fad-checker 2.1.2 → 2.2.1

package/lib/codecs/binary.codec.js

@@ -0,0 +1,54 @@
+/**
+ * lib/codecs/binary.codec.js — codec for committed NATIVE binaries
+ * (.dll/.exe/.so/.dylib) that no package manager governs.
+ *
+ * Plan 1 scope: discover + hash only. The records carry no resolved coordinate
+ * (just a filename); Plan 2's hash-id service fills `identity`, Plan 3 builds the
+ * unmanaged inventory + report. Until then the records are `provenance:"binary"`
+ * and the CVE/OSV/EOL/outdated stages skip them (no coordinate to query).
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
+ */
+const { makeDepRecord } = require("../dep-record");
+const { scanBinaries } = require("./binary/scan");
+
+module.exports = {
+	id: "binary",
+	label: "Binaries",
+	osvEcosystem: null,                                   // no OSV ecosystem until identified
+	manifestNames: ["*.dll", "*.exe", "*.so", "*.dylib"], // lets detectCodecs include us in auto mode
+
+	detect(dir) {
+		try { return scanBinaries(dir, { onProgress: null }).length > 0; }
+		catch { return false; }
+	},
+
+	async collect(dir, opts = {}) {
+		const out = new Map();
+		const warnings = [];
+		let records;
+		try { records = scanBinaries(dir, { onProgress: opts.onBinaryProgress, srcRoot: opts.srcRoot || dir, excludePath: opts.excludePath, defaultExcludes: opts.defaultExcludes }); }
+		catch (e) { return { deps: out, warnings: [{ type: "scan-error", message: `binary scan failed: ${e.message}` }] }; }
+		for (const r of records) {
+			out.set(`binary:${r.path}`, makeDepRecord({
+				ecosystem: "binary",
+				name: r.declaredName,
+				version: null,
+				manifestPath: r.path,
+				provenance: "binary",
+				hashes: { sha1: r.sha1, sha256: r.sha256 },
+				declaredName: r.declaredName,
+			}));
+		}
+		return { deps: out, warnings };
+	},
+
+	coordKey(d) { return `binary:${d.manifestPaths?.[0] || d.name}`; },
+	formatCoord(d) { return d.declaredName || d.name; },
+	osvPackageName() { return null; },
+	async checkRegistry() { return { deprecated: [], outdated: [], licensed: [] }; },
+	resolveEolProduct() { return null; },
+	recipe: require("./recipes").binary,
+	nativeScanners: [],
+};

package/lib/codecs/composer.codec.js

@@ -15,7 +15,7 @@ const { parseComposerLock, parseComposerJson, isConcrete } = require("./composer
 
 const SKIP = new Set(["vendor", ".git", ".idea", ".vscode", "node_modules", "dist", "build", "out", "target"]);
 
-function findComposerManifests(dir) {
+function findComposerManifests(dir, skipDir = (child, name) => SKIP.has(name)) {
 	const groups = [];
 	const stack = [dir];
 	while (stack.length) {
@@ -29,11 +29,15 @@ function findComposerManifests(dir) {
 				composerLock: names.has("composer.lock") ? path.join(cur, "composer.lock") : null,
 			});
 		}
-		for (const e of entries) if (e.isDirectory() && !SKIP.has(e.name)) stack.push(path.join(cur, e.name));
+		for (const e of entries) if (e.isDirectory() && !skipDir(path.join(cur, e.name), e.name)) stack.push(path.join(cur, e.name));
 	}
 	return groups;
 }
 
+function dirFilter(dir, opts) {
+	return require("../path-filter").makeDirFilter({ srcRoot: opts.srcRoot || dir, defaultSkip: SKIP, excludePath: opts.excludePath, useDefaults: opts.defaultExcludes !== false });
+}
+
 module.exports = {
 	id: "composer",
 	label: "Composer",
@@ -46,7 +50,7 @@ module.exports = {
 		const { ignoreTest, deps2Exclude } = opts;
 		const out = new Map();
 		const warnings = [];
-		for (const g of findComposerManifests(dir)) {
+		for (const g of findComposerManifests(dir, dirFilter(dir, opts))) {
 			if (g.composerLock) {
 				let parsed;
 				try { parsed = parseComposerLock(g.composerLock); }

package/lib/codecs/go/registry.js

@@ -13,11 +13,11 @@ const fs = require("fs");
 const path = require("path");
 const os = require("os");
 let pLimit; try { pLimit = require("p-limit"); } catch { pLimit = () => (fn) => fn(); }
+const { withPublic, authHeaderFor, normalise } = require("../../registries");
 
 const CACHE_DIR = path.join(os.homedir(), ".fad-checker");
 const CACHE_PATH = path.join(CACHE_DIR, "go-proxy-cache.json");
 const CACHE_MAX_AGE_MS = 24 * 3600 * 1000;
-const PROXY = "https://proxy.golang.org";
 
 function loadCache() { try { return JSON.parse(fs.readFileSync(CACHE_PATH, "utf8")); } catch { return { entries: {}, meta: {} }; } }
 function saveCache(d) { try { fs.mkdirSync(CACHE_DIR, { recursive: true }); fs.writeFileSync(CACHE_PATH, JSON.stringify(d)); } catch { /* ignore */ } }
@@ -34,18 +34,26 @@ function cmp(a, b) {
 	return 0;
 }
 
-async function fetchLatest(mod, { offline }) {
+// Custom GOPROXY first (same protocol: <base>/<escaped-module>/@latest), then proxy.golang.org.
+async function fetchLatest(mod, { offline, registries = [], fetcher = globalThis.fetch } = {}) {
 	if (offline) return null;
-	try {
-		const res = await fetch(`${PROXY}/${escapeModule(mod)}/@latest`, { headers: { "User-Agent": "fad-checker-go" } });
-		if (!res.ok) return { error: `HTTP ${res.status}` };
-		const j = await res.json();
-		return { latest: (j.Version || "").replace(/^v/, "") || null };
-	} catch (e) { return { error: e.message }; }
+	const bases = withPublic("go", registries);
+	let lastErr = null;
+	for (const base of bases) {
+		const url = normalise(base.url) + `${escapeModule(mod)}/@latest`;
+		const headers = { "User-Agent": "fad-checker-go", Accept: "application/json" };
+		const ah = authHeaderFor(base); if (ah) headers.Authorization = ah;
+		try {
+			const res = await fetcher(url, { headers });
+			if (res.ok) { const j = await res.json(); return { latest: (j.Version || "").replace(/^v/, "") || null }; }
+			lastErr = `HTTP ${res.status}`;
+		} catch (e) { lastErr = e.message; }
+	}
+	return { error: lastErr || "no data" };
 }
 
 async function checkGoRegistryDeps(deps, opts = {}) {
-	const { verbose, offline, allLibs = true, concurrency = 8 } = opts;
+	const { verbose, offline, allLibs = true, concurrency = 8, registries = [] } = opts;
 	const targets = [...deps.values()].filter(d => d.ecosystem === "go" && d.version);
 	const result = { deprecated: [], outdated: [], licensed: [] };
 	if (!targets.length || !allLibs) return result;
@@ -57,7 +65,7 @@ async function checkGoRegistryDeps(deps, opts = {}) {
 		const key = `${t.name}@${t.version}`;
 		let ex = cache.entries[key];
 		if (!ex) {
-			const r = await fetchLatest(t.name, { offline });
+			const r = await fetchLatest(t.name, { offline, registries });
 			ex = (r && !r.error) ? { latest: r.latest } : { latest: null };
 			if (r && !r.error) cache.entries[key] = ex;
 		}
@@ -71,4 +79,4 @@ async function checkGoRegistryDeps(deps, opts = {}) {
 	return result;
 }
 
-module.exports = { checkGoRegistryDeps, escapeModule };
+module.exports = { checkGoRegistryDeps, escapeModule, fetchLatest };

package/lib/codecs/go.codec.js

@@ -15,7 +15,7 @@ const G = require("./go/parse");
 
 const SKIP = new Set([".git", ".idea", ".vscode", "node_modules", "dist", "build", "out", "target", "vendor", "testdata"]);
 
-function findGoDirs(dir) {
+function findGoDirs(dir, skipDir = (child, name) => SKIP.has(name)) {
 	const groups = [];
 	const stack = [dir];
 	while (stack.length) {
@@ -23,11 +23,15 @@ function findGoDirs(dir) {
 		let entries; try { entries = fs.readdirSync(cur, { withFileTypes: true }); } catch { continue; }
 		const names = new Set(entries.filter(e => e.isFile()).map(e => e.name));
 		if (names.has("go.mod") || names.has("go.sum")) groups.push({ dir: cur, names });
-		for (const e of entries) if (e.isDirectory() && !SKIP.has(e.name)) stack.push(path.join(cur, e.name));
+		for (const e of entries) if (e.isDirectory() && !skipDir(path.join(cur, e.name), e.name)) stack.push(path.join(cur, e.name));
 	}
 	return groups;
 }
 
+function dirFilter(dir, opts) {
+	return require("../path-filter").makeDirFilter({ srcRoot: opts.srcRoot || dir, defaultSkip: SKIP, excludePath: opts.excludePath, useDefaults: opts.defaultExcludes !== false });
+}
+
 module.exports = {
 	id: "go",
 	label: "Go",
@@ -44,7 +48,7 @@ module.exports = {
 			if (deps2Exclude && deps2Exclude.test(d.name)) return;
 			out.set(coordKeyFor("go", "", d.name), makeDepRecord({ ecosystem: "go", namespace: "", name: d.name, version: d.version, manifestPath, scope: d.scope, isDev: false }));
 		};
-		for (const g of findGoDirs(dir)) {
+		for (const g of findGoDirs(dir, dirFilter(dir, opts))) {
 			if (g.names.has("go.mod")) {
 				const fp = path.join(g.dir, "go.mod");
 				try {

package/lib/codecs/index.js

@@ -19,12 +19,14 @@ const pypi = require("./pypi.codec");
 const nuget = require("./nuget.codec");
 const go = require("./go.codec");
 const ruby = require("./ruby.codec");
+const binary = require("./binary.codec");
 
 // Ordre stable pour le report (maven, npm, yarn, puis les nouveaux écosystèmes).
-const ORDER = ["maven", "npm", "yarn", "nuget", "composer", "pypi", "go", "ruby"];
+// "binary" (committed native libs, no manifest) reste en dernier.
+const ORDER = ["maven", "npm", "yarn", "nuget", "composer", "pypi", "go", "ruby", "binary"];
 
 const REGISTRY = new Map();
-for (const c of [maven, npm, yarn, composer, pypi, nuget, go, ruby]) {
+for (const c of [maven, npm, yarn, composer, pypi, nuget, go, ruby, binary]) {
 	assertCodecShape(c);
 	REGISTRY.set(c.id, c);
 }
@@ -57,7 +59,9 @@ const DETECT_CONCURRENCY = 48;
 // globs). Short-circuits as soon as every codec has matched. readdir runs with bounded
 // concurrency — on a high-latency filesystem (WSL/9p, network mounts) the walk is
 // latency-bound, so issuing many readdirs at once is far faster than a serial walk.
-async function detectCodecs(dir) {
+async function detectCodecs(dir, opts = {}) {
+	const { makeDirFilter } = require("../path-filter");
+	const skipDir = makeDirFilter({ srcRoot: dir, defaultSkip: DETECT_SKIP, excludePath: opts.excludePath, useDefaults: opts.defaultExcludes !== false });
 	const codecs = allCodecs().filter(c => c.id !== "yarn");
 	const matchers = codecs.map(c => {
 		const exact = new Set();
@@ -85,7 +89,8 @@ async function detectCodecs(dir) {
 				fs.promises.readdir(cur, { withFileTypes: true }).then(entries => {
 					for (const e of entries) {
 						if (e.isDirectory()) {
-							if (!DETECT_SKIP.has(e.name)) queue.push(path.join(cur, e.name));
+							const child = path.join(cur, e.name);
+							if (!skipDir(child, e.name)) queue.push(child);
 							continue;
 						}
 						if (!e.isFile()) continue;

package/lib/codecs/maven/jar-scan.js

@@ -289,11 +289,12 @@ function findArchives(dir, acc = []) {
 
 // Parallel equivalent of findArchives — concurrent readdir so a deep tree on a
 // high-latency filesystem isn't walked one round-trip at a time.
-async function findArchivesAsync(dir) {
+async function findArchivesAsync(dir, skipDir) {
 	const { walkDirs } = require("../../parallel-walk");
+	const skip = skipDir || ((child, name) => SKIP_DIRS.has(name) || name.startsWith("."));
 	const acc = [];
 	await walkDirs(dir, {
-		skipDir: name => SKIP_DIRS.has(name) || name.startsWith("."),
+		skipDir: skip,
 		onDir: (cur, entries) => {
 			for (const e of entries) if (e.isFile() && ARCHIVE_RE.test(e.name)) acc.push(path.join(cur, e.name));
 		},
@@ -315,7 +316,11 @@ async function findArchivesAsync(dir) {
  * @returns { deps: depRecord[], warnings: [{type,message}] }
  */
 async function scanEmbeddedJars(rootDir, opts = {}) {
-	const archives = await findArchivesAsync(rootDir);
+	const { makeDirFilter } = require("../../path-filter");
+	const useDefaults = opts.defaultExcludes !== false;
+	const base = makeDirFilter({ srcRoot: opts.srcRoot || rootDir, defaultSkip: SKIP_DIRS, excludePath: opts.excludePath, useDefaults });
+	const skipDir = (child, name) => base(child, name) || (useDefaults && name.startsWith("."));
+	const archives = await findArchivesAsync(rootDir, skipDir);
 	const ctx = {
 		out: [],
 		warnings: [],

package/lib/codecs/maven.codec.js

@@ -40,7 +40,9 @@ module.exports = {
 	// Expose _maven (store/propsByPom/pomFiles) pour que l'orchestrateur garde la
 	// phase de réécriture des POM nettoyés (lib/core.rewritePoms).
 	async collect(dir, opts = {}) {
-		const pomFiles = await core.findPomFilesAsync(dir);
+		const { makeDirFilter } = require("../path-filter");
+		const skipDir = makeDirFilter({ srcRoot: opts.srcRoot || dir, defaultSkip: core.SKIP_DIRS, excludePath: opts.excludePath, useDefaults: opts.defaultExcludes !== false });
+		const pomFiles = await core.findPomFilesAsync(dir, skipDir);
 		const store = core.newMetadataStore();
 		const propsByPom = {};
 		for (const pom of pomFiles) {
@@ -58,7 +60,7 @@ module.exports = {
 		if (opts.scanJars !== false) {
 			try {
 				const { scanEmbeddedJars } = require("./maven/jar-scan");
-				const { deps: embedded, warnings: jarWarnings } = await scanEmbeddedJars(dir, { srcRoot: opts.srcRoot || dir, onProgress: opts.onJarProgress });
+				const { deps: embedded, warnings: jarWarnings } = await scanEmbeddedJars(dir, { srcRoot: opts.srcRoot || dir, excludePath: opts.excludePath, defaultExcludes: opts.defaultExcludes, onProgress: opts.onJarProgress });
 				for (const rec of embedded) deps.set(rec.coordKey, rec);
 				warnings.push(...jarWarnings);
 			} catch (e) { warnings.push({ type: "embedded-jar", message: `embedded-jar scan failed: ${e.message}` }); }

package/lib/codecs/npm/parse.js

@@ -362,6 +362,7 @@ const DEFAULT_JS_SKIP_DIRS = new Set([
 
 function findJsManifests(rootDir, opts = {}) {
 	const { skipDirs = DEFAULT_JS_SKIP_DIRS } = opts;
+	const skipDir = opts.skipDir || ((child, name) => skipDirs.has(name));
 	const found = [];
 	const stack = [rootDir];
 	while (stack.length) {
@@ -374,7 +375,7 @@ function findJsManifests(rootDir, opts = {}) {
 		for (const e of entries) {
 			const p = path.join(cur, e.name);
 			if (e.isDirectory()) {
-				if (skipDirs.has(e.name)) continue;
+				if (skipDir(p, e.name)) continue;
 				stack.push(p);
 			} else if (e.isFile()) {
 				if (e.name === "package.json") here.packageJson = p;
@@ -392,10 +393,11 @@ function findJsManifests(rootDir, opts = {}) {
 // serialized one round-trip at a time on a high-latency filesystem.
 async function findJsManifestsAsync(rootDir, opts = {}) {
 	const { skipDirs = DEFAULT_JS_SKIP_DIRS } = opts;
+	const skipDir = opts.skipDir || ((child, name) => skipDirs.has(name));
 	const { walkDirs } = require("../../parallel-walk");
 	const found = [];
 	await walkDirs(rootDir, {
-		skipDir: name => skipDirs.has(name),
+		skipDir,
 		onDir: (cur, entries) => {
 			const here = { dir: cur, packageJson: null, packageLock: null, yarnLock: null, pnpmLock: null };
 			for (const e of entries) {
@@ -420,4 +422,5 @@ module.exports = {
 	parsePnpmLock,
 	findJsManifests,
 	findJsManifestsAsync,
+	DEFAULT_JS_SKIP_DIRS,
 };

package/lib/codecs/npm/registry.js

@@ -21,11 +21,11 @@ const path = require("path");
 const os = require("os");
 const pLimit = require("p-limit");
 const { semverCompare, webjarToNpm } = require("./collect");
+const { withPublic, authHeaderFor, normalise } = require("../../registries");
 
 const CACHE_DIR = path.join(os.homedir(), ".fad-checker");
 const CACHE_PATH = path.join(CACHE_DIR, "npm-registry-cache.json");
 const CACHE_MAX_AGE_MS = 24 * 3600 * 1000; // 1 day, aligned with Maven Central
-const REGISTRY = "https://registry.npmjs.org";
 
 function loadCache() {
 	try { return JSON.parse(fs.readFileSync(CACHE_PATH, "utf8")); }
@@ -89,29 +89,40 @@ function packumentToFindings(packument, dep) {
 	return out;
 }
 
-/** registry.npmjs.org path-encodes a scoped name's slash. */
-function packumentUrl(name) {
-	return name.startsWith("@")
-		? `${REGISTRY}/${name.replace("/", "%2F")}`
-		: `${REGISTRY}/${encodeURIComponent(name)}`;
+/** registry path-encodes a scoped name's slash. */
+function encodeName(name) {
+	return name.startsWith("@") ? name.replace("/", "%2F") : encodeURIComponent(name);
 }
 
+/**
+ * Fetch a packument, trying each custom registry first (with per-registry auth),
+ * then the public registry.npmjs.org as the final fallback. Returns the parsed
+ * packument, or { error } if every base failed.
+ */
 async function fetchPackument(name, opts = {}) {
 	if (opts.offline) return null;
 	const timeoutMs = opts.timeoutMs || 15000;
-	try {
+	const fetcher = opts.fetcher || globalThis.fetch;
+	const bases = withPublic("npm", opts.registries || []);
+	const enc = encodeName(name);
+	let lastErr = null;
+	for (const base of bases) {
 		// Per-request timeout: a single stalled connection must never hang the
 		// whole run (one slow package would otherwise occupy a concurrency slot
 		// forever and starve the pool).
-		const res = await fetch(packumentUrl(name), {
-			headers: { "User-Agent": "fad-checker-npm-registry", Accept: "application/json" },
-			signal: AbortSignal.timeout(timeoutMs),
-		});
-		if (!res.ok) return { error: `HTTP ${res.status}` };
-		return await res.json();
-	} catch (err) {
-		return { error: err.name === "TimeoutError" ? `timeout after ${timeoutMs}ms` : err.message };
+		const url = normalise(base.url) + enc;
+		const headers = { "User-Agent": "fad-checker-npm-registry", Accept: "application/json" };
+		const ah = authHeaderFor(base);
+		if (ah) headers.Authorization = ah;
+		try {
+			const res = await fetcher(url, { headers, signal: AbortSignal.timeout(timeoutMs) });
+			if (res.ok) return await res.json();
+			lastErr = `HTTP ${res.status}`;
+		} catch (err) {
+			lastErr = err.name === "TimeoutError" ? `timeout after ${timeoutMs}ms` : err.message;
+		}
 	}
+	return { error: lastErr || "no data" };
 }
 
 /**
@@ -124,7 +135,7 @@ async function fetchPackument(name, opts = {}) {
  * opts: { verbose, offline, allLibs, concurrency = 8 }
  */
 async function checkNpmRegistryDeps(resolvedDeps, opts = {}) {
-	const { verbose, offline, allLibs = true, concurrency = 8, onProgress } = opts;
+	const { verbose, offline, allLibs = true, concurrency = 8, onProgress, registries = [] } = opts;
 	// Targets = npm deps (queried by their own name) + WebJars (queried by their
 	// derived npm-equivalent name; version matches upstream). The original dep
 	// is kept for display/results so the report shows e.g. org.webjars:angularjs.
@@ -168,7 +179,7 @@ async function checkNpmRegistryDeps(resolvedDeps, opts = {}) {
 		const key = cacheKey(t);
 		let extracted = cache.entries[key];
 		if (!extracted) {
-			const packument = await fetchPackument(npmName, { offline });
+			const packument = await fetchPackument(npmName, { offline, registries });
 			if (packument && !packument.error) {
 				const f = packumentToFindings(packument, { version });
 				extracted = {
@@ -212,4 +223,4 @@ async function checkNpmRegistryDeps(resolvedDeps, opts = {}) {
 	return result;
 }
 
-module.exports = { packumentToFindings, checkNpmRegistryDeps, replacementFromMessage };
+module.exports = { packumentToFindings, checkNpmRegistryDeps, replacementFromMessage, fetchPackument };

package/lib/codecs/npm.codec.js

@@ -20,9 +20,9 @@ const retireScanner = {
 	id: "retire",
 	kind: "vendored",   // résultats → chapitre vendored-JS (séparé des CVE)
 	async scan(_deps, opts = {}) {
-		const { scanWithRetire } = require("../retire");
-		const matches = await scanWithRetire(opts.src, { verbose: opts.verbose, force: !!opts.retireRefresh, offline: !!opts.offline });
-		return { matches, meta: {} };
+		const { scanWithRetireFull } = require("../retire");
+		const { matches, inventory, error } = await scanWithRetireFull(opts.src, { verbose: opts.verbose, force: !!opts.retireRefresh, offline: !!opts.offline });
+		return { matches, meta: { inventory, error } };
 	},
 };
 
@@ -51,8 +51,10 @@ module.exports = {
 	async collect(dir, opts = {}) {
 		// Parallel manifest discovery (concurrent readdir) — much faster than the
 		// serial walk on a high-latency filesystem; parsing then runs synchronously.
-		const { findJsManifestsAsync } = require("./npm/parse");
-		const manifestGroups = await findJsManifestsAsync(dir);
+		const { findJsManifestsAsync, DEFAULT_JS_SKIP_DIRS } = require("./npm/parse");
+		const { makeDirFilter } = require("../path-filter");
+		const skipDir = makeDirFilter({ srcRoot: opts.srcRoot || dir, defaultSkip: DEFAULT_JS_SKIP_DIRS, excludePath: opts.excludePath, useDefaults: opts.defaultExcludes !== false });
+		const manifestGroups = await findJsManifestsAsync(dir, { skipDir });
 		const deps = collectNpmDeps(dir, { ...opts, manifestGroups });
 		return { deps, warnings: deps.warnings || [] };
 	},

package/lib/codecs/nuget.codec.js

@@ -19,7 +19,7 @@ const SKIP = new Set([".git", ".idea", ".vscode", "node_modules", "dist", "build
 // MSBuild project files share the same <PackageReference> schema — C#, F#, VB.
 const PROJ_RE = /\.(csproj|fsproj|vbproj)$/i;
 
-function findNugetDirs(dir) {
+function findNugetDirs(dir, skipDir = (child, name) => SKIP.has(name)) {
 	const groups = [];
 	const stack = [dir];
 	while (stack.length) {
@@ -30,11 +30,15 @@ function findNugetDirs(dir) {
 		if (files.includes("packages.lock.json") || files.includes("packages.config") || csprojs.length) {
 			groups.push({ dir: cur, files, csprojs });
 		}
-		for (const e of entries) if (e.isDirectory() && !SKIP.has(e.name)) stack.push(path.join(cur, e.name));
+		for (const e of entries) if (e.isDirectory() && !skipDir(path.join(cur, e.name), e.name)) stack.push(path.join(cur, e.name));
 	}
 	return groups;
 }
 
+function dirFilter(dir, opts) {
+	return require("../path-filter").makeDirFilter({ srcRoot: opts.srcRoot || dir, defaultSkip: SKIP, excludePath: opts.excludePath, useDefaults: opts.defaultExcludes !== false });
+}
+
 module.exports = {
 	id: "nuget",
 	label: "NuGet",
@@ -51,7 +55,7 @@ module.exports = {
 			if (deps2Exclude && deps2Exclude.test(d.name)) return;
 			out.set(coordKeyFor("nuget", "", d.name), makeDepRecord({ ecosystem: "nuget", namespace: "", name: d.name, version: d.version, manifestPath, scope: d.scope, isDev: d.isDev }));
 		};
-		for (const g of findNugetDirs(dir)) {
+		for (const g of findNugetDirs(dir, dirFilter(dir, opts))) {
 			if (g.files.includes("packages.lock.json")) {
 				const fp = path.join(g.dir, "packages.lock.json");
 				try { const { deps } = await N.parsePackagesLockJson(fp); for (const d of deps) add(d, fp); }

package/lib/codecs/pypi/registry.js

@@ -14,11 +14,11 @@ const fs = require("fs");
 const path = require("path");
 const os = require("os");
 let pLimit; try { pLimit = require("p-limit"); } catch { pLimit = () => (fn) => fn(); }
+const { withPublic, authHeaderFor, normalise } = require("../../registries");
 
 const CACHE_DIR = path.join(os.homedir(), ".fad-checker");
 const CACHE_PATH = path.join(CACHE_DIR, "pypi-cache.json");
 const CACHE_MAX_AGE_MS = 24 * 3600 * 1000;
-const API = "https://pypi.org/pypi";
 
 function loadCache() { try { return JSON.parse(fs.readFileSync(CACHE_PATH, "utf8")); } catch { return { entries: {}, meta: {} }; } }
 function saveCache(d) { try { fs.mkdirSync(CACHE_DIR, { recursive: true }); fs.writeFileSync(CACHE_PATH, JSON.stringify(d)); } catch { /* ignore */ } }
@@ -56,18 +56,24 @@ function pypiToFindings(data, { version }) {
 	return out;
 }
 
-async function fetchProject(name, { offline }) {
+// Custom registries first (same JSON API: <base>/<name>/json), then pypi.org.
+async function fetchProject(name, { offline, registries = [], fetcher = globalThis.fetch } = {}) {
 	if (offline) return null;
-	try {
-		const res = await fetch(`${API}/${name}/json`, { headers: { "User-Agent": "fad-checker-pypi" } });
-		if (!res.ok) return { error: `HTTP ${res.status}` };
-		return await res.json();
-	} catch (e) { return { error: e.message }; }
+	const bases = withPublic("pypi", registries);
+	let lastErr = null;
+	for (const base of bases) {
+		const url = normalise(base.url) + `${name}/json`;
+		const headers = { "User-Agent": "fad-checker-pypi", Accept: "application/json" };
+		const ah = authHeaderFor(base); if (ah) headers.Authorization = ah;
+		try { const res = await fetcher(url, { headers }); if (res.ok) return await res.json(); lastErr = `HTTP ${res.status}`; }
+		catch (e) { lastErr = e.message; }
+	}
+	return { error: lastErr || "no data" };
 }
 
 // Mirror of checkNpmRegistryDeps: returns { deprecated:[], outdated:[] }.
 async function checkPypiRegistryDeps(deps, opts = {}) {
-	const { verbose, offline, allLibs = true, concurrency = 8 } = opts;
+	const { verbose, offline, allLibs = true, concurrency = 8, registries = [] } = opts;
 	const targets = [...deps.values()].filter(d => d.ecosystem === "pypi" && d.version);
 	const result = { deprecated: [], outdated: [], licensed: [] };
 	if (!targets.length) return result;
@@ -79,7 +85,7 @@ async function checkPypiRegistryDeps(deps, opts = {}) {
 		const key = `${t.name}@${t.version}`;
 		let ex = cache.entries[key];
 		if (!ex) {
-			const data = await fetchProject(t.name, { offline });
+			const data = await fetchProject(t.name, { offline, registries });
 			if (data && !data.error) {
 				const f = pypiToFindings(data, { version: t.version });
 				ex = { yanked: f.yanked, inactive: f.inactive, latest: f.outdated?.latest || null, license: f.license || null };
@@ -105,4 +111,4 @@ async function checkPypiRegistryDeps(deps, opts = {}) {
 	return result;
 }
 
-module.exports = { pypiToFindings, pypiLicense, checkPypiRegistryDeps };
+module.exports = { pypiToFindings, pypiLicense, checkPypiRegistryDeps, fetchProject };

package/lib/codecs/pypi.codec.js

@@ -24,7 +24,7 @@ const LOCKS = [
 
 const FALLBACK_MANIFESTS = ["pyproject.toml", "requirements.txt"];
 
-function findPyDirs(dir) {
+function findPyDirs(dir, skipDir = (child, name) => SKIP.has(name)) {
 	const groups = [];
 	const stack = [dir];
 	while (stack.length) {
@@ -32,11 +32,15 @@ function findPyDirs(dir) {
 		let entries; try { entries = fs.readdirSync(cur, { withFileTypes: true }); } catch { continue; }
 		const names = new Set(entries.filter(e => e.isFile()).map(e => e.name));
 		if ([...LOCKS.map(l => l[0]), ...FALLBACK_MANIFESTS].some(n => names.has(n))) groups.push({ dir: cur, names });
-		for (const e of entries) if (e.isDirectory() && !SKIP.has(e.name)) stack.push(path.join(cur, e.name));
+		for (const e of entries) if (e.isDirectory() && !skipDir(path.join(cur, e.name), e.name)) stack.push(path.join(cur, e.name));
 	}
 	return groups;
 }
 
+function pyDirFilter(dir, opts) {
+	return require("../path-filter").makeDirFilter({ srcRoot: opts.srcRoot || dir, defaultSkip: SKIP, excludePath: opts.excludePath, useDefaults: opts.defaultExcludes !== false });
+}
+
 module.exports = {
 	id: "pypi",
 	label: "PyPI",
@@ -54,7 +58,7 @@ module.exports = {
 			if (deps2Exclude && deps2Exclude.test(d.name)) return;
 			out.set(coordKeyFor("pypi", "", d.name), makeDepRecord({ ecosystem: "pypi", namespace: "", name: d.name, version: d.version, manifestPath, scope: d.scope, isDev: d.isDev }));
 		};
-		for (const g of findPyDirs(dir)) {
+		for (const g of findPyDirs(dir, pyDirFilter(dir, opts))) {
 			const lock = LOCKS.find(([n]) => g.names.has(n));
 			if (lock) {
 				const fp = path.join(g.dir, lock[0]);

package/lib/codecs/recipes.js

@@ -132,4 +132,12 @@ const ruby = {
 	directSection: "B. Or pin them in the Gemfile and run bundle update",
 };
 
-module.exports = { maven, npm, yarn, composer, pypi, nuget, go, ruby, dependencyManagementSnippet, npmOverridesSnippet, yarnResolutionsSnippet, composerRequireSnippet, pipInstallSnippet, dotnetAddSnippet, goGetSnippet, bundleUpdateSnippet };
+const binary = {
+	label: "Binaries",
+	pinSection: "A. Replace or remove the vendored binary",
+	pinIntro: cnt => `Replace ${cnt} committed binar${cnt > 1 ? "ies" : "y"} with a managed dependency, or verify their provenance/checksum:`,
+	snippet: (items) => ((items || []).map(it => `# ${it.artifactId || "binary"}: replace with a managed dependency, or record its origin and verify its checksum`).join("\n")) || "# verify the provenance/checksum of each vendored binary, or replace it with a managed dependency",
+	directSection: "B. Prefer declaring these through a package manager (Maven/npm/NuGet/…)",
+};
+
+module.exports = { maven, npm, yarn, composer, pypi, nuget, go, ruby, binary, dependencyManagementSnippet, npmOverridesSnippet, yarnResolutionsSnippet, composerRequireSnippet, pipInstallSnippet, dotnetAddSnippet, goGetSnippet, bundleUpdateSnippet };

package/lib/codecs/ruby/registry.js

@@ -11,11 +11,11 @@ const fs = require("fs");
 const path = require("path");
 const os = require("os");
 let pLimit; try { pLimit = require("p-limit"); } catch { pLimit = () => (fn) => fn(); }
+const { withPublic, authHeaderFor, normalise } = require("../../registries");
 
 const CACHE_DIR = path.join(os.homedir(), ".fad-checker");
 const CACHE_PATH = path.join(CACHE_DIR, "rubygems-cache.json");
 const CACHE_MAX_AGE_MS = 24 * 3600 * 1000;
-const API = "https://rubygems.org/api/v1/gems";
 
 function loadCache() { try { return JSON.parse(fs.readFileSync(CACHE_PATH, "utf8")); } catch { return { entries: {}, meta: {} }; } }
 function saveCache(d) { try { fs.mkdirSync(CACHE_DIR, { recursive: true }); fs.writeFileSync(CACHE_PATH, JSON.stringify(d)); } catch { /* ignore */ } }
@@ -36,17 +36,23 @@ function gemToFindings(data) {
 	return out;
 }
 
-async function fetchGem(name, { offline }) {
+// Custom gem servers first (same JSON API: <base>/<gem>.json), then rubygems.org.
+async function fetchGem(name, { offline, registries = [], fetcher = globalThis.fetch } = {}) {
 	if (offline) return null;
-	try {
-		const res = await fetch(`${API}/${encodeURIComponent(name)}.json`, { headers: { "User-Agent": "fad-checker-rubygems" } });
-		if (!res.ok) return { error: `HTTP ${res.status}` };
-		return await res.json();
-	} catch (e) { return { error: e.message }; }
+	const bases = withPublic("ruby", registries);
+	let lastErr = null;
+	for (const base of bases) {
+		const url = normalise(base.url) + `${encodeURIComponent(name)}.json`;
+		const headers = { "User-Agent": "fad-checker-rubygems", Accept: "application/json" };
+		const ah = authHeaderFor(base); if (ah) headers.Authorization = ah;
+		try { const res = await fetcher(url, { headers }); if (res.ok) return await res.json(); lastErr = `HTTP ${res.status}`; }
+		catch (e) { lastErr = e.message; }
+	}
+	return { error: lastErr || "no data" };
 }
 
 async function checkRubyRegistryDeps(deps, opts = {}) {
-	const { verbose, offline, allLibs = true, concurrency = 8 } = opts;
+	const { verbose, offline, allLibs = true, concurrency = 8, registries = [] } = opts;
 	const targets = [...deps.values()].filter(d => d.ecosystem === "ruby" && d.version);
 	const result = { deprecated: [], outdated: [], licensed: [] };
 	if (!targets.length) return result;
@@ -58,7 +64,7 @@ async function checkRubyRegistryDeps(deps, opts = {}) {
 		const key = `${t.name}@${t.version}`;
 		let ex = cache.entries[key];
 		if (!ex) {
-			const data = await fetchGem(t.name, { offline });
+			const data = await fetchGem(t.name, { offline, registries });
 			ex = (data && !data.error) ? gemToFindings(data) : { latest: null, license: null };
 			if (data && !data.error) cache.entries[key] = ex;
 		}
@@ -73,4 +79,4 @@ async function checkRubyRegistryDeps(deps, opts = {}) {
 	return result;
 }
 
-module.exports = { gemToFindings, checkRubyRegistryDeps };
+module.exports = { gemToFindings, checkRubyRegistryDeps, fetchGem };