fad-checker 2.0.1 → 2.1.1

package/lib/codecs/go/registry.js

@@ -0,0 +1,74 @@
+/**
+ * lib/codecs/go/registry.js — query the Go module proxy for the latest version.
+ *
+ * API: https://proxy.golang.org/<escaped-module>/@latest → { Version }
+ * Module paths are case-encoded (uppercase → !lower) per the proxy protocol.
+ * Deprecation/license aren't exposed by the proxy without fetching the module's
+ * go.mod, so this only contributes "outdated".
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
+ */
+const fs = require("fs");
+const path = require("path");
+const os = require("os");
+let pLimit; try { pLimit = require("p-limit"); } catch { pLimit = () => (fn) => fn(); }
+
+const CACHE_DIR = path.join(os.homedir(), ".fad-checker");
+const CACHE_PATH = path.join(CACHE_DIR, "go-proxy-cache.json");
+const CACHE_MAX_AGE_MS = 24 * 3600 * 1000;
+const PROXY = "https://proxy.golang.org";
+
+function loadCache() { try { return JSON.parse(fs.readFileSync(CACHE_PATH, "utf8")); } catch { return { entries: {}, meta: {} }; } }
+function saveCache(d) { try { fs.mkdirSync(CACHE_DIR, { recursive: true }); fs.writeFileSync(CACHE_PATH, JSON.stringify(d)); } catch { /* ignore */ } }
+
+// proxy.golang.org case-encoding: uppercase letters → "!" + lowercase.
+function escapeModule(mod) {
+	return String(mod).replace(/[A-Z]/g, c => "!" + c.toLowerCase());
+}
+
+function cmp(a, b) {
+	const pa = String(a).replace(/^v/, "").split(/[.\-+]/).map(n => parseInt(n, 10) || 0);
+	const pb = String(b).replace(/^v/, "").split(/[.\-+]/).map(n => parseInt(n, 10) || 0);
+	for (let i = 0; i < Math.max(pa.length, pb.length); i++) { const d = (pa[i] || 0) - (pb[i] || 0); if (d) return d > 0 ? 1 : -1; }
+	return 0;
+}
+
+async function fetchLatest(mod, { offline }) {
+	if (offline) return null;
+	try {
+		const res = await fetch(`${PROXY}/${escapeModule(mod)}/@latest`, { headers: { "User-Agent": "fad-checker-go" } });
+		if (!res.ok) return { error: `HTTP ${res.status}` };
+		const j = await res.json();
+		return { latest: (j.Version || "").replace(/^v/, "") || null };
+	} catch (e) { return { error: e.message }; }
+}
+
+async function checkGoRegistryDeps(deps, opts = {}) {
+	const { verbose, offline, allLibs = true, concurrency = 8 } = opts;
+	const targets = [...deps.values()].filter(d => d.ecosystem === "go" && d.version);
+	const result = { deprecated: [], outdated: [], licensed: [] };
+	if (!targets.length || !allLibs) return result;
+	const cache = loadCache();
+	const fresh = cache.meta?.fetchedAt && (Date.now() - cache.meta.fetchedAt) < CACHE_MAX_AGE_MS;
+	if (!fresh && !offline) cache.entries = {};
+	const limit = pLimit(concurrency);
+	await Promise.all(targets.map(t => limit(async () => {
+		const key = `${t.name}@${t.version}`;
+		let ex = cache.entries[key];
+		if (!ex) {
+			const r = await fetchLatest(t.name, { offline });
+			ex = (r && !r.error) ? { latest: r.latest } : { latest: null };
+			if (r && !r.error) cache.entries[key] = ex;
+		}
+		if (ex.latest && cmp(ex.latest, t.version) > 0) {
+			result.outdated.push({ dep: t, latest: ex.latest, releaseDate: null });
+			if (verbose) process.stdout.write(`  outdated: ${t.name} ${t.version} → ${ex.latest}\n`);
+		}
+	})));
+	cache.meta = { fetchedAt: Date.now() };
+	saveCache(cache);
+	return result;
+}
+
+module.exports = { checkGoRegistryDeps, escapeModule };

package/lib/codecs/go.codec.js

@@ -0,0 +1,76 @@
+/**
+ * lib/codecs/go.codec.js — codec Go (modules).
+ *
+ * Reads go.mod (authoritative on Go ≥1.17 — lists the full pruned graph) and
+ * falls back to go.sum. Vuln recall via OSV (ecosystem "Go"); outdated via the
+ * Go module proxy. The full module path is the dep name (namespace = "").
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
+ */
+const fs = require("fs");
+const path = require("path");
+const { makeDepRecord, coordKeyFor } = require("../dep-record");
+const G = require("./go/parse");
+
+const SKIP = new Set([".git", ".idea", ".vscode", "node_modules", "dist", "build", "out", "target", "vendor", "testdata"]);
+
+function findGoDirs(dir) {
+	const groups = [];
+	const stack = [dir];
+	while (stack.length) {
+		const cur = stack.pop();
+		let entries; try { entries = fs.readdirSync(cur, { withFileTypes: true }); } catch { continue; }
+		const names = new Set(entries.filter(e => e.isFile()).map(e => e.name));
+		if (names.has("go.mod") || names.has("go.sum")) groups.push({ dir: cur, names });
+		for (const e of entries) if (e.isDirectory() && !SKIP.has(e.name)) stack.push(path.join(cur, e.name));
+	}
+	return groups;
+}
+
+module.exports = {
+	id: "go",
+	label: "Go",
+	osvEcosystem: "Go",
+	manifestNames: ["go.mod", "go.sum"],
+
+	detect(dir) { return findGoDirs(dir).length > 0; },
+
+	async collect(dir, opts = {}) {
+		const { deps2Exclude } = opts;
+		const out = new Map();
+		const warnings = [];
+		const add = (d, manifestPath) => {
+			if (deps2Exclude && deps2Exclude.test(d.name)) return;
+			out.set(coordKeyFor("go", "", d.name), makeDepRecord({ ecosystem: "go", namespace: "", name: d.name, version: d.version, manifestPath, scope: d.scope, isDev: false }));
+		};
+		for (const g of findGoDirs(dir)) {
+			if (g.names.has("go.mod")) {
+				const fp = path.join(g.dir, "go.mod");
+				try {
+					const r = G.parseGoModFile(fp);
+					if (r.deps.length) { for (const d of r.deps) add(d, fp); continue; }
+					// go.mod with no require list (rare / very old) → fall through to go.sum.
+				} catch (e) { warnings.push({ type: "parse-error", manifestPath: fp, message: `go.mod parse failed: ${e.message}` }); }
+			}
+			if (g.names.has("go.sum")) {
+				const fp = path.join(g.dir, "go.sum");
+				try { const r = G.parseGoSumFile(fp); for (const d of r.deps) add(d, fp); }
+				catch (e) { warnings.push({ type: "parse-error", manifestPath: fp, message: `go.sum parse failed: ${e.message}` }); }
+			}
+		}
+		return { deps: out, warnings };
+	},
+
+	coordKey(d) { return coordKeyFor("go", "", d.name); },
+	formatCoord(d) { return d.version ? `${d.name}@${d.version}` : d.name; },
+	osvPackageName(d) { return d.name; },
+
+	async checkRegistry(deps, opts = {}) {
+		const { checkGoRegistryDeps } = require("./go/registry");
+		return checkGoRegistryDeps(deps, opts);
+	},
+	resolveEolProduct() { return null; },
+	recipe: require("./recipes").go,
+	nativeScanners: [],
+};

package/lib/codecs/index.js

@@ -4,6 +4,9 @@
  * getCodec(id)      → le codec, ou null
  * allCodecs()       → tous les codecs enregistrés, dans l'ordre report stable
  * detectCodecs(dir) → les codecs dont detect() est vrai sur ce répertoire
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
  */
 const { assertCodecShape } = require("./codec.interface");
 const maven = require("./maven.codec");
@@ -12,12 +15,14 @@ const yarn = require("./yarn.codec");
 const composer = require("./composer.codec");
 const pypi = require("./pypi.codec");
 const nuget = require("./nuget.codec");
+const go = require("./go.codec");
+const ruby = require("./ruby.codec");
 
 // Ordre stable pour le report (maven, npm, yarn, puis les nouveaux écosystèmes).
-const ORDER = ["maven", "npm", "yarn", "nuget", "composer", "pypi"];
+const ORDER = ["maven", "npm", "yarn", "nuget", "composer", "pypi", "go", "ruby"];
 
 const REGISTRY = new Map();
-for (const c of [maven, npm, yarn, composer, pypi, nuget]) {
+for (const c of [maven, npm, yarn, composer, pypi, nuget, go, ruby]) {
 	assertCodecShape(c);
 	REGISTRY.set(c.id, c);
 }

package/lib/codecs/maven/jar-scan.js

@@ -0,0 +1,199 @@
+/**
+ * lib/codecs/maven/jar-scan.js — discover Maven coordinates from embedded JARs.
+ *
+ * Many projects ship binary archives committed straight into the tree — a
+ * vendored `lib/*.jar`, a Spring-Boot fat-jar under `BOOT-INF/lib/`, an uber-jar
+ * with shaded dependencies, or jars inside a `.war`/`.ear`. None of those appear
+ * in a `pom.xml`, so the manifest-based scan misses them. This module walks the
+ * tree, reads every archive IN MEMORY (via fflate — a nested jar is just a zip
+ * Buffer, so recursion needs no temp files and there is no zip-slip risk because
+ * nothing is ever written to disk), and extracts each artifact's coordinate from,
+ * in order of trust:
+ *   1. META-INF/maven/<groupId>/<artifactId>/pom.properties  (authoritative)
+ *   2. META-INF/MANIFEST.MF  (Implementation-* / OSGi Bundle-* headers)
+ *   3. the file name  (commons-lang3-3.12.0.jar → commons-lang3 @ 3.12.0)
+ * An archive whose coordinate can't be determined is reported as a warning, not
+ * scanned blindly.
+ *
+ * Output deps carry provenance:"embedded" + a manifestPath using the `!/` nesting
+ * notation (e.g. dist/app.jar!/BOOT-INF/lib/log4j-core-2.14.0.jar) so the report
+ * can group them under their containing archive.
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
+ */
+const fs = require("fs");
+const path = require("path");
+const { unzipSync, strFromU8 } = require("fflate");
+const { makeDepRecord } = require("../../dep-record");
+
+const ARCHIVE_RE = /\.(jar|war|ear)$/i;
+const SKIP_DIRS = new Set(["node_modules", ".git", "target", "build", "out", "dist-newstyle", ".gradle", ".m2"]);
+// A fat-jar can be large; cap what we read into memory and how deep we recurse.
+const MAX_ARCHIVE_BYTES = 512 * 1024 * 1024;
+const MAX_DEPTH = 8;
+
+/** Parse a META-INF/maven/.../pom.properties body → { groupId, artifactId, version } | null. */
+function coordFromPomProperties(text) {
+	const get = re => (String(text || "").match(re) || [])[1]?.trim();
+	const groupId = get(/^groupId=(.+)$/m);
+	const artifactId = get(/^artifactId=(.+)$/m);
+	const version = get(/^version=(.+)$/m);
+	if (groupId && artifactId && version) return { groupId, artifactId, version };
+	return null;
+}
+
+/**
+ * Parse a MANIFEST.MF body → { groupId, artifactId, version } | null.
+ * Tries Implementation-* first, then OSGi Bundle-*. groupId is best-effort: the
+ * manifest rarely carries it, so we fall back to the OSGi symbolic name or "".
+ */
+function coordFromManifest(text) {
+	// MANIFEST.MF folds long lines with a leading space on continuation lines.
+	const unfolded = String(text || "").replace(/\r?\n /g, "");
+	const h = name => (unfolded.match(new RegExp(`^${name}:\\s*(.+)$`, "im")) || [])[1]?.trim();
+	const title = h("Implementation-Title") || h("Bundle-Name");
+	const implVer = h("Implementation-Version") || h("Bundle-Version") || h("Specification-Version");
+	const symbolic = h("Bundle-SymbolicName");
+	const vendor = h("Implementation-Vendor-Id") || h("Implementation-Vendor");
+	// OSGi symbolic name (org.apache.commons.lang3) is the most coordinate-like.
+	let groupId = "", artifactId = title || symbolic;
+	if (symbolic && symbolic.includes(".")) {
+		const parts = symbolic.split(";")[0].split(".");
+		artifactId = parts.pop();
+		groupId = parts.join(".");
+	} else if (vendor && vendor.includes(".")) {
+		groupId = vendor;
+	}
+	if (artifactId && implVer) return { groupId: groupId || vendor || "", artifactId, version: implVer };
+	return null;
+}
+
+/**
+ * Parse an archive file name → { groupId:"", artifactId, version } | null.
+ * Handles `name-1.2.3.jar`, `name-1.2.3-SNAPSHOT.jar`, `name-1.2.3-classifier.jar`.
+ * The version token is the first dash-separated segment that starts with a digit.
+ */
+function coordFromFilename(fileName) {
+    const base = String(fileName || "").replace(ARCHIVE_RE, "");
+    const m = base.match(/^(.+?)-(\d[\w.]*(?:-[A-Za-z0-9]+)?)$/);
+    if (!m) return null;
+    return { groupId: "", artifactId: m[1], version: m[2] };
+}
+
+/** Read the named entries from an in-memory zip buffer. Returns {} on a corrupt zip. */
+function readEntries(buf, filter) {
+	try {
+		return unzipSync(buf, filter ? { filter: f => filter(f.name) } : undefined);
+	} catch {
+		return null; // not a valid zip / unsupported (e.g. ZIP64 edge) — caller warns
+	}
+}
+
+/**
+ * Resolve a single archive's own coordinate + confidence from its entries.
+ * Returns { coord, source } | null. `source` ∈ pom.properties|manifest|filename.
+ */
+function coordForArchive(entries, fileName) {
+	// 1. pom.properties (there may be several in a fat-jar; the archive's OWN is the
+	//    one whose path matches its identity — but for the top artifact we take the
+	//    first. Nested libs are handled separately as their own archives.)
+	for (const name of Object.keys(entries)) {
+		if (/^META-INF\/maven\/[^/]+\/[^/]+\/pom\.properties$/.test(name)) {
+			const coord = coordFromPomProperties(strFromU8(entries[name]));
+			if (coord) return { coord, source: "pom.properties" };
+		}
+	}
+	const mf = entries["META-INF/MANIFEST.MF"];
+	if (mf) {
+		const coord = coordFromManifest(strFromU8(mf));
+		if (coord) return { coord, source: "manifest" };
+	}
+	const coord = coordFromFilename(fileName);
+	if (coord) return { coord, source: "filename" };
+	return null;
+}
+
+/**
+ * Recursively scan one archive buffer. Pushes embedded depRecords into `out` and
+ * warnings into `warnings`. `displayPath` is the `!/`-joined logical path.
+ */
+function scanArchiveBuffer(buf, displayPath, fileName, out, warnings, depth) {
+	if (depth > MAX_DEPTH) { warnings.push({ type: "embedded-jar", message: `nesting too deep, skipped: ${displayPath}` }); return; }
+	if (buf.length > MAX_ARCHIVE_BYTES) { warnings.push({ type: "embedded-jar", message: `archive too large (${Math.round(buf.length / 1048576)}MB), skipped: ${displayPath}` }); return; }
+
+	// Read only what we need: this archive's identity files + any nested archives.
+	const entries = readEntries(buf, name =>
+		/^META-INF\/maven\/[^/]+\/[^/]+\/pom\.properties$/.test(name) ||
+		name === "META-INF/MANIFEST.MF" ||
+		ARCHIVE_RE.test(name));
+	if (entries === null) { warnings.push({ type: "embedded-jar", message: `could not read archive (corrupt/unsupported): ${displayPath}` }); return; }
+
+	const resolved = coordForArchive(entries, fileName);
+	if (resolved) {
+		const { coord, source } = resolved;
+		out.push(makeDepRecord({
+			ecosystem: "maven",
+			namespace: coord.groupId || "",
+			name: coord.artifactId,
+			version: coord.version,
+			manifestPath: displayPath,
+			scope: "embedded",
+			provenance: "embedded",
+		}));
+	} else {
+		warnings.push({ type: "embedded-jar", message: `embedded archive with no resolvable Maven coordinate (not scanned): ${displayPath}` });
+	}
+
+	// Recurse into nested archives (fat-jar libs).
+	for (const name of Object.keys(entries)) {
+		if (!ARCHIVE_RE.test(name)) continue;
+		const nestedBuf = entries[name];
+		if (!nestedBuf || !nestedBuf.length) continue;
+		scanArchiveBuffer(Buffer.from(nestedBuf), `${displayPath}!/${name}`, path.basename(name), out, warnings, depth + 1);
+	}
+}
+
+/** Recursively list archive file paths under `dir`. */
+function findArchives(dir, acc = []) {
+	let entries;
+	try { entries = fs.readdirSync(dir, { withFileTypes: true }); }
+	catch { return acc; }
+	for (const e of entries) {
+		if (e.isDirectory && e.isDirectory()) {
+			if (SKIP_DIRS.has(e.name) || e.name.startsWith(".")) continue;
+			findArchives(path.join(dir, e.name), acc);
+		} else if (e.isFile() && ARCHIVE_RE.test(e.name)) {
+			acc.push(path.join(dir, e.name));
+		}
+	}
+	return acc;
+}
+
+/**
+ * Scan `rootDir` for embedded JAR/WAR/EAR coordinates.
+ * @returns { deps: depRecord[], warnings: [{type,message}] }
+ */
+function scanEmbeddedJars(rootDir, opts = {}) {
+	const out = [];
+	const warnings = [];
+	const archives = findArchives(rootDir);
+	for (const abs of archives) {
+		let buf;
+		try { buf = fs.readFileSync(abs); }
+		catch (e) { warnings.push({ type: "embedded-jar", message: `could not read ${abs}: ${e.message}` }); continue; }
+		const rel = opts.srcRoot ? path.relative(opts.srcRoot, abs) : abs;
+		scanArchiveBuffer(buf, rel.split(path.sep).join("/"), path.basename(abs), out, warnings, 0);
+	}
+	return { deps: out, warnings };
+}
+
+module.exports = {
+	scanEmbeddedJars,
+	findArchives,
+	coordFromPomProperties,
+	coordFromManifest,
+	coordFromFilename,
+	coordForArchive,
+	scanArchiveBuffer,
+};

package/lib/codecs/maven.codec.js

@@ -5,6 +5,9 @@
  * lib/core.js (parse, parent, merge multi-profils, dependencyManagement, imports
  * scope=import), le collecteur lib/cve-match.js, le walker transitif
  * lib/transitive.js et le scanner natif CVE-index (cvelistV5).
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
  */
 const core = require("../core");
 const { collectResolvedDeps, expandWithTransitives, matchDepsAgainstCves } = require("../cve-match");
@@ -47,7 +50,20 @@ module.exports = {
 			try { await core.getAllInheritedProps(pom, store, propsByPom); } catch { /* logged */ }
 		}
 		const deps = collectResolvedDeps(store, propsByPom, { ignoreTest: opts.ignoreTest, deps2Exclude: opts.deps2Exclude });
-		return { deps, warnings: [], _maven: { store, propsByPom, pomFiles } };
+		const warnings = [];
+		// Embedded binaries: discover Maven coordinates inside committed .jar/.war/.ear
+		// archives (vendored libs, fat-jars). Keyed by physical location so they don't
+		// merge with declared deps (they get their own report chapter). Default on;
+		// opts.scanJars === false (--no-jars) disables it.
+		if (opts.scanJars !== false) {
+			try {
+				const { scanEmbeddedJars } = require("./maven/jar-scan");
+				const { deps: embedded, warnings: jarWarnings } = scanEmbeddedJars(dir, { srcRoot: opts.srcRoot || dir });
+				for (const rec of embedded) deps.set(rec.coordKey, rec);
+				warnings.push(...jarWarnings);
+			} catch (e) { warnings.push({ type: "embedded-jar", message: `embedded-jar scan failed: ${e.message}` }); }
+		}
+		return { deps, warnings, _maven: { store, propsByPom, pomFiles } };
 	},
 
 	coordKey(d) { return coordKeyFor("maven", d.namespace || d.groupId, d.name || d.artifactId); },

package/lib/codecs/npm/collect.js

@@ -13,6 +13,9 @@
  *   - lockfile entries WIN over package.json range specs (concrete version)
  *   - if two lockfiles disagree, keep the highest semver-comparable version
  *   - dev/optional/peer downgrade to prod if any manifest puts the dep in prod
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
  */
 const path = require("path");
 const fs = require("fs");
@@ -91,6 +94,14 @@ function upsert(out, dep, manifestPath, lockType) {
 	} else if (!have && incoming) {
 		existing.version = incoming;
 	}
+	// Every DISTINCT concrete version is scanned, not just the highest: a JS tree
+	// routinely pins the same package at several versions (nested node_modules),
+	// and a CVE may affect only a lower one. cve-match.js / osv.js iterate
+	// dep.versions, so we union them here (makeDepRecord seeds `versions` with the
+	// record's own concrete version).
+	for (const v of record.versions || []) {
+		if (!existing.versions.includes(v)) existing.versions.push(v);
+	}
 	// Stronger scope wins (prod > peer > optional > dev)
 	if (rankScope(record.scope) > rankScope(existing.scope)) existing.scope = record.scope;
 	// A dep is "dev" overall only if every occurrence is dev. Any prod use → not dev.

package/lib/codecs/npm/parse.js

@@ -21,6 +21,9 @@
  *
  * The collector (lib/npm/collect.js) is responsible for merging across
  * files and applying exclusion rules.
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
  */
 const fs = require("fs");
 const path = require("path");

package/lib/codecs/npm/registry.js

@@ -12,6 +12,9 @@
  *
  * `packumentToFindings` is the pure extractor (unit-tested without network);
  * `checkNpmRegistryDeps` is the cached, concurrent driver.
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
  */
 const fs = require("fs");
 const path = require("path");
@@ -49,10 +52,13 @@ function replacementFromMessage(msg) {
  * Pure — no network, no cache. Either field is null when not applicable.
  */
 function packumentToFindings(packument, dep) {
-	const out = { deprecated: null, outdated: null };
+	const out = { deprecated: null, outdated: null, license: null };
 	if (!packument || typeof packument !== "object") return out;
 
 	const versionEntry = packument.versions?.[dep.version];
+	// License: prefer the resolved version's field, fall back to the packument root.
+	const lic = versionEntry?.license ?? versionEntry?.licenses ?? packument.license ?? packument.licenses;
+	if (lic) out.license = lic;
 	const depMsg = versionEntry && typeof versionEntry.deprecated === "string"
 		? versionEntry.deprecated.trim()
 		: "";
@@ -129,7 +135,7 @@ async function checkNpmRegistryDeps(resolvedDeps, opts = {}) {
 		const wj = webjarToNpm(d);
 		if (wj?.name) targets.push({ dep: d, npmName: wj.name, version: d.version });
 	}
-	const result = { deprecated: [], outdated: [] };
+	const result = { deprecated: [], outdated: [], licensed: [] };
 	if (!targets.length) return result;
 
 	const cache = loadCache();
@@ -169,6 +175,7 @@ async function checkNpmRegistryDeps(resolvedDeps, opts = {}) {
 					deprecated: f.deprecated ? { reason: f.deprecated.reason, replacement: f.deprecated.replacement } : null,
 					latest: f.outdated ? f.outdated.latest : null,
 					latestDate: f.outdated ? f.outdated.releaseDate : null,
+					license: f.license || null,
 				};
 				cache.entries[key] = extracted;
 			} else {
@@ -192,6 +199,7 @@ async function checkNpmRegistryDeps(resolvedDeps, opts = {}) {
 			result.outdated.push({ dep, latest: extracted.latest, releaseDate: extracted.latestDate || null });
 			if (verbose) process.stdout.write(`  outdated: ${npmName} ${version} → ${extracted.latest}\n`);
 		}
+		if (extracted.license) result.licensed.push({ dep, licenses: extracted.license, source: "npm" });
 	})));
 	if (liveCount) printProgress(true);
 

package/lib/codecs/npm.codec.js

@@ -8,6 +8,9 @@
  * npm.collect ramasse package-lock ET yarn.lock — chaque dep porte son
  * `ecosystemType` ("npm" | "yarn"). Le codec yarn (yarn.codec.js) n'existe que
  * pour fournir son label/recette au report ; il ne re-scanne pas.
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
  */
 const { collectNpmDeps, hasJsManifests } = require("./npm/collect");
 const { coordKeyFor } = require("../dep-record");

package/lib/codecs/nuget/parse.js

@@ -9,6 +9,9 @@
  *   packages.config        — XML legacy, <package id version targetFramework />.
  *
  * NuGet ids are case-insensitive (lowercased for the key; original case kept for display).
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
  */
 const fs = require("fs");
 const xml2js = require("xml2js");

package/lib/codecs/nuget/registry.js

@@ -6,6 +6,9 @@
  *   → { items: [ { items: [ { catalogEntry: { version, deprecation } } ] } ] }
  *
  * Cached in ~/.fad-checker/nuget-cache.json for 24h.
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
  */
 const fs = require("fs");
 const path = require("path");
@@ -31,11 +34,14 @@ function cmp(a, b) {
 function nugetRegistrationToFindings(reg, { version }) {
 	const entries = [];
 	for (const page of reg.items || []) for (const leaf of page.items || []) if (leaf.catalogEntry) entries.push(leaf.catalogEntry);
-	const out = { outdated: null, deprecated: null };
+	const out = { outdated: null, deprecated: null, license: null };
 	const stable = entries.map(e => e.version).filter(isStable);
 	if (stable.length) { const latest = stable.sort(cmp).at(-1); if (latest && cmp(latest, version) > 0) out.outdated = { latest }; }
 	const mine = entries.find(e => String(e.version) === String(version));
 	if (mine?.deprecation) out.deprecated = { reason: (mine.deprecation.reasons || []).join(", ") || "deprecated", replacement: mine.deprecation.alternatePackage?.id || null };
+	// Modern packages expose an SPDX licenseExpression; older ones only a licenseUrl (→ unknown).
+	const licEntry = mine || entries.at(-1);
+	if (licEntry?.licenseExpression) out.license = licEntry.licenseExpression;
 	return out;
 }
 
@@ -52,7 +58,7 @@ async function fetchRegistration(name, { offline }) {
 async function checkNugetRegistryDeps(deps, opts = {}) {
 	const { verbose, offline, allLibs = true, concurrency = 8 } = opts;
 	const targets = [...deps.values()].filter(d => d.ecosystem === "nuget" && d.version);
-	const result = { deprecated: [], outdated: [] };
+	const result = { deprecated: [], outdated: [], licensed: [] };
 	if (!targets.length) return result;
 	const cache = loadCache();
 	const fresh = cache.meta?.fetchedAt && (Date.now() - cache.meta.fetchedAt) < CACHE_MAX_AGE_MS;
@@ -65,12 +71,13 @@ async function checkNugetRegistryDeps(deps, opts = {}) {
 			const reg = await fetchRegistration(t.name, { offline });
 			if (reg && !reg.error) {
 				const f = nugetRegistrationToFindings(reg, { version: t.version });
-				ex = { deprecated: f.deprecated, latest: f.outdated?.latest || null };
+				ex = { deprecated: f.deprecated, latest: f.outdated?.latest || null, license: f.license || null };
 				cache.entries[key] = ex;
 			} else {
-				ex = { deprecated: null, latest: null };
+				ex = { deprecated: null, latest: null, license: null };
 			}
 		}
+		if (ex.license) result.licensed.push({ dep: t, licenses: ex.license, source: "nuget" });
 		if (ex.deprecated) {
 			result.deprecated.push({ dep: t, severity: "MEDIUM", replacement: ex.deprecated.replacement, reason: ex.deprecated.reason, source: "nuget" });
 			if (verbose) process.stdout.write(`  deprecated: ${t.name}@${t.version}\n`);

package/lib/codecs/nuget.codec.js

@@ -6,6 +6,9 @@
  * else packages.config), NuGet registration registry (deprecation + outdated),
  * and EOL. NuGet ids are case-insensitive: the key is lowercased, dep.name keeps
  * the original casing for display / OSV.
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
  */
 const fs = require("fs");
 const path = require("path");

package/lib/codecs/pypi/parse.js

@@ -10,6 +10,9 @@
  *
  * All names are PEP 503 normalized (lowercase, runs of -_. → single -) so they
  * match OSV / PyPI / the resolved-deps key.
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
  */
 const fs = require("fs");
 const path = require("path");
@@ -37,9 +40,11 @@ function parseTomlPackages(filePath, type) {
 	const deps = [];
 	for (const p of pkgs) {
 		if (!p.name || !p.version) continue;
-		// pdm marks groups; poetry/uv don't reliably → default prod.
+		// pdm/poetry≥1.5 use `groups`; classic poetry.lock (≤1.4) uses `category = "dev"`.
 		const groups = Array.isArray(p.groups) ? p.groups : null;
-		const isDev = groups ? groups.every(g => g === "dev") : false;
+		const isDev = groups
+			? groups.every(g => g === "dev")
+			: (p.category ? String(p.category).toLowerCase() === "dev" : false);
 		deps.push({ name: pep503(p.name), version: String(p.version), scope: isDev ? "dev" : "prod", isDev });
 	}
 	return { manifestPath: filePath, manifestType: type, deps };