fad-checker 2.1.1 → 2.2.0

package/lib/codecs/npm/parse.js

@@ -362,6 +362,7 @@ const DEFAULT_JS_SKIP_DIRS = new Set([
 
 function findJsManifests(rootDir, opts = {}) {
 	const { skipDirs = DEFAULT_JS_SKIP_DIRS } = opts;
+	const skipDir = opts.skipDir || ((child, name) => skipDirs.has(name));
 	const found = [];
 	const stack = [rootDir];
 	while (stack.length) {
@@ -374,7 +375,7 @@ function findJsManifests(rootDir, opts = {}) {
 		for (const e of entries) {
 			const p = path.join(cur, e.name);
 			if (e.isDirectory()) {
-				if (skipDirs.has(e.name)) continue;
+				if (skipDir(p, e.name)) continue;
 				stack.push(p);
 			} else if (e.isFile()) {
 				if (e.name === "package.json") here.packageJson = p;
@@ -388,6 +389,31 @@ function findJsManifests(rootDir, opts = {}) {
 	return found;
 }
 
+// Parallel equivalent of findJsManifests — concurrent readdir so the walk isn't
+// serialized one round-trip at a time on a high-latency filesystem.
+async function findJsManifestsAsync(rootDir, opts = {}) {
+	const { skipDirs = DEFAULT_JS_SKIP_DIRS } = opts;
+	const skipDir = opts.skipDir || ((child, name) => skipDirs.has(name));
+	const { walkDirs } = require("../../parallel-walk");
+	const found = [];
+	await walkDirs(rootDir, {
+		skipDir,
+		onDir: (cur, entries) => {
+			const here = { dir: cur, packageJson: null, packageLock: null, yarnLock: null, pnpmLock: null };
+			for (const e of entries) {
+				if (!e.isFile()) continue;
+				const p = path.join(cur, e.name);
+				if (e.name === "package.json") here.packageJson = p;
+				else if (e.name === "package-lock.json") here.packageLock = p;
+				else if (e.name === "yarn.lock") here.yarnLock = p;
+				else if (e.name === "pnpm-lock.yaml") here.pnpmLock = p;
+			}
+			if (here.packageJson || here.packageLock || here.yarnLock || here.pnpmLock) found.push(here);
+		},
+	});
+	return found;
+}
+
 module.exports = {
 	parsePackageJson,
 	parsePackageLock,
@@ -395,4 +421,6 @@ module.exports = {
 	parseYarnBerry,
 	parsePnpmLock,
 	findJsManifests,
+	findJsManifestsAsync,
+	DEFAULT_JS_SKIP_DIRS,
 };

package/lib/codecs/npm/registry.js

@@ -21,11 +21,11 @@ const path = require("path");
 const os = require("os");
 const pLimit = require("p-limit");
 const { semverCompare, webjarToNpm } = require("./collect");
+const { withPublic, authHeaderFor, normalise } = require("../../registries");
 
 const CACHE_DIR = path.join(os.homedir(), ".fad-checker");
 const CACHE_PATH = path.join(CACHE_DIR, "npm-registry-cache.json");
 const CACHE_MAX_AGE_MS = 24 * 3600 * 1000; // 1 day, aligned with Maven Central
-const REGISTRY = "https://registry.npmjs.org";
 
 function loadCache() {
 	try { return JSON.parse(fs.readFileSync(CACHE_PATH, "utf8")); }
@@ -89,29 +89,40 @@ function packumentToFindings(packument, dep) {
 	return out;
 }
 
-/** registry.npmjs.org path-encodes a scoped name's slash. */
-function packumentUrl(name) {
-	return name.startsWith("@")
-		? `${REGISTRY}/${name.replace("/", "%2F")}`
-		: `${REGISTRY}/${encodeURIComponent(name)}`;
+/** registry path-encodes a scoped name's slash. */
+function encodeName(name) {
+	return name.startsWith("@") ? name.replace("/", "%2F") : encodeURIComponent(name);
 }
 
+/**
+ * Fetch a packument, trying each custom registry first (with per-registry auth),
+ * then the public registry.npmjs.org as the final fallback. Returns the parsed
+ * packument, or { error } if every base failed.
+ */
 async function fetchPackument(name, opts = {}) {
 	if (opts.offline) return null;
 	const timeoutMs = opts.timeoutMs || 15000;
-	try {
+	const fetcher = opts.fetcher || globalThis.fetch;
+	const bases = withPublic("npm", opts.registries || []);
+	const enc = encodeName(name);
+	let lastErr = null;
+	for (const base of bases) {
 		// Per-request timeout: a single stalled connection must never hang the
 		// whole run (one slow package would otherwise occupy a concurrency slot
 		// forever and starve the pool).
-		const res = await fetch(packumentUrl(name), {
-			headers: { "User-Agent": "fad-checker-npm-registry", Accept: "application/json" },
-			signal: AbortSignal.timeout(timeoutMs),
-		});
-		if (!res.ok) return { error: `HTTP ${res.status}` };
-		return await res.json();
-	} catch (err) {
-		return { error: err.name === "TimeoutError" ? `timeout after ${timeoutMs}ms` : err.message };
+		const url = normalise(base.url) + enc;
+		const headers = { "User-Agent": "fad-checker-npm-registry", Accept: "application/json" };
+		const ah = authHeaderFor(base);
+		if (ah) headers.Authorization = ah;
+		try {
+			const res = await fetcher(url, { headers, signal: AbortSignal.timeout(timeoutMs) });
+			if (res.ok) return await res.json();
+			lastErr = `HTTP ${res.status}`;
+		} catch (err) {
+			lastErr = err.name === "TimeoutError" ? `timeout after ${timeoutMs}ms` : err.message;
+		}
 	}
+	return { error: lastErr || "no data" };
 }
 
 /**
@@ -124,7 +135,7 @@ async function fetchPackument(name, opts = {}) {
  * opts: { verbose, offline, allLibs, concurrency = 8 }
  */
 async function checkNpmRegistryDeps(resolvedDeps, opts = {}) {
-	const { verbose, offline, allLibs = true, concurrency = 8, onProgress } = opts;
+	const { verbose, offline, allLibs = true, concurrency = 8, onProgress, registries = [] } = opts;
 	// Targets = npm deps (queried by their own name) + WebJars (queried by their
 	// derived npm-equivalent name; version matches upstream). The original dep
 	// is kept for display/results so the report shows e.g. org.webjars:angularjs.
@@ -168,7 +179,7 @@ async function checkNpmRegistryDeps(resolvedDeps, opts = {}) {
 		const key = cacheKey(t);
 		let extracted = cache.entries[key];
 		if (!extracted) {
-			const packument = await fetchPackument(npmName, { offline });
+			const packument = await fetchPackument(npmName, { offline, registries });
 			if (packument && !packument.error) {
 				const f = packumentToFindings(packument, { version });
 				extracted = {
@@ -212,4 +223,4 @@ async function checkNpmRegistryDeps(resolvedDeps, opts = {}) {
 	return result;
 }
 
-module.exports = { packumentToFindings, checkNpmRegistryDeps, replacementFromMessage };
+module.exports = { packumentToFindings, checkNpmRegistryDeps, replacementFromMessage, fetchPackument };

package/lib/codecs/npm.codec.js

@@ -20,9 +20,9 @@ const retireScanner = {
 	id: "retire",
 	kind: "vendored",   // résultats → chapitre vendored-JS (séparé des CVE)
 	async scan(_deps, opts = {}) {
-		const { scanWithRetire } = require("../retire");
-		const matches = await scanWithRetire(opts.src, { verbose: opts.verbose, force: !!opts.retireRefresh, offline: !!opts.offline });
-		return { matches, meta: {} };
+		const { scanWithRetireFull } = require("../retire");
+		const { matches, inventory } = await scanWithRetireFull(opts.src, { verbose: opts.verbose, force: !!opts.retireRefresh, offline: !!opts.offline });
+		return { matches, meta: { inventory } };
 	},
 };
 
@@ -49,7 +49,13 @@ module.exports = {
 	recipe: require("./recipes").npm,
 	// collect ramasse TOUTES les deps JS (package-lock + yarn.lock).
 	async collect(dir, opts = {}) {
-		const deps = collectNpmDeps(dir, opts);
+		// Parallel manifest discovery (concurrent readdir) — much faster than the
+		// serial walk on a high-latency filesystem; parsing then runs synchronously.
+		const { findJsManifestsAsync, DEFAULT_JS_SKIP_DIRS } = require("./npm/parse");
+		const { makeDirFilter } = require("../path-filter");
+		const skipDir = makeDirFilter({ srcRoot: opts.srcRoot || dir, defaultSkip: DEFAULT_JS_SKIP_DIRS, excludePath: opts.excludePath, useDefaults: opts.defaultExcludes !== false });
+		const manifestGroups = await findJsManifestsAsync(dir, { skipDir });
+		const deps = collectNpmDeps(dir, { ...opts, manifestGroups });
 		return { deps, warnings: deps.warnings || [] };
 	},
 };

package/lib/codecs/nuget.codec.js

@@ -19,7 +19,7 @@ const SKIP = new Set([".git", ".idea", ".vscode", "node_modules", "dist", "build
 // MSBuild project files share the same <PackageReference> schema — C#, F#, VB.
 const PROJ_RE = /\.(csproj|fsproj|vbproj)$/i;
 
-function findNugetDirs(dir) {
+function findNugetDirs(dir, skipDir = (child, name) => SKIP.has(name)) {
 	const groups = [];
 	const stack = [dir];
 	while (stack.length) {
@@ -30,11 +30,15 @@ function findNugetDirs(dir) {
 		if (files.includes("packages.lock.json") || files.includes("packages.config") || csprojs.length) {
 			groups.push({ dir: cur, files, csprojs });
 		}
-		for (const e of entries) if (e.isDirectory() && !SKIP.has(e.name)) stack.push(path.join(cur, e.name));
+		for (const e of entries) if (e.isDirectory() && !skipDir(path.join(cur, e.name), e.name)) stack.push(path.join(cur, e.name));
 	}
 	return groups;
 }
 
+function dirFilter(dir, opts) {
+	return require("../path-filter").makeDirFilter({ srcRoot: opts.srcRoot || dir, defaultSkip: SKIP, excludePath: opts.excludePath, useDefaults: opts.defaultExcludes !== false });
+}
+
 module.exports = {
 	id: "nuget",
 	label: "NuGet",
@@ -51,7 +55,7 @@ module.exports = {
 			if (deps2Exclude && deps2Exclude.test(d.name)) return;
 			out.set(coordKeyFor("nuget", "", d.name), makeDepRecord({ ecosystem: "nuget", namespace: "", name: d.name, version: d.version, manifestPath, scope: d.scope, isDev: d.isDev }));
 		};
-		for (const g of findNugetDirs(dir)) {
+		for (const g of findNugetDirs(dir, dirFilter(dir, opts))) {
 			if (g.files.includes("packages.lock.json")) {
 				const fp = path.join(g.dir, "packages.lock.json");
 				try { const { deps } = await N.parsePackagesLockJson(fp); for (const d of deps) add(d, fp); }

package/lib/codecs/pypi/registry.js

@@ -14,11 +14,11 @@ const fs = require("fs");
 const path = require("path");
 const os = require("os");
 let pLimit; try { pLimit = require("p-limit"); } catch { pLimit = () => (fn) => fn(); }
+const { withPublic, authHeaderFor, normalise } = require("../../registries");
 
 const CACHE_DIR = path.join(os.homedir(), ".fad-checker");
 const CACHE_PATH = path.join(CACHE_DIR, "pypi-cache.json");
 const CACHE_MAX_AGE_MS = 24 * 3600 * 1000;
-const API = "https://pypi.org/pypi";
 
 function loadCache() { try { return JSON.parse(fs.readFileSync(CACHE_PATH, "utf8")); } catch { return { entries: {}, meta: {} }; } }
 function saveCache(d) { try { fs.mkdirSync(CACHE_DIR, { recursive: true }); fs.writeFileSync(CACHE_PATH, JSON.stringify(d)); } catch { /* ignore */ } }
@@ -56,18 +56,24 @@ function pypiToFindings(data, { version }) {
 	return out;
 }
 
-async function fetchProject(name, { offline }) {
+// Custom registries first (same JSON API: <base>/<name>/json), then pypi.org.
+async function fetchProject(name, { offline, registries = [], fetcher = globalThis.fetch } = {}) {
 	if (offline) return null;
-	try {
-		const res = await fetch(`${API}/${name}/json`, { headers: { "User-Agent": "fad-checker-pypi" } });
-		if (!res.ok) return { error: `HTTP ${res.status}` };
-		return await res.json();
-	} catch (e) { return { error: e.message }; }
+	const bases = withPublic("pypi", registries);
+	let lastErr = null;
+	for (const base of bases) {
+		const url = normalise(base.url) + `${name}/json`;
+		const headers = { "User-Agent": "fad-checker-pypi", Accept: "application/json" };
+		const ah = authHeaderFor(base); if (ah) headers.Authorization = ah;
+		try { const res = await fetcher(url, { headers }); if (res.ok) return await res.json(); lastErr = `HTTP ${res.status}`; }
+		catch (e) { lastErr = e.message; }
+	}
+	return { error: lastErr || "no data" };
 }
 
 // Mirror of checkNpmRegistryDeps: returns { deprecated:[], outdated:[] }.
 async function checkPypiRegistryDeps(deps, opts = {}) {
-	const { verbose, offline, allLibs = true, concurrency = 8 } = opts;
+	const { verbose, offline, allLibs = true, concurrency = 8, registries = [] } = opts;
 	const targets = [...deps.values()].filter(d => d.ecosystem === "pypi" && d.version);
 	const result = { deprecated: [], outdated: [], licensed: [] };
 	if (!targets.length) return result;
@@ -79,7 +85,7 @@ async function checkPypiRegistryDeps(deps, opts = {}) {
 		const key = `${t.name}@${t.version}`;
 		let ex = cache.entries[key];
 		if (!ex) {
-			const data = await fetchProject(t.name, { offline });
+			const data = await fetchProject(t.name, { offline, registries });
 			if (data && !data.error) {
 				const f = pypiToFindings(data, { version: t.version });
 				ex = { yanked: f.yanked, inactive: f.inactive, latest: f.outdated?.latest || null, license: f.license || null };
@@ -105,4 +111,4 @@ async function checkPypiRegistryDeps(deps, opts = {}) {
 	return result;
 }
 
-module.exports = { pypiToFindings, pypiLicense, checkPypiRegistryDeps };
+module.exports = { pypiToFindings, pypiLicense, checkPypiRegistryDeps, fetchProject };

package/lib/codecs/pypi.codec.js

@@ -24,7 +24,7 @@ const LOCKS = [
 
 const FALLBACK_MANIFESTS = ["pyproject.toml", "requirements.txt"];
 
-function findPyDirs(dir) {
+function findPyDirs(dir, skipDir = (child, name) => SKIP.has(name)) {
 	const groups = [];
 	const stack = [dir];
 	while (stack.length) {
@@ -32,11 +32,15 @@ function findPyDirs(dir) {
 		let entries; try { entries = fs.readdirSync(cur, { withFileTypes: true }); } catch { continue; }
 		const names = new Set(entries.filter(e => e.isFile()).map(e => e.name));
 		if ([...LOCKS.map(l => l[0]), ...FALLBACK_MANIFESTS].some(n => names.has(n))) groups.push({ dir: cur, names });
-		for (const e of entries) if (e.isDirectory() && !SKIP.has(e.name)) stack.push(path.join(cur, e.name));
+		for (const e of entries) if (e.isDirectory() && !skipDir(path.join(cur, e.name), e.name)) stack.push(path.join(cur, e.name));
 	}
 	return groups;
 }
 
+function pyDirFilter(dir, opts) {
+	return require("../path-filter").makeDirFilter({ srcRoot: opts.srcRoot || dir, defaultSkip: SKIP, excludePath: opts.excludePath, useDefaults: opts.defaultExcludes !== false });
+}
+
 module.exports = {
 	id: "pypi",
 	label: "PyPI",
@@ -54,7 +58,7 @@ module.exports = {
 			if (deps2Exclude && deps2Exclude.test(d.name)) return;
 			out.set(coordKeyFor("pypi", "", d.name), makeDepRecord({ ecosystem: "pypi", namespace: "", name: d.name, version: d.version, manifestPath, scope: d.scope, isDev: d.isDev }));
 		};
-		for (const g of findPyDirs(dir)) {
+		for (const g of findPyDirs(dir, pyDirFilter(dir, opts))) {
 			const lock = LOCKS.find(([n]) => g.names.has(n));
 			if (lock) {
 				const fp = path.join(g.dir, lock[0]);

package/lib/codecs/recipes.js

@@ -132,4 +132,12 @@ const ruby = {
 	directSection: "B. Or pin them in the Gemfile and run bundle update",
 };
 
-module.exports = { maven, npm, yarn, composer, pypi, nuget, go, ruby, dependencyManagementSnippet, npmOverridesSnippet, yarnResolutionsSnippet, composerRequireSnippet, pipInstallSnippet, dotnetAddSnippet, goGetSnippet, bundleUpdateSnippet };
+const binary = {
+	label: "Binaries",
+	pinSection: "A. Replace or remove the vendored binary",
+	pinIntro: cnt => `Replace ${cnt} committed binar${cnt > 1 ? "ies" : "y"} with a managed dependency, or verify their provenance/checksum:`,
+	snippet: (items) => ((items || []).map(it => `# ${it.artifactId || "binary"}: replace with a managed dependency, or record its origin and verify its checksum`).join("\n")) || "# verify the provenance/checksum of each vendored binary, or replace it with a managed dependency",
+	directSection: "B. Prefer declaring these through a package manager (Maven/npm/NuGet/…)",
+};
+
+module.exports = { maven, npm, yarn, composer, pypi, nuget, go, ruby, binary, dependencyManagementSnippet, npmOverridesSnippet, yarnResolutionsSnippet, composerRequireSnippet, pipInstallSnippet, dotnetAddSnippet, goGetSnippet, bundleUpdateSnippet };

package/lib/codecs/ruby/registry.js

@@ -11,11 +11,11 @@ const fs = require("fs");
 const path = require("path");
 const os = require("os");
 let pLimit; try { pLimit = require("p-limit"); } catch { pLimit = () => (fn) => fn(); }
+const { withPublic, authHeaderFor, normalise } = require("../../registries");
 
 const CACHE_DIR = path.join(os.homedir(), ".fad-checker");
 const CACHE_PATH = path.join(CACHE_DIR, "rubygems-cache.json");
 const CACHE_MAX_AGE_MS = 24 * 3600 * 1000;
-const API = "https://rubygems.org/api/v1/gems";
 
 function loadCache() { try { return JSON.parse(fs.readFileSync(CACHE_PATH, "utf8")); } catch { return { entries: {}, meta: {} }; } }
 function saveCache(d) { try { fs.mkdirSync(CACHE_DIR, { recursive: true }); fs.writeFileSync(CACHE_PATH, JSON.stringify(d)); } catch { /* ignore */ } }
@@ -36,17 +36,23 @@ function gemToFindings(data) {
 	return out;
 }
 
-async function fetchGem(name, { offline }) {
+// Custom gem servers first (same JSON API: <base>/<gem>.json), then rubygems.org.
+async function fetchGem(name, { offline, registries = [], fetcher = globalThis.fetch } = {}) {
 	if (offline) return null;
-	try {
-		const res = await fetch(`${API}/${encodeURIComponent(name)}.json`, { headers: { "User-Agent": "fad-checker-rubygems" } });
-		if (!res.ok) return { error: `HTTP ${res.status}` };
-		return await res.json();
-	} catch (e) { return { error: e.message }; }
+	const bases = withPublic("ruby", registries);
+	let lastErr = null;
+	for (const base of bases) {
+		const url = normalise(base.url) + `${encodeURIComponent(name)}.json`;
+		const headers = { "User-Agent": "fad-checker-rubygems", Accept: "application/json" };
+		const ah = authHeaderFor(base); if (ah) headers.Authorization = ah;
+		try { const res = await fetcher(url, { headers }); if (res.ok) return await res.json(); lastErr = `HTTP ${res.status}`; }
+		catch (e) { lastErr = e.message; }
+	}
+	return { error: lastErr || "no data" };
 }
 
 async function checkRubyRegistryDeps(deps, opts = {}) {
-	const { verbose, offline, allLibs = true, concurrency = 8 } = opts;
+	const { verbose, offline, allLibs = true, concurrency = 8, registries = [] } = opts;
 	const targets = [...deps.values()].filter(d => d.ecosystem === "ruby" && d.version);
 	const result = { deprecated: [], outdated: [], licensed: [] };
 	if (!targets.length) return result;
@@ -58,7 +64,7 @@ async function checkRubyRegistryDeps(deps, opts = {}) {
 		const key = `${t.name}@${t.version}`;
 		let ex = cache.entries[key];
 		if (!ex) {
-			const data = await fetchGem(t.name, { offline });
+			const data = await fetchGem(t.name, { offline, registries });
 			ex = (data && !data.error) ? gemToFindings(data) : { latest: null, license: null };
 			if (data && !data.error) cache.entries[key] = ex;
 		}
@@ -73,4 +79,4 @@ async function checkRubyRegistryDeps(deps, opts = {}) {
 	return result;
 }
 
-module.exports = { gemToFindings, checkRubyRegistryDeps };
+module.exports = { gemToFindings, checkRubyRegistryDeps, fetchGem };

package/lib/codecs/ruby.codec.js

@@ -14,7 +14,7 @@ const R = require("./ruby/parse");
 
 const SKIP = new Set([".git", ".idea", ".vscode", "node_modules", "dist", "build", "out", "target", "vendor", "tmp"]);
 
-function findGemfileLocks(dir) {
+function findGemfileLocks(dir, skipDir = (child, name) => SKIP.has(name)) {
 	const found = [];
 	const stack = [dir];
 	while (stack.length) {
@@ -22,12 +22,16 @@ function findGemfileLocks(dir) {
 		let entries; try { entries = fs.readdirSync(cur, { withFileTypes: true }); } catch { continue; }
 		for (const e of entries) {
 			if (e.isFile() && e.name === "Gemfile.lock") found.push(path.join(cur, e.name));
-			else if (e.isDirectory() && !SKIP.has(e.name)) stack.push(path.join(cur, e.name));
+			else if (e.isDirectory() && !skipDir(path.join(cur, e.name), e.name)) stack.push(path.join(cur, e.name));
 		}
 	}
 	return found;
 }
 
+function dirFilter(dir, opts) {
+	return require("../path-filter").makeDirFilter({ srcRoot: opts.srcRoot || dir, defaultSkip: SKIP, excludePath: opts.excludePath, useDefaults: opts.defaultExcludes !== false });
+}
+
 module.exports = {
 	id: "ruby",
 	label: "Ruby",
@@ -40,7 +44,7 @@ module.exports = {
 		const { deps2Exclude } = opts;
 		const out = new Map();
 		const warnings = [];
-		for (const fp of findGemfileLocks(dir)) {
+		for (const fp of findGemfileLocks(dir, dirFilter(dir, opts))) {
 			try {
 				const { deps } = R.parseGemfileLockFile(fp);
 				for (const d of deps) {

package/lib/config.js

@@ -44,35 +44,45 @@ function getNvdApiKey() {
 }
 
 /**
- * Custom Maven repositories (Nexus, Artifactory, JBoss, …) the user has
- * configured. Returned as an array of { name, url, auth? } where `auth` is
- * pre-encoded "user:pass" (caller wraps as Basic <base64>).
+ * Per-ecosystem custom registries (Nexus/Artifactory/JBoss, Verdaccio, devpi,
+ * Gemfury, Athens, …) the user has configured. Stored under config key
+ * `registries`: { <ecosystem>: [{ name, url, auth?, token? }] } where `auth` is
+ * "user:pass" (→ Basic) and `token` is a Bearer token.
  *
- * Maven Central is intentionally NOT included here — callers append it as
- * the final fallback. That keeps the user's repos in priority order while
- * always ensuring Central works as a safety net.
+ * Public registries (Maven Central, registry.npmjs.org, …) are intentionally
+ * NOT stored here — callers append them as the final fallback so the user's
+ * registries stay in priority order while the public one is always a safety net.
  */
-function getMavenRepos() {
-	const list = get("maven_repos") || [];
+function getRegistryMap() {
+	const m = get("registries");
+	return (m && typeof m === "object" && !Array.isArray(m)) ? m : {};
+}
+
+function getRegistries(ecosystem) {
+	const list = getRegistryMap()[ecosystem];
 	return Array.isArray(list) ? list : [];
 }
 
-function setMavenRepos(list) {
-	return set("maven_repos", Array.isArray(list) && list.length ? list : null);
+function setRegistryMap(map) {
+	return set("registries", map && Object.keys(map).length ? map : null);
 }
 
-function addMavenRepo(name, url, auth = null) {
-	const list = getMavenRepos().filter(r => r.name !== name);
-	list.push({ name, url, ...(auth ? { auth } : {}) });
-	setMavenRepos(list);
+function addRegistry(ecosystem, name, url, { auth = null, token = null } = {}) {
+	const map = getRegistryMap();
+	const list = (map[ecosystem] || []).filter(r => r.name !== name);
+	list.push({ name, url, ...(auth ? { auth } : {}), ...(token ? { token } : {}) });
+	map[ecosystem] = list;
+	setRegistryMap(map);
 	return list;
 }
 
-function removeMavenRepo(name) {
-	const before = getMavenRepos();
-	const after = before.filter(r => r.name !== name);
-	setMavenRepos(after);
-	return before.length !== after.length;
+function removeRegistry(ecosystem, name) {
+	const map = getRegistryMap();
+	const before = (map[ecosystem] || []).length;
+	map[ecosystem] = (map[ecosystem] || []).filter(r => r.name !== name);
+	if (!map[ecosystem].length) delete map[ecosystem];
+	setRegistryMap(map);
+	return before !== (map[ecosystem]?.length || 0);
 }
 
 module.exports = {
@@ -83,8 +93,9 @@ module.exports = {
 	set,
 	get,
 	getNvdApiKey,
-	getMavenRepos,
-	setMavenRepos,
-	addMavenRepo,
-	removeMavenRepo,
+	getRegistryMap,
+	getRegistries,
+	setRegistryMap,
+	addRegistry,
+	removeRegistry,
 };

package/lib/core.js

@@ -19,7 +19,9 @@ const SKIP_DIRS = new Set([
 
 const coord = v => (v == null ? null : String(v).trim() || null);
 
-function findPomFiles(dir) {
+const defaultPomSkip = child => SKIP_DIRS.has(path.basename(child));
+
+function findPomFiles(dir, skipDir = defaultPomSkip) {
 	const out = [];
 	const stack = [dir];
 	while (stack.length) {
@@ -29,8 +31,9 @@ function findPomFiles(dir) {
 		catch { continue; }
 		for (const e of entries) {
 			if (e.isDirectory()) {
-				if (SKIP_DIRS.has(e.name)) continue;
-				stack.push(path.join(cur, e.name));
+				const child = path.join(cur, e.name);
+				if (skipDir(child, e.name)) continue;
+				stack.push(child);
 			} else if (e.name === "pom.xml") {
 				out.push(path.join(cur, e.name));
 			}
@@ -39,6 +42,20 @@ function findPomFiles(dir) {
 	return out;
 }
 
+// Parallel equivalent of findPomFiles — same result, but readdir runs concurrently
+// so the walk isn't serialized one round-trip at a time on a high-latency filesystem.
+async function findPomFilesAsync(dir, skipDir = defaultPomSkip) {
+	const { walkDirs } = require("./parallel-walk");
+	const out = [];
+	await walkDirs(dir, {
+		skipDir,
+		onDir: (cur, entries) => {
+			for (const e of entries) if (e.isFile() && e.name === "pom.xml") out.push(path.join(cur, e.name));
+		},
+	});
+	return out;
+}
+
 function newMetadataStore() {
 	return {
 		byPath: {},
@@ -345,7 +362,9 @@ async function rewritePoms(pomPath, allPomMetadata, allPropsByPom, opts) {
 
 module.exports = {
 	coord,
+	SKIP_DIRS,
 	findPomFiles,
+	findPomFilesAsync,
 	newMetadataStore,
 	parsePom,
 	resolveParentPath,

package/lib/cve-match.js

@@ -125,14 +125,14 @@ async function expandWithTransitives(resolvedDeps, opts = {}) {
 		// Embedded-binary coords don't participate in Maven Central resolution (a
 		// fat-jar already ships its deps, discovered by recursion) and must not act as
 		// a depMgmt override for the declared tree.
-		if (dep.provenance === "embedded") continue;
+		if (dep.provenance === "embedded" || dep.provenance === "binary") continue;
 		if (dep.version && !/\$\{/.test(dep.version)) {
 			rootDepMgmt.set(`${dep.groupId}:${dep.artifactId}`, { version: dep.version });
 		}
 	}
 
 	const directs = [...resolvedDeps.values()]
-		.filter(d => d.provenance !== "embedded")
+		.filter(d => d.provenance !== "embedded" && d.provenance !== "binary")
 		.filter(d => d.version && !/\$\{/.test(d.version))
 		.filter(d => d.scope !== "test" || opts.includeTestDeps)
 		.filter(d => d.scope !== "parent");
@@ -227,6 +227,7 @@ function matchDepsAgainstCves(resolvedDeps, cveIndex, opts = {}) {
 		// They are caught by the OSV pipeline (which is multi-ecosystem) and
 		// the CPE refinement step (post-NVD).
 		if (dep.ecosystem === "npm") continue;
+		if (dep.provenance === "binary") continue; // no resolved coordinate yet (Plan 2 identifies it)
 		const key = `${dep.groupId}:${dep.artifactId}`.toLowerCase();
 		// Tier 1: exact packageName match
 		const t1 = matchOne(dep, byPackage[key], "exact");