.epssPercentile * 100)}%`);
+			if (cve.kev) extras.push(`CISA KEV (known exploited)${cve.kevDueDate ? `, remediate by ${cve.kevDueDate}` : ""}`);
+			if (cve.priority?.band) extras.push(`fad-checker priority: ${cve.priority.band} (${cve.priority.score}/100)`);
+			if (extras.length) notes.push({ category: "other", text: extras.join("; "), title: "Prioritization" });
+
+			const v3ver = cvssV3Version(cve.cvssVersion);
+			const scores = (v3ver && cve.score != null) ? [{
+				cvss_v3: {
+					version: v3ver,
+					baseScore: cve.score,
+					baseSeverity: cvssV3Severity(cve.severity, cve.score),
+					// Only carry the vector when it actually IS a v3 vector — a v4 (or
+					// mismatched) vector string fails the v3 schema's vectorString pattern.
+					...((cve.cvssVector && /^CVSS:3\.[01]\//.test(cve.cvssVector)) ? { vectorString: cve.cvssVector } : {}),
+				},
+				products: [],
+			}] : [];
+
+			v = {
+				cve: id,
+				...(notes.length ? { notes } : {}),
+				product_status: { known_affected: [] },
+				...(scores.length ? { scores } : {}),
+				...(cve.kev ? { flags: [{ label: "exploited", product_ids: [] }] } : {}),
+			};
+			byCve.set(id, v);
+		}
+		if (pid && !v.product_status.known_affected.includes(pid)) {
+			v.product_status.known_affected.push(pid);
+			if (v.scores?.[0]) v.scores[0].products.push(pid);
+			if (v.flags?.[0]) v.flags[0].product_ids.push(pid);
+		}
+	}
+
+	return {
+		document: {
+			category: "csaf_vex",
+			csaf_version: "2.0",
+			title: `Vulnerability disclosure (VEX) — ${projectInfo.name || "project"}`,
+			publisher: {
+				category: "vendor",
+				name: "fad-checker",
+				namespace: "https://github.com/nathb2b/fad-checker",
+			},
+			tracking: {
+				id: `fad-checker-${(projectInfo.name || "project").replace(/[^A-Za-z0-9._-]/g, "-")}-${String(now).slice(0, 10)}`,
+				status: "final",
+				version: "1",
+				generator: { engine: { name: "fad-checker", version: String(toolVersion) } },
+				initial_release_date: now,
+				current_release_date: now,
+				revision_history: [{ number: "1", date: now, summary: "Initial automated VEX from fad-checker scan" }],
+			},
+		},
+		product_tree: { full_product_names },
+		// Drop any vulnerability that ended up with zero affected products (e.g. a
+		// match with no usable dep) — an empty product_status is schema-invalid.
+		vulnerabilities: [...byCve.values()].filter(v => v.product_status.known_affected.length > 0),
+	};
+}
+
+function writeCsaf(resolvedDeps, cveMatches, outputPath, opts = {}) {
+	const doc = buildCsaf(resolvedDeps, cveMatches, opts);
+	fs.writeFileSync(outputPath, JSON.stringify(doc, null, 2) + "\n");
+	return doc;
+}
+
+module.exports = { buildCsaf, writeCsaf };

package/lib/cve-download.js

@@ -5,6 +5,9 @@
  * The bundle is ~500 MB+. We shell out to curl + unzip rather than
  * bundling a zip library. The extracted JSON is deleted after the index
  * is built.
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
  */
 const fs = require("fs");
 const path = require("path");

package/lib/cve-match.js

@@ -1,6 +1,9 @@
 /**
  * lib/cve-match.js — collect resolved deps from the parsed POM tree and
  * match them against a CVE index built by lib/cve-download.js.
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
  */
 const { coord } = require("./core");
 const { compareMavenVersions, isVersionAffected } = require("./maven-version");
@@ -119,12 +122,17 @@ async function expandWithTransitives(resolvedDeps, opts = {}) {
 	// project pins a transitive's version via <dependencyManagement>.
 	const rootDepMgmt = new Map();
 	for (const dep of resolvedDeps.values()) {
+		// Embedded-binary coords don't participate in Maven Central resolution (a
+		// fat-jar already ships its deps, discovered by recursion) and must not act as
+		// a depMgmt override for the declared tree.
+		if (dep.provenance === "embedded") continue;
 		if (dep.version && !/\$\{/.test(dep.version)) {
 			rootDepMgmt.set(`${dep.groupId}:${dep.artifactId}`, { version: dep.version });
 		}
 	}
 
 	const directs = [...resolvedDeps.values()]
+		.filter(d => d.provenance !== "embedded")
 		.filter(d => d.version && !/\$\{/.test(d.version))
 		.filter(d => d.scope !== "test" || opts.includeTestDeps)
 		.filter(d => d.scope !== "parent");
@@ -238,7 +246,10 @@ function matchDepsAgainstCves(resolvedDeps, cveIndex, opts = {}) {
 	const seen = new Set();
 	const deduped = [];
 	for (const m of all) {
-		const k = `${m.dep.groupId}:${m.dep.artifactId}:${m.dep.version}|${m.cve.id}`;
+		// Key by coordKey (not g:a): identical to g:a for declared Maven deps, but
+		// keeps embedded-binary findings (coordKey "embedded:<path>") distinct from a
+		// declared dep with the same g:a:v so the embedded chapter doesn't lose them.
+		const k = `${m.dep.coordKey}:${m.dep.version}|${m.cve.id}`;
 		if (seen.has(k)) continue;
 		seen.add(k);
 		deduped.push(m);