fad-checker 2.2.0 → 2.2.2

package/lib/cve-report.js

@@ -13,6 +13,7 @@ const path = require("path");
 const { getCodec, allCodecs, ORDER } = require("./codecs");
 const { computePriority, sortByPriority } = require("./priority");
 const { buildInventory } = require("./unmanaged");
+const { buildEmbeddedInventory } = require("./embedded");
 
 // CWE-id → short human name. Loaded once at module init. Unknown CWEs fall
 // back to the raw id (with a "—" placeholder name where the row asks for one).
@@ -935,17 +936,42 @@ function renderRecommendationsForEco(slice, meta) {
 	return blocks.join("");
 }
 
+// Where a dependency comes from in the tree. A transitive dep (no defining
+// manifest) carries `via` — the chain of g:a from a root direct dep down to it —
+// recorded by the transitive resolver. Show that chain so an EOL/CVE finding on a
+// "dep of a dep" is traceable to the direct dependency that pulls it in. A direct
+// dep falls back to its defining manifest(s).
+function renderDepOrigin(dep, srcRoot) {
+	if (dep.via && dep.via.length) {
+		const chain = dep.via.map(c => `<code>${esc(c)}</code>`).join(" → ");
+		const tail = `<code>${esc(`${dep.groupId}:${dep.artifactId}`)}</code>`;
+		const alt = (dep.viaPaths && dep.viaPaths.length > 1) ? ` <span class="defined-more">+${dep.viaPaths.length - 1} more path${dep.viaPaths.length > 2 ? "s" : ""}</span>` : "";
+		return `<div class="defined-in"><span class="defined-label">pulled in via:</span> ${chain} → ${tail}${alt}</div>`;
+	}
+	return renderDefinedIn(dep, srcRoot);
+}
+
+// The source of an EOL verdict: the endoflife.date product queried, and which
+// mapping rule (data/eol-mapping.json) matched the dep to that product.
+function renderEolSource(e) {
+	const slug = e.productSlug || "";
+	const link = slug ? `endoflife.date/${esc(slug)}` : "endoflife.date";
+	const rule = e.via ? `<br><span style="color:#6b7280">matched via ${esc(e.via)} = <code>${esc(e.viaKey || "")}</code></span>` : "";
+	return `<span>${link}</span>${rule}`;
+}
+
 function renderEolTable(eolResults) {
 	if (!eolResults?.length) return `<div class="empty">No end-of-life frameworks detected.</div>`;
 	const rows = eolResults.map(e => `<tr>
 		<td class="dep">${esc(e.product)}</td>
-		<td class="dep">${esc(depDisplayName(e.dep))}<br><span style="color:#6b7280">${esc(e.dep.version || "?")}</span>${renderDefinedIn(e.dep, RENDER_CTX.srcRoot)}</td>
+		<td class="dep">${esc(depDisplayName(e.dep))}<br><span style="color:#6b7280">${esc(e.dep.version || "?")}</span>${renderDepOrigin(e.dep, RENDER_CTX.srcRoot)}</td>
 		<td>${esc(e.eol || "")}</td>
 		<td>${esc(e.latest || "")}</td>
+		<td class="dep">${renderEolSource(e)}</td>
 		<td class="desc">${esc(e.notes || "")}</td>
 	</tr>`).join("\n");
 	return `<table>
-		<thead><tr><th>Product</th><th>Dependency</th><th>EOL date</th><th>Latest</th><th>Notes</th></tr></thead>
+		<thead><tr><th>Product</th><th>Dependency</th><th>EOL date</th><th>Latest</th><th>Source</th><th>Notes</th></tr></thead>
 		<tbody>${rows}</tbody>
 	</table>`;
 }
@@ -1338,7 +1364,7 @@ const LICENSE_CAT_ORDER = ["network-copyleft", "strong-copyleft", "proprietary",
 
 function renderLicenseChapter(licenseResults) {
 	if (!licenseResults || !licenseResults.assessed?.length) {
-		return `<div class="empty">No license data resolved (offline, or registries returned none).</div>`;
+		return `<div class="empty">No license data — the license scan is off by default (enable with <code>--licenses</code>); also empty when offline or registries return none.</div>`;
 	}
 	const { byCategory } = licenseResults;
 	const blocks = LICENSE_CAT_ORDER.filter(cat => byCategory[cat]?.length).map(cat => {
@@ -1397,7 +1423,8 @@ function buildBody({ cveMatches, devCveMatches, embeddedMatches, retireMatches,
 	const licenseContent   = renderLicenseChapter(licenseResults);
 	const licenseTotal     = licenseResults?.assessed?.length || 0;
 	const licenseFlagged   = licenseResults?.flagged?.length || 0;
-	const embeddedContent  = renderEmbeddedChapter(embMatchesActive, projectInfo?.src);
+	const embeddedInventory = buildEmbeddedInventory(resolvedDeps || new Map(), embMatchesActive);
+	const embeddedContent  = renderEmbeddedChapter(embeddedInventory, embMatchesActive, projectInfo?.src);
 	const unmanagedInventory = buildInventory(resolvedDeps || new Map());
 	const unmanagedContent = renderUnmanagedInventory(unmanagedInventory, projectInfo?.src);
 	const vendoredJsInv    = vendoredJsInventory || [];
@@ -1433,7 +1460,7 @@ function buildBody({ cveMatches, devCveMatches, embeddedMatches, retireMatches,
 		outdatedTotal: outdatedResults?.length || 0,
 		licenseTotal,
 		licenseFlagged,
-		embeddedTotal: embStats.total,
+		embeddedTotal: embeddedInventory.length,
 		unmanagedTotal: unmanagedInventory.length,
 		vendoredJsTotal: vendoredJsInv.length,
 		fpTotal: prodMatchesFP.length + devMatchesFP.length + embMatchesFP.length,
@@ -1455,7 +1482,7 @@ function buildBody({ cveMatches, devCveMatches, embeddedMatches, retireMatches,
 
 		${(warnings?.length || 0) ? majorSection(`0. Warnings & scan-completeness (${warnings.length})`, renderWarnings(warnings), { open: true, id: "ch0" }) : ""}
 		${majorSection(`1. CVE Vulnerabilities — production (${prodStats.total})`, cveContent, { id: "ch1" })}
-		${embStats.total ? majorSection(`1B. Embedded binaries — JAR/WAR/EAR (${embStats.total})`, embeddedContent, { open: embStats.total <= 50, id: "ch1e" }) : ""}
+		${embeddedInventory.length ? majorSection(`1B. Embedded binaries — JAR/WAR/EAR (${embeddedInventory.length})`, embeddedContent, { open: embeddedInventory.length <= 50, id: "ch1e" }) : ""}
 		${unmanagedInventory.length ? majorSection(`1C. Unmanaged / vendored binaries (${unmanagedInventory.length})`, unmanagedContent, { open: unmanagedInventory.length <= 50, id: "ch1c" }) : ""}
 		${vendoredJsInv.length ? majorSection(`1D. Unmanaged / vendored JavaScript (${vendoredJsInv.length})`, vendoredJsContent, { open: vendoredJsInv.length <= 50, id: "ch1d" }) : ""}
 		${majorSection(`2. Vendored JS scan — retire.js (${retireMatches.length})`, vendoredContent, { open: retireMatches.length > 0 && retireMatches.length <= 50, id: "ch2" })}
@@ -1520,22 +1547,39 @@ function renderToc({ hasWarnings, prodTotal, embeddedTotal, unmanagedTotal, vend
 	return `<nav class="toc">${entries.map(e => `<a href="#${e.id}">${esc(e.label)}</a>`).join("")}</nav>`;
 }
 
-// Embedded-binary CVE chapter: group findings by their top-level archive (the
-// part of the manifestPath before the first "!/"), so a fat-jar lists all the
-// vulnerable libraries shaded inside it.
-function renderEmbeddedChapter(matches, srcRoot) {
-	if (!matches.length) return `<div class="empty">No CVEs found in embedded binaries.</div>`;
-	const intro = `<div class="fp-intro">Maven coordinates discovered inside committed <code>.jar</code>/<code>.war</code>/<code>.ear</code> binaries (vendored libs, fat-jars) — not declared in any <code>pom.xml</code>. Patch by rebuilding/replacing the containing archive.</div>`;
+// Embedded-binary inventory chapter (1B): every embedded coordinate grouped by its
+// top-level archive (the part of the manifestPath before the first "!/"), with its
+// CVE status. Vulnerable coords additionally get the full CVE detail table.
+function renderEmbeddedChapter(inventory, embeddedMatches, srcRoot) {
+	if (!inventory.length) return `<div class="empty">No embedded JAR/WAR/EAR coordinates found.</div>`;
+	const vulnN = inventory.filter(e => e.vulnCount > 0).length;
+	const intro = `<div class="fp-intro">Maven coordinates discovered inside committed <code>.jar</code>/<code>.war</code>/<code>.ear</code> binaries (vendored libs, fat-jars, shaded uber-jars) — <strong>not declared in any <code>pom.xml</code></strong>. Unmanaged third-party code: unknown provenance and patch story even when not vulnerable. <strong>${vulnN}</strong> of ${inventory.length} carry known CVEs (patch by rebuilding/replacing the containing archive).</div>`;
+	// CVE matches keyed by archive, for the per-archive detail tables.
+	const matchesByArchive = new Map();
+	for (const m of (embeddedMatches || [])) {
+		const top = String((m.dep?.manifestPaths || [])[0] || "(unknown archive)").split("!/")[0];
+		if (!matchesByArchive.has(top)) matchesByArchive.set(top, []);
+		matchesByArchive.get(top).push(m);
+	}
 	const byArchive = new Map();
-	for (const m of matches) {
-		const mp = (m.dep?.manifestPaths || [])[0] || "(unknown archive)";
-		const top = String(mp).split("!/")[0];
-		if (!byArchive.has(top)) byArchive.set(top, []);
-		byArchive.get(top).push(m);
+	for (const e of inventory) {
+		if (!byArchive.has(e.archive)) byArchive.set(e.archive, []);
+		byArchive.get(e.archive).push(e);
 	}
-	const blocks = [...byArchive.entries()].sort((a, b) => a[0].localeCompare(b[0])).map(([archive, list]) =>
-		minorSection(`📦 <code class="path">${esc(archive)}</code> (${list.length})`, renderCveTable(list), { open: list.length <= 30 })
-	).join("\n");
+	const blocks = [...byArchive.entries()].sort((a, b) => a[0].localeCompare(b[0])).map(([archive, list]) => {
+		const rows = list.map(e => {
+			const coord = `${e.groupId}:${e.artifactId}:${e.version}`;
+			const status = e.vulnCount > 0
+				? pill(`${e.vulnCount} CVE${e.vulnCount > 1 ? "s" : ""}${e.maxSeverity ? " · " + e.maxSeverity : ""}`, "#b91c1c")
+				: pill("no known CVE", "#15803d");
+			return `<tr><td class="dep"><code>${esc(coord)}</code></td><td>${status}</td></tr>`;
+		}).join("\n");
+		const invTable = `<table><thead><tr><th>Coordinate (groupId:artifactId:version)</th><th>Status</th></tr></thead><tbody>${rows}</tbody></table>`;
+		const cveDetail = matchesByArchive.has(archive)
+			? `<div class="defined-in" style="margin-top:8px"><span class="defined-label">CVE detail:</span></div>` + renderCveTable(matchesByArchive.get(archive))
+			: "";
+		return minorSection(`📦 <code class="path">${esc(archive)}</code> (${list.length})`, invTable + cveDetail, { open: list.length <= 30 });
+	}).join("\n");
 	return intro + blocks;
 }
 
@@ -1984,6 +2028,7 @@ async function writeReports({ cveMatches, devCveMatches, embeddedMatches, retire
 
 module.exports = {
 	computeStats,
+	buildEmbeddedInventory,
 	generateHtmlReport,
 	generateWordReport,
 	writeReports,

package/lib/embedded.js

@@ -0,0 +1,57 @@
+/**
+ * lib/embedded.js — inventory of Maven coordinates discovered inside committed
+ * .jar/.war/.ear archives (provenance:"embedded"), whether or not they carry a CVE.
+ *
+ * This is a governance / cyber-hygiene signal: the JAR twin of the native-binary
+ * inventory (lib/unmanaged.js → chapter 1C) and the vendored-JS inventory
+ * (lib/retire.js → chapter 1D). Code that ships inside a committed binary which no
+ * pom.xml declares has unknown provenance and patch story even when not vulnerable.
+ *
+ * Pure: shared by the HTML report (chapter 1B) and the JSON export so both list the
+ * SAME set. CVE counts/severity are cross-referenced from the embedded CVE matches
+ * by coordKey.
+ */
+
+const EMB_SEV_RANK = { CRITICAL: 4, HIGH: 3, MEDIUM: 2, LOW: 1, NONE: 0, UNKNOWN: 0 };
+
+/**
+ * @param resolvedDeps Map of all resolved deps (embedded ones carry provenance:"embedded").
+ * @param embeddedMatches CVE matches whose dep is embedded (subset of the scan's matches).
+ * @returns sorted array of { archive, groupId, artifactId, version, coordKey, manifestPath, vulnCount, maxSeverity }
+ */
+function buildEmbeddedInventory(resolvedDeps, embeddedMatches) {
+	const cveByCoord = new Map(); // coordKey → { ids:Set, maxSeverity }
+	for (const m of (embeddedMatches || [])) {
+		const key = m.dep?.coordKey;
+		if (!key) continue;
+		let e = cveByCoord.get(key);
+		if (!e) { e = { ids: new Set(), maxSeverity: null }; cveByCoord.set(key, e); }
+		e.ids.add(m.cve?.id);
+		const sev = m.cve?.severity || "UNKNOWN";
+		if (!e.maxSeverity || (EMB_SEV_RANK[sev] || 0) > (EMB_SEV_RANK[e.maxSeverity] || 0)) e.maxSeverity = sev;
+	}
+	const out = [];
+	for (const dep of (resolvedDeps?.values?.() || [])) {
+		if (dep.provenance !== "embedded") continue;
+		const manifestPath = (dep.manifestPaths || [])[0] || "(unknown archive)";
+		const archive = String(manifestPath).split("!/")[0];
+		const cve = cveByCoord.get(dep.coordKey);
+		out.push({
+			archive,
+			groupId: dep.groupId || dep.namespace || "",
+			artifactId: dep.artifactId || dep.name || "",
+			version: dep.version || "",
+			coordKey: dep.coordKey,
+			manifestPath,
+			vulnCount: cve ? cve.ids.size : 0,
+			maxSeverity: cve ? cve.maxSeverity : null,
+		});
+	}
+	out.sort((a, b) =>
+		(EMB_SEV_RANK[b.maxSeverity] || 0) - (EMB_SEV_RANK[a.maxSeverity] || 0)
+		|| String(a.archive).localeCompare(String(b.archive))
+		|| `${a.groupId}:${a.artifactId}:${a.version}`.localeCompare(`${b.groupId}:${b.artifactId}:${b.version}`));
+	return out;
+}
+
+module.exports = { buildEmbeddedInventory, EMB_SEV_RANK };

package/lib/json-export.js

@@ -72,6 +72,10 @@ function buildFindings(payload = {}) {
 	const { buildInventory } = require("./unmanaged");
 	const unmanaged = resolvedDeps ? buildInventory(resolvedDeps) : [];
 
+	const { buildEmbeddedInventory } = require("./embedded");
+	const embeddedMatches = cveMatches.filter(m => m.dep?.provenance === "embedded");
+	const embedded = resolvedDeps ? buildEmbeddedInventory(resolvedDeps, embeddedMatches) : [];
+
 	const sevCounts = Object.fromEntries(SEV.map(s => [s, 0]));
 	let kev = 0;
 	for (const m of cveMatches) {
@@ -94,16 +98,18 @@ function buildFindings(payload = {}) {
 			licensesFlagged: licenseResults?.flagged?.length || 0,
 			vendored: retireMatches.length,
 			unmanaged: unmanaged.length,
+			embedded: embedded.length,
 			vendoredJs: vendoredJsInventory.length,
 			suppressed: cveMatches.filter(m => m.suppressed).length,
 		},
 		cve: cveMatches.map(cveFinding),
 		vendored: retireMatches.map(cveFinding),
-		eol: eolResults.map(e => ({ product: e.product, eol: e.eol, dep: depBrief(e.dep) })),
+		eol: eolResults.map(e => ({ product: e.product, productSlug: e.productSlug || null, via: e.via || null, viaKey: e.viaKey || null, eol: e.eol, dep: depBrief(e.dep) })),
 		obsolete: obsoleteResults.map(o => ({ reason: o.reason || null, replacement: o.replacement || null, source: o.source || null, dep: depBrief(o.dep) })),
 		outdated: outdatedResults.map(o => ({ latest: o.latest, releaseDate: o.releaseDate || null, dep: depBrief(o.dep) })),
 		licenses: (licenseResults?.assessed || []).map(e => ({ category: e.category, licenses: e.ids.concat(e.raw), source: e.source || null, dep: depBrief(e.dep) })),
 		unmanaged,
+		embedded,
 		vendoredJs: vendoredJsInventory,
 	};
 }

package/lib/manifest-copy.js

@@ -0,0 +1,75 @@
+/**
+ * lib/manifest-copy.js — when writing a cleaned tree (`-t`), copy every NON-Maven
+ * ecosystem manifest / lockfile from the source into the target at the same relative
+ * path, so `snyk test --all-projects` on the cleaned tree scans every ecosystem — not
+ * just the cleaned Maven POMs (which are written separately by core.rewritePoms).
+ *
+ * Maven is excluded (its cleaned POMs are the whole point of the rewrite); the binary
+ * codec is excluded (its files aren't dependency manifests). node_modules / vendor and
+ * friends are pruned so we copy the project's own lockfiles, not vendored ones.
+ */
+const fs = require("fs");
+const path = require("path");
+const { makeDirFilter } = require("./path-filter");
+const { allCodecs } = require("./codecs");
+
+// Ecosystems whose manifests/lockfiles Snyk reads off disk.
+const COPY_ECOSYSTEMS = new Set(["npm", "nuget", "composer", "pypi", "go", "ruby"]);
+// Companion files that aren't a codec's primary manifest but Snyk/the build need.
+const COMPANION_FILES = ["Directory.Packages.props", "Directory.Build.props", "nuget.config", "Gemfile", "Pipfile", "go.work", "go.work.sum"];
+// Directories never worth copying manifests from (installed/vendored trees).
+const SKIP_DIRS = new Set([
+	"node_modules", "bower_components", "jspm_packages", "vendor",
+	".git", ".svn", ".hg", ".idea", ".vscode", ".gradle", ".mvn",
+	"target", "dist", "build", "out", "bin", "obj", ".next", ".nuxt", "coverage",
+]);
+
+/** Pure: the exact filenames + extensions that count as a copyable manifest. */
+function manifestMatchers() {
+	const exact = new Set(COMPANION_FILES);
+	const exts = [];
+	for (const c of allCodecs()) {
+		if (!COPY_ECOSYSTEMS.has(c.id)) continue;
+		for (const n of c.manifestNames || []) {
+			if (n.startsWith("*.")) exts.push(n.slice(1)); // "*.csproj" → ".csproj"
+			else exact.add(n);
+		}
+	}
+	return { exact, exts };
+}
+
+/** Pure: is this basename a manifest we copy? */
+function isManifestName(name, matchers = manifestMatchers()) {
+	return matchers.exact.has(name) || matchers.exts.some(e => name.endsWith(e));
+}
+
+/**
+ * Copy every matching manifest from srcRoot into targetRoot at the same relative path.
+ * @returns { copied: number, files: string[] } (files are relative paths)
+ */
+async function copyEcosystemManifests(srcRoot, targetRoot, opts = {}) {
+	const matchers = manifestMatchers();
+	const skipDir = makeDirFilter({ srcRoot, defaultSkip: SKIP_DIRS, excludePath: opts.excludePath, useDefaults: opts.defaultExcludes !== false });
+	const files = [];
+	const walk = async (dir) => {
+		let entries;
+		try { entries = await fs.promises.readdir(dir, { withFileTypes: true }); } catch { return; }
+		for (const e of entries) {
+			const abs = path.join(dir, e.name);
+			if (e.isDirectory()) { if (!skipDir(abs, e.name)) await walk(abs); continue; }
+			if (!e.isFile()) continue;
+			if (!isManifestName(e.name, matchers)) continue;
+			const rel = path.relative(srcRoot, abs);
+			const dest = path.join(targetRoot, rel);
+			try {
+				await fs.promises.mkdir(path.dirname(dest), { recursive: true });
+				await fs.promises.copyFile(abs, dest);
+				files.push(rel);
+			} catch { /* best effort per file */ }
+		}
+	};
+	await walk(srcRoot);
+	return { copied: files.length, files };
+}
+
+module.exports = { manifestMatchers, isManifestName, copyEcosystemManifests, COPY_ECOSYSTEMS };

package/lib/maven-bom.js

@@ -0,0 +1,104 @@
+/**
+ * lib/maven-bom.js — resolve EXTERNAL import-scope BOMs (e.g. spring-boot-dependencies)
+ * from Maven Central and backfill the versions of declared deps that the BOM manages.
+ *
+ * core.js follows LOCAL `<scope>import</scope>` BOMs (their POM is in the source tree)
+ * but cannot enumerate an external BOM's managed-version table without fetching it. So
+ * in a typical Spring Boot project every `spring-boot-starter-*` (declared without a
+ * version, version pinned by the imported BOM) ends up unresolved — flooding chapter 0
+ * and dropping out of the CVE/EOL/outdated scans.
+ *
+ * This module fetches each external import BOM via transitive.js#effectivePom (which
+ * already merges the parent chain, resolves `${properties}` and recursively expands
+ * nested import BOMs), builds a g:a → version map, and fills it into the versionless
+ * declared deps. Network + cached (poms-cache, immutable) + offline-aware (the caller
+ * skips it offline). Pure except for the injected/real effectivePom fetch.
+ */
+const transitive = require("./transitive");
+
+/**
+ * Extract the distinct external import-BOM coordinates from the parsed poms' merged
+ * dependencyManagement. `version` is resolved against each pom's property map; entries
+ * that stay unresolved (`${…}`) or lack a g/a are skipped.
+ * @param propsByPom map pomPath → { properties, dependencyManagement } (xml2js-shaped)
+ * @returns [{ groupId, artifactId, version }] deduped by g:a:v
+ */
+function collectImportBoms(propsByPom) {
+	const seen = new Set();
+	const out = [];
+	for (const pom of Object.keys(propsByPom || {})) {
+		const entry = propsByPom[pom];
+		if (!entry) continue;
+		const props = entry.properties || {};
+		for (const d of (entry.dependencyManagement || [])) {
+			if (d?.scope?.[0] !== "import") continue;
+			const g = transitive.resolveProps(d.groupId?.[0], props);
+			const a = transitive.resolveProps(d.artifactId?.[0], props);
+			const v = transitive.resolveProps(d.version?.[0], props);
+			if (!g || !a || !v || /\$\{/.test(String(v))) continue;
+			const k = `${g}:${a}:${v}`;
+			if (seen.has(k)) continue;
+			seen.add(k);
+			out.push({ groupId: g, artifactId: a, version: v });
+		}
+	}
+	return out;
+}
+
+/**
+ * Resolve each import BOM to its managed-version table and merge them into one map.
+ * First BOM to manage a given g:a wins (mirrors Maven's declaration-order precedence).
+ */
+async function resolveBomManagedVersions(boms, opts = {}) {
+	const effectivePom = opts.effectivePom || transitive.effectivePom;
+	const map = new Map();
+	for (const bom of boms) {
+		let eff = null;
+		try { eff = await effectivePom(bom.groupId, bom.artifactId, bom.version, opts); }
+		catch { eff = null; }
+		if (!eff || !eff.depMgmt) continue;
+		for (const d of eff.depMgmt) {
+			if (!d.groupId || !d.artifactId) continue;
+			const k = `${d.groupId}:${d.artifactId}`;
+			if (map.has(k)) continue;
+			if (d.version && !/\$\{/.test(String(d.version))) map.set(k, String(d.version));
+		}
+	}
+	return map;
+}
+
+/**
+ * Fill the version of every Maven dep that has no concrete version (null or `${…}`)
+ * from the BOM-managed map. Mutates the resolvedDeps Map entries in place.
+ * @returns number of deps filled
+ */
+function backfillVersions(resolvedDeps, mgmtMap) {
+	let filled = 0;
+	for (const dep of resolvedDeps.values()) {
+		if (dep.ecosystem !== "maven") continue;
+		if (dep.provenance === "embedded" || dep.provenance === "binary") continue;
+		if (dep.version && !/\$\{/.test(String(dep.version))) continue; // already concrete
+		const v = mgmtMap.get(`${dep.groupId}:${dep.artifactId}`);
+		if (!v) continue;
+		dep.version = v;
+		if (!Array.isArray(dep.versions)) dep.versions = [];
+		if (!dep.versions.includes(v)) dep.versions.push(v);
+		filled++;
+	}
+	return filled;
+}
+
+/**
+ * One-shot: collect external import BOMs from the poms, resolve their managed versions
+ * online, and backfill the versionless declared deps.
+ * @returns { boms, filled, mgmtSize }
+ */
+async function resolveAndBackfill(propsByPom, resolvedDeps, opts = {}) {
+	const boms = collectImportBoms(propsByPom);
+	if (!boms.length) return { boms: 0, filled: 0, mgmtSize: 0 };
+	const map = await resolveBomManagedVersions(boms, opts);
+	const filled = backfillVersions(resolvedDeps, map);
+	return { boms: boms.length, filled, mgmtSize: map.size };
+}
+
+module.exports = { collectImportBoms, resolveBomManagedVersions, backfillVersions, resolveAndBackfill };

package/lib/outdated.js

@@ -42,6 +42,13 @@ function isEolCacheFresh(maxAge = EOL_CACHE_MAX_AGE_MS) {
 
 // -------- EOL via endoflife.date --------
 
+// Tag the matched mapping entry with HOW it matched (which rule + which key), so
+// the report can show where an EOL verdict comes from. Returns a COPY — the shared
+// EOL_MAPPING objects must never be mutated (they're reused across deps).
+function withOrigin(entry, via, viaKey) {
+	return entry ? { ...entry, via, viaKey } : null;
+}
+
 function findEolProduct(dep) {
 	// npm packages — and WebJars, which are client-side JS shipped as Maven
 	// artifacts — resolve by JS library name, not Maven coordinate. npm deps
@@ -49,36 +56,39 @@ function findEolProduct(dep) {
 	// first (org.webjars:angularjs → "angularjs", org.webjars.npm:angular__core
 	// → "@angular/core"). The npm package literally named "angular" is AngularJS
 	// 1.x; modern Angular is the @angular/* scope — hence the name vs. scope maps.
+	const isWebjar = dep.ecosystem !== "npm" && webjarToNpm(dep) != null;
 	const npmName = dep.ecosystem === "npm" ? (dep.artifactId || "") : webjarToNpm(dep)?.name;
 	if (npmName != null) {
 		const byName = EOL_MAPPING.by_npm_name?.[npmName];
-		if (byName) return byName;
+		if (byName) return withOrigin(byName, isWebjar ? "webjar" : "npm-name", npmName);
 		const scopes = Object.keys(EOL_MAPPING.by_npm_scope || {})
 			.sort((a, b) => b.length - a.length);
 		for (const s of scopes) {
-			if (npmName.startsWith(s)) return EOL_MAPPING.by_npm_scope[s];
+			if (npmName.startsWith(s)) return withOrigin(EOL_MAPPING.by_npm_scope[s], isWebjar ? "webjar" : "npm-scope", s);
 		}
 		return null;
 	}
 	if (dep.ecosystem === "composer") {
 		const full = `${dep.namespace || dep.groupId || ""}/${dep.name || dep.artifactId}`.toLowerCase();
-		return EOL_MAPPING.by_composer_name?.[full] || null;
+		return withOrigin(EOL_MAPPING.by_composer_name?.[full], "composer-name", full);
 	}
 	if (dep.ecosystem === "pypi") {
-		return EOL_MAPPING.by_pypi_name?.[(dep.name || dep.artifactId || "").toLowerCase()] || null;
+		const k = (dep.name || dep.artifactId || "").toLowerCase();
+		return withOrigin(EOL_MAPPING.by_pypi_name?.[k], "pypi-name", k);
 	}
 	if (dep.ecosystem === "nuget") {
-		return EOL_MAPPING.by_nuget_name?.[(dep.name || dep.artifactId || "").toLowerCase()] || null;
+		const k = (dep.name || dep.artifactId || "").toLowerCase();
+		return withOrigin(EOL_MAPPING.by_nuget_name?.[k], "nuget-name", k);
 	}
 	const key = `${dep.groupId}:${dep.artifactId}`;
 	const direct = EOL_MAPPING.by_group_artifact?.[key];
-	if (direct) return direct;
+	if (direct) return withOrigin(direct, "group-artifact", key);
 	// Match longest groupId prefix
 	const prefixes = Object.keys(EOL_MAPPING.by_group_prefix || {})
 		.sort((a, b) => b.length - a.length);
 	for (const p of prefixes) {
 		if (dep.groupId === p || dep.groupId.startsWith(p + ".")) {
-			return EOL_MAPPING.by_group_prefix[p];
+			return withOrigin(EOL_MAPPING.by_group_prefix[p], "group-prefix", p);
 		}
 	}
 	return null;
@@ -154,6 +164,8 @@ async function checkEolDeps(resolvedDeps, opts = {}) {
 			dep,
 			product: product.label || product.product,
 			productSlug: product.product,
+			via: product.via || null,
+			viaKey: product.viaKey || null,
 			cycle: cycle.cycle,
 			eol: cycle.eol === true ? "true" : String(cycle.eol),
 			latest: cycle.latest || null,