fad-checker 2.2.1 → 2.2.2

package/fad-checker.js

@@ -597,6 +597,18 @@ async function timedPhase(label, fn) {
 		}
 	}
 
+	// Mirror every non-Maven lockfile/manifest (npm/yarn/pnpm, composer, pypi, nuget,
+	// go, ruby) into the cleaned tree so `snyk test --all-projects` scans the WHOLE
+	// polyglot project, not just the cleaned POMs. Maven POMs are the rewrite above.
+	let copiedManifests = 0;
+	if (!readOnly) {
+		try {
+			const { copyEcosystemManifests } = require("./lib/manifest-copy");
+			const r = await copyEcosystemManifests(options.src, options.target, { excludePath, defaultExcludes });
+			copiedManifests = r.copied;
+		} catch (err) { console.error(chalk.red("  ✗ manifest copy failed:"), err.message); }
+	}
+
 	// ---------- Maven POM analysis summary (parents missing / excluded) ----------
 	let privateLibIds = [];
 	if (runMaven && mavenCtx) {
@@ -674,11 +686,15 @@ async function timedPhase(label, fn) {
 		else ui.info(chalk.dim(`${wrotePom} POM(s) cleanable (read-only — pass -t <dir> to write them)`));
 	}
 
+	if (!readOnly && copiedManifests) {
+		ui.ok(`${chalk.bold(copiedManifests)} non-Maven lockfile/manifest(s) mirrored → ${chalk.white(options.target)} ${chalk.dim("(so snyk --all-projects scans every ecosystem)")}`);
+	}
+
 	// ---------- Scan flow (CVE / EOL / Obsolete) ----------
 	// The scan always runs — it feeds the terminal summary, the file outputs and the
 	// CI gate. Which files get written is decided by the --report-* family inside
 	// (HTML + .doc by default; --no-report writes nothing).
-	await runReportFlow(resolved, { activeIds, runMaven, runNpm, privateLibIds, mavenRepos, regMap, collectWarnings });
+	await runReportFlow(resolved, { activeIds, runMaven, runNpm, privateLibIds, mavenRepos, regMap, collectWarnings, mavenPropsByPom: mavenCtx?.propsByPom, mavenStore: mavenCtx?.store });
 	if (!readOnly) {
 		ui.section("Next step");
 		ui.info(`run Snyk on the cleaned tree:`);
@@ -687,7 +703,7 @@ async function timedPhase(label, fn) {
 })();
 
 async function runReportFlow(resolved, ecoFlags = {}) {
-	const { activeIds = [], runMaven = true, runNpm = false, privateLibIds = [], mavenRepos = [], regMap = {}, collectWarnings = [] } = ecoFlags;
+	const { activeIds = [], runMaven = true, runNpm = false, privateLibIds = [], mavenRepos = [], regMap = {}, collectWarnings = [], mavenPropsByPom = null, mavenStore = null } = ecoFlags;
 	const registriesFor = eco => regMap[eco] || [];
 	const { expandWithTransitives } = require("./lib/cve-match");
 	const { writeReports, computeStats } = require("./lib/cve-report");
@@ -701,13 +717,9 @@ async function runReportFlow(resolved, ecoFlags = {}) {
 	const npmWarnings = collectWarnings || [];
 	let scanWarnings = [];
 	const directCount = resolved.size;
-
-	// Scan-completeness signals: BOMs and unresolved-version deps mean fad-checker
-	// has gone as far as it can without running Maven/Snyk itself.
-	if (runMaven) {
-		const { detectScanCompletenessWarnings } = require("./lib/scan-completeness");
-		scanWarnings = detectScanCompletenessWarnings(resolved, { ranSnyk: !!options.snyk, ranTransitive: !!options.transitive });
-	}
+	// NOTE: scan-completeness (unresolved-versions) is computed LATER — after the BOM
+	// version-resolution step backfills external-BOM-managed versions — so it reflects
+	// what's *genuinely* still unresolved, not what a Maven Central BOM fetch will fix.
 
 	// ---- Vulnerability database update (global step progress) ----
 	ui.section("Vulnerability database update");
@@ -726,6 +738,17 @@ async function runReportFlow(resolved, ecoFlags = {}) {
 	const otherRegistryIds = activeIds.filter(id => id !== "maven" && id !== "npm" && id !== "yarn" && getCodec(id)?.checkRegistry);
 	const willCve = !!cveScanner && (!(options.cveOffline || offline) || cveIndexExists);
 	const willTransitive = !!(options.transitive && runMaven);
+	// Per-module version mediation overlay: recover transitive versions the global
+	// transitive pass masks via cross-module depMgmt bleed. Runs after (and only when)
+	// the global pass runs, and needs the parsed store + per-module props.
+	const willOverlay = willTransitive && !!mavenPropsByPom && !!mavenStore;
+	// External import BOMs (e.g. spring-boot-dependencies): resolve their managed
+	// versions to backfill declared deps that pin no version of their own (the usual
+	// Spring Boot setup). Cached via poms-cache; offline-aware (uses warmed POMs,
+	// never the network — same as transitive resolution).
+	const importBoms = (runMaven && mavenPropsByPom)
+		? require("./lib/maven-bom").collectImportBoms(mavenPropsByPom) : [];
+	const willBom = importBoms.length > 0;
 	const willOsv = !!options.osv;
 	const willOutdated = !!options.allLibs;
 	const willNvd = !!options.nvd;
@@ -737,9 +760,18 @@ async function runReportFlow(resolved, ecoFlags = {}) {
 	const willBinaryId = [...resolved.values()].some(d => d.provenance === "binary");
 	// License detection piggybacks on the registry passes (same fetched metadata),
 	// so it adds no progress step of its own.
-	const totalSteps = [willTransitive, willCve, /*EOL*/ true, willOutdated, /*npm reg*/ true, ...otherRegistryIds.map(() => true), willOsv, willNvd, willEpss, willKev, willRetire, willBinaryId].filter(Boolean).length;
+	const totalSteps = [willBom, willTransitive, willOverlay, willCve, /*EOL*/ true, willOutdated, /*npm reg*/ true, ...otherRegistryIds.map(() => true), willOsv, willNvd, willEpss, willKev, willRetire, willBinaryId].filter(Boolean).length;
 	const progress = new ui.Progress(totalSteps);
 
+	if (willBom) {
+		const st = progress.start("BOM version resolution (Maven Central)");
+		try {
+			const { resolveAndBackfill } = require("./lib/maven-bom");
+			const r = await resolveAndBackfill(mavenPropsByPom, resolved, { repos: mavenRepos, offline, verbose });
+			st.done(`${r.filled} dep version(s) from ${r.boms} import BOM(s)`);
+		} catch (err) { st.fail(err.message); }
+	}
+
 	if (willTransitive) {
 		const st = progress.start("Transitive resolution (Maven Central)");
 		await expandWithTransitives(resolved, {
@@ -752,6 +784,32 @@ async function runReportFlow(resolved, ecoFlags = {}) {
 		st.done(`+${resolved.size - directCount} transitive (total ${resolved.size})`);
 	}
 
+	if (willOverlay) {
+		const st = progress.start("Per-module version mediation (masked transitives)");
+		try {
+			const { expandPerModuleOverlay } = require("./lib/version-overlay");
+			const ov = await expandPerModuleOverlay(resolved, mavenStore, mavenPropsByPom, {
+				verbose,
+				offline,
+				maxDepth: parseInt(options.transitiveDepth, 10) || 6,
+				includeTestDeps: !options.ignoreTest,
+				repos: mavenRepos,
+			});
+			st.done(`+${ov.appended} masked version(s) recovered across ${ov.modules} module(s)`);
+			if (verbose && ov.recovered.length) {
+				for (const r of ov.recovered) console.log(`   ↳ ${r.coord}: +${r.version} (had ${r.had})  via ${r.module}`);
+			}
+		} catch (err) { st.fail(err.message); }
+	}
+
+	// Scan-completeness signals — computed NOW (after BOM backfill) so only the deps
+	// still without a concrete version (external BOM truly unreachable, or offline)
+	// are flagged, not the ones we just resolved from spring-boot-dependencies & co.
+	if (runMaven) {
+		const { detectScanCompletenessWarnings } = require("./lib/scan-completeness");
+		scanWarnings = detectScanCompletenessWarnings(resolved, { ranSnyk: !!options.snyk, ranTransitive: !!options.transitive });
+	}
+
 	// 1. CVE — native scanner contributed by the maven codec (local cvelistV5 index).
 	let cveMatches = [];
 	let cveDataDate = null;
@@ -1078,7 +1136,12 @@ async function runReportFlow(resolved, ecoFlags = {}) {
 		ui.warn(`${scanWarnings.length} scan-completeness note(s) — a real Maven/Snyk run may surface more:`);
 		for (const w of scanWarnings) {
 			ui.info(chalk.dim(`[${w.type}] ${w.message}`));
-			for (const it of (w.items || []).slice(0, 4)) console.log("      " + chalk.dim(`· ${it}`));
+			// Items may be plain strings or { id, manifestPaths } objects (the
+			// unresolved-versions warning carries the defining manifest paths).
+			for (const it of (w.items || []).slice(0, 4)) {
+				const id = typeof it === "string" ? it : it.id;
+				console.log("      " + chalk.dim(`· ${id}`));
+			}
 			if ((w.items || []).length > 4) console.log("      " + chalk.dim(`· …and ${w.items.length - 4} more`));
 		}
 	}

package/lib/cve-match.js

@@ -180,12 +180,17 @@ function matchOne(dep, entries, confidence) {
 	// the same g:a), not just the representative highest — otherwise a CVE that
 	// only affects a lower-versioned profile variant would be missed.
 	const versions = (dep.versions && dep.versions.length) ? dep.versions : [dep.version];
+	// Only CONCRETE, resolved versions can be matched. A dep whose version is null
+	// or an unresolved `${property}` (typically pinned by an external BOM like
+	// spring-boot-dependencies) carries NO version we can compare — matching it
+	// against every "affected" range would flag it as vulnerable to ALL the
+	// coordinate's CVEs (a flood of false CRITICALs with version "?"). Skip it;
+	// it's already reported in chapter 0 as an "unresolved-versions" warning.
+	const concrete = versions.filter(v => v && !/\$\{/.test(String(v)));
+	if (!concrete.length) return matches;
 	for (const e of entries) {
-		for (const ver of versions) {
-			const affected = (e.ranges || []).some(r => {
-				if (!ver) return r.status === "affected"; // unknown version → assume affected
-				return isVersionAffected(ver, r);
-			});
+		for (const ver of concrete) {
+			const affected = (e.ranges || []).some(r => isVersionAffected(ver, r));
 			if (affected) {
 				const vdep = ver === dep.version ? dep : { ...dep, version: ver };
 				matches.push({ dep: vdep, cve: { ...e }, confidence });

package/lib/manifest-copy.js

@@ -0,0 +1,75 @@
+/**
+ * lib/manifest-copy.js — when writing a cleaned tree (`-t`), copy every NON-Maven
+ * ecosystem manifest / lockfile from the source into the target at the same relative
+ * path, so `snyk test --all-projects` on the cleaned tree scans every ecosystem — not
+ * just the cleaned Maven POMs (which are written separately by core.rewritePoms).
+ *
+ * Maven is excluded (its cleaned POMs are the whole point of the rewrite); the binary
+ * codec is excluded (its files aren't dependency manifests). node_modules / vendor and
+ * friends are pruned so we copy the project's own lockfiles, not vendored ones.
+ */
+const fs = require("fs");
+const path = require("path");
+const { makeDirFilter } = require("./path-filter");
+const { allCodecs } = require("./codecs");
+
+// Ecosystems whose manifests/lockfiles Snyk reads off disk.
+const COPY_ECOSYSTEMS = new Set(["npm", "nuget", "composer", "pypi", "go", "ruby"]);
+// Companion files that aren't a codec's primary manifest but Snyk/the build need.
+const COMPANION_FILES = ["Directory.Packages.props", "Directory.Build.props", "nuget.config", "Gemfile", "Pipfile", "go.work", "go.work.sum"];
+// Directories never worth copying manifests from (installed/vendored trees).
+const SKIP_DIRS = new Set([
+	"node_modules", "bower_components", "jspm_packages", "vendor",
+	".git", ".svn", ".hg", ".idea", ".vscode", ".gradle", ".mvn",
+	"target", "dist", "build", "out", "bin", "obj", ".next", ".nuxt", "coverage",
+]);
+
+/** Pure: the exact filenames + extensions that count as a copyable manifest. */
+function manifestMatchers() {
+	const exact = new Set(COMPANION_FILES);
+	const exts = [];
+	for (const c of allCodecs()) {
+		if (!COPY_ECOSYSTEMS.has(c.id)) continue;
+		for (const n of c.manifestNames || []) {
+			if (n.startsWith("*.")) exts.push(n.slice(1)); // "*.csproj" → ".csproj"
+			else exact.add(n);
+		}
+	}
+	return { exact, exts };
+}
+
+/** Pure: is this basename a manifest we copy? */
+function isManifestName(name, matchers = manifestMatchers()) {
+	return matchers.exact.has(name) || matchers.exts.some(e => name.endsWith(e));
+}
+
+/**
+ * Copy every matching manifest from srcRoot into targetRoot at the same relative path.
+ * @returns { copied: number, files: string[] } (files are relative paths)
+ */
+async function copyEcosystemManifests(srcRoot, targetRoot, opts = {}) {
+	const matchers = manifestMatchers();
+	const skipDir = makeDirFilter({ srcRoot, defaultSkip: SKIP_DIRS, excludePath: opts.excludePath, useDefaults: opts.defaultExcludes !== false });
+	const files = [];
+	const walk = async (dir) => {
+		let entries;
+		try { entries = await fs.promises.readdir(dir, { withFileTypes: true }); } catch { return; }
+		for (const e of entries) {
+			const abs = path.join(dir, e.name);
+			if (e.isDirectory()) { if (!skipDir(abs, e.name)) await walk(abs); continue; }
+			if (!e.isFile()) continue;
+			if (!isManifestName(e.name, matchers)) continue;
+			const rel = path.relative(srcRoot, abs);
+			const dest = path.join(targetRoot, rel);
+			try {
+				await fs.promises.mkdir(path.dirname(dest), { recursive: true });
+				await fs.promises.copyFile(abs, dest);
+				files.push(rel);
+			} catch { /* best effort per file */ }
+		}
+	};
+	await walk(srcRoot);
+	return { copied: files.length, files };
+}
+
+module.exports = { manifestMatchers, isManifestName, copyEcosystemManifests, COPY_ECOSYSTEMS };

package/lib/maven-bom.js

@@ -0,0 +1,104 @@
+/**
+ * lib/maven-bom.js — resolve EXTERNAL import-scope BOMs (e.g. spring-boot-dependencies)
+ * from Maven Central and backfill the versions of declared deps that the BOM manages.
+ *
+ * core.js follows LOCAL `<scope>import</scope>` BOMs (their POM is in the source tree)
+ * but cannot enumerate an external BOM's managed-version table without fetching it. So
+ * in a typical Spring Boot project every `spring-boot-starter-*` (declared without a
+ * version, version pinned by the imported BOM) ends up unresolved — flooding chapter 0
+ * and dropping out of the CVE/EOL/outdated scans.
+ *
+ * This module fetches each external import BOM via transitive.js#effectivePom (which
+ * already merges the parent chain, resolves `${properties}` and recursively expands
+ * nested import BOMs), builds a g:a → version map, and fills it into the versionless
+ * declared deps. Network + cached (poms-cache, immutable) + offline-aware (the caller
+ * skips it offline). Pure except for the injected/real effectivePom fetch.
+ */
+const transitive = require("./transitive");
+
+/**
+ * Extract the distinct external import-BOM coordinates from the parsed poms' merged
+ * dependencyManagement. `version` is resolved against each pom's property map; entries
+ * that stay unresolved (`${…}`) or lack a g/a are skipped.
+ * @param propsByPom map pomPath → { properties, dependencyManagement } (xml2js-shaped)
+ * @returns [{ groupId, artifactId, version }] deduped by g:a:v
+ */
+function collectImportBoms(propsByPom) {
+	const seen = new Set();
+	const out = [];
+	for (const pom of Object.keys(propsByPom || {})) {
+		const entry = propsByPom[pom];
+		if (!entry) continue;
+		const props = entry.properties || {};
+		for (const d of (entry.dependencyManagement || [])) {
+			if (d?.scope?.[0] !== "import") continue;
+			const g = transitive.resolveProps(d.groupId?.[0], props);
+			const a = transitive.resolveProps(d.artifactId?.[0], props);
+			const v = transitive.resolveProps(d.version?.[0], props);
+			if (!g || !a || !v || /\$\{/.test(String(v))) continue;
+			const k = `${g}:${a}:${v}`;
+			if (seen.has(k)) continue;
+			seen.add(k);
+			out.push({ groupId: g, artifactId: a, version: v });
+		}
+	}
+	return out;
+}
+
+/**
+ * Resolve each import BOM to its managed-version table and merge them into one map.
+ * First BOM to manage a given g:a wins (mirrors Maven's declaration-order precedence).
+ */
+async function resolveBomManagedVersions(boms, opts = {}) {
+	const effectivePom = opts.effectivePom || transitive.effectivePom;
+	const map = new Map();
+	for (const bom of boms) {
+		let eff = null;
+		try { eff = await effectivePom(bom.groupId, bom.artifactId, bom.version, opts); }
+		catch { eff = null; }
+		if (!eff || !eff.depMgmt) continue;
+		for (const d of eff.depMgmt) {
+			if (!d.groupId || !d.artifactId) continue;
+			const k = `${d.groupId}:${d.artifactId}`;
+			if (map.has(k)) continue;
+			if (d.version && !/\$\{/.test(String(d.version))) map.set(k, String(d.version));
+		}
+	}
+	return map;
+}
+
+/**
+ * Fill the version of every Maven dep that has no concrete version (null or `${…}`)
+ * from the BOM-managed map. Mutates the resolvedDeps Map entries in place.
+ * @returns number of deps filled
+ */
+function backfillVersions(resolvedDeps, mgmtMap) {
+	let filled = 0;
+	for (const dep of resolvedDeps.values()) {
+		if (dep.ecosystem !== "maven") continue;
+		if (dep.provenance === "embedded" || dep.provenance === "binary") continue;
+		if (dep.version && !/\$\{/.test(String(dep.version))) continue; // already concrete
+		const v = mgmtMap.get(`${dep.groupId}:${dep.artifactId}`);
+		if (!v) continue;
+		dep.version = v;
+		if (!Array.isArray(dep.versions)) dep.versions = [];
+		if (!dep.versions.includes(v)) dep.versions.push(v);
+		filled++;
+	}
+	return filled;
+}
+
+/**
+ * One-shot: collect external import BOMs from the poms, resolve their managed versions
+ * online, and backfill the versionless declared deps.
+ * @returns { boms, filled, mgmtSize }
+ */
+async function resolveAndBackfill(propsByPom, resolvedDeps, opts = {}) {
+	const boms = collectImportBoms(propsByPom);
+	if (!boms.length) return { boms: 0, filled: 0, mgmtSize: 0 };
+	const map = await resolveBomManagedVersions(boms, opts);
+	const filled = backfillVersions(resolvedDeps, map);
+	return { boms: boms.length, filled, mgmtSize: map.size };
+}
+
+module.exports = { collectImportBoms, resolveBomManagedVersions, backfillVersions, resolveAndBackfill };

package/lib/transitive.js

@@ -183,12 +183,18 @@ function resolveProps(value, props, builtins, depth = 0) {
 async function effectivePom(g, a, v, opts = {}, seen = new Set()) {
 	const key = `${g}:${a}:${v}`;
 	if (seen.has(key)) return null;
+	// Opt-in cross-call memo (used by the per-module overlay, which resolves the
+	// same shared parents/BOMs once per module). Immutable POMs → the effective
+	// result for a g:a:v is stable, so caching the finished object is safe; callers
+	// only READ eff.depMgmt/eff.deps. Only active when opts.effCache is supplied,
+	// so existing single-shot callers are byte-for-byte unchanged.
+	if (opts.effCache && opts.effCache.has(key)) return opts.effCache.get(key);
 	seen.add(key);
 
 	const xml = await fetchPom(g, a, v, opts);
-	if (!xml) return null;
+	if (!xml) { if (opts.effCache) opts.effCache.set(key, null); return null; }
 	const pom = await parsePomXml(xml);
-	if (!pom) return null;
+	if (!pom) { if (opts.effCache) opts.effCache.set(key, null); return null; }
 
 	let merged = {
 		groupId: pom.groupId,
@@ -243,6 +249,7 @@ async function effectivePom(g, a, v, opts = {}, seen = new Set()) {
 	}
 	merged.depMgmt = expanded;
 
+	if (opts.effCache) opts.effCache.set(key, merged);
 	return merged;
 }
 

package/lib/version-overlay.js

@@ -0,0 +1,193 @@
+/**
+ * lib/version-overlay.js — recover transitive dependency versions that Maven's
+ * PER-MODULE mediation keeps but fad's GLOBAL transitive pass masks.
+ *
+ * The problem: `expandWithTransitives` (cve-match.js) resolves the whole reactor as
+ * ONE tree with ONE global `rootDepMgmt` (the highest version of every coord seen
+ * anywhere). So a `<dependencyManagement>` pin in module A is force-applied to a
+ * transitive of the unrelated module B — e.g. `controller` pins poi 5.4.1 and the
+ * stress-tests island's `jmeter → poi 3.11` gets rewritten to 5.4.1, hiding
+ * CVE-2017-12626. Maven applies depMgmt only inside the subtree that declares it.
+ *
+ * The fix (additive overlay): keep the global pass UNCHANGED as the base (no
+ * regression), then re-resolve EACH module independently with ONLY that module's
+ * own effective depMgmt (its local parent chain + its external parent/import-BOMs),
+ * and APPEND any (g:a, version) it finds that isn't already in the coord's
+ * `versions[]`. Never removes, never reseeds — so it can only ADD coverage, and the
+ * per-module version it finds is the one genuinely on that module's classpath
+ * (so it's a true positive, not a force-elevated one).
+ *
+ * Offline-aware (cache-first via transitive.js#fetchPom) and memoised across modules
+ * with a shared `effCache` so 25 modules stay fast.
+ */
+const core = require("./core");
+const { resolveTransitiveDeps, effectivePom } = require("./transitive");
+const { resolveDepVersion } = require("./cve-match");
+
+const coord = core.coord;
+const isConcrete = v => v != null && !/\$\{/.test(String(v));
+
+/** xml2js dependency node → flat descriptor (groupId/artifactId/version/scope/…). */
+function flattenDep(d) {
+	return {
+		groupId: coord(d.groupId?.[0]),
+		artifactId: coord(d.artifactId?.[0]),
+		rawVersion: coord(d.version?.[0]),
+		scope: coord(d.scope?.[0]) || "compile",
+		optional: d.optional?.[0] === "true",
+		isImport: d.scope?.[0] === "import",
+		exclusions: (d.exclusions?.[0]?.exclusion || []).map(e => ({
+			groupId: coord(e.groupId?.[0]),
+			artifactId: coord(e.artifactId?.[0]),
+		})),
+	};
+}
+
+/**
+ * Walk a module's LOCAL parent chain (child first). Stops at the first external
+ * parent (one not present in the source tree) and reports it separately, so the
+ * caller can resolve its managed table from Maven Central.
+ * @returns { chain: [pomPath, parentPath, …], externalParent: {groupId,artifactId,version}|null }
+ */
+function localChain(pomPath, store) {
+	const chain = [];
+	const seen = new Set();
+	let cur = pomPath;
+	let externalParent = null;
+	while (cur && !seen.has(cur)) {
+		seen.add(cur);
+		chain.push(cur);
+		const meta = store.byPath[cur];
+		if (!meta) break;
+		const parentPath = core.resolveParentPath(cur, meta.parentInfo, store);
+		if (!parentPath) {
+			const p = meta.parentInfo;
+			if (p?.groupId && p?.artifactId && p?.version) externalParent = { groupId: p.groupId, artifactId: p.artifactId, version: p.version };
+			break;
+		}
+		cur = parentPath;
+	}
+	return { chain, externalParent };
+}
+
+/**
+ * Build the EFFECTIVE managed-version map for ONE module — exactly the depMgmt that
+ * Maven would apply when resolving THIS module's dependencies, and no other module's.
+ * Closest-declared pin wins (set-if-absent while climbing child → parent).
+ *
+ * Sources, in precedence order:
+ *   1. each local pom in the parent chain's own <dependencyManagement> (local
+ *      scope=import BOMs are already expanded inline by core.getAllInheritedProps);
+ *   2. the chain's external <parent> (e.g. spring-boot-starter-parent) managed table;
+ *   3. external scope=import BOMs (e.g. spring-boot-dependencies) declared in the chain.
+ * @returns Map<"g:a", version>
+ */
+async function buildModuleManagement(pomPath, store, propsByPom, opts = {}) {
+	const map = new Map();
+	const setIf = (k, v) => { if (k && isConcrete(v) && !map.has(k)) map.set(k, String(v)); };
+	const { chain, externalParent } = localChain(pomPath, store);
+	const externalBoms = [];
+
+	for (const pom of chain) {
+		const entry = propsByPom[pom];
+		if (!entry) continue;
+		const props = entry.properties || {};
+		for (const node of entry.dependencyManagement || []) {
+			const g = coord(node.groupId?.[0]);
+			const a = coord(node.artifactId?.[0]);
+			if (!g || !a) continue;
+			const v = resolveDepVersion(coord(node.version?.[0]), props);
+			if (node.scope?.[0] === "import") {
+				// Local import BOMs are already expanded inline by getAllInheritedProps;
+				// only chase EXTERNAL ones (not present in the source tree).
+				const local = (v && store.byId[`${g}:${a}:${v}`]) || store.byId[`${g}:${a}`];
+				if (!local && isConcrete(v)) externalBoms.push({ groupId: g, artifactId: a, version: v });
+				continue;
+			}
+			setIf(`${g}:${a}`, v);
+		}
+	}
+
+	// External parent + external import BOMs: pull their managed tables from Maven
+	// Central (cache-first, memoised). Closest local pins already set win.
+	const externals = externalParent ? [externalParent, ...externalBoms] : externalBoms;
+	for (const ext of externals) {
+		let eff = null;
+		try { eff = await effectivePom(ext.groupId, ext.artifactId, ext.version, opts); } catch { eff = null; }
+		if (eff?.depMgmt) for (const d of eff.depMgmt) setIf(`${d.groupId}:${d.artifactId}`, d.version);
+	}
+	return map;
+}
+
+/**
+ * The direct dependencies declared by ONE module, with concrete versions resolved
+ * (own ${properties} → module's managed map → the global resolved version). These
+ * seed the per-module transitive walk.
+ */
+function buildModuleDirects(pomPath, propsByPom, moduleMgmt, resolvedDeps, opts = {}) {
+	const entry = propsByPom[pomPath];
+	if (!entry) return [];
+	const props = entry.properties || {};
+	const out = [];
+	for (const node of entry.dependencies || []) {
+		const d = flattenSafe(node);
+		if (!d || !d.groupId || !d.artifactId || d.optional || d.isImport) continue;
+		if (d.scope === "test" && !opts.includeTestDeps) continue;
+		if (d.scope === "system" || d.scope === "import") continue;
+		let v = resolveDepVersion(d.rawVersion, props);
+		if (!isConcrete(v)) v = moduleMgmt.get(`${d.groupId}:${d.artifactId}`) || resolvedDeps.get(`${d.groupId}:${d.artifactId}`)?.version || null;
+		if (!isConcrete(v)) continue;
+		out.push({ groupId: d.groupId, artifactId: d.artifactId, version: String(v), scope: d.scope, exclusions: d.exclusions });
+	}
+	return out;
+}
+// flattenSafe guards against malformed nodes (xml2js can yield odd shapes).
+function flattenSafe(node) { try { return flattenDep(node); } catch { return null; } }
+
+/**
+ * Additive per-module overlay. Mutates `resolvedDeps`: for every coord already in
+ * the scan set, appends any concrete version found by a faithful per-module
+ * resolution that the global pass masked. Returns a small diagnostics object incl.
+ * the (g:a, version) pairs recovered (used for the false-positive measurement).
+ */
+async function expandPerModuleOverlay(resolvedDeps, store, propsByPom, opts = {}) {
+	if (!store || !propsByPom) return { appended: 0, modules: 0, recovered: [] };
+	const effCache = opts.effCache || new Map();
+	const tOpts = { ...opts, effCache };
+	const recovered = [];
+	let modules = 0;
+
+	for (const pomPath of Object.keys(propsByPom)) {
+		const moduleMgmt = await buildModuleManagement(pomPath, store, propsByPom, tOpts);
+		const directs = buildModuleDirects(pomPath, propsByPom, moduleMgmt, resolvedDeps, tOpts);
+		if (!directs.length) continue;
+		modules++;
+
+		let trans;
+		try {
+			trans = await resolveTransitiveDeps(directs, {
+				...tOpts,
+				rootDepMgmt: moduleMgmt,
+				maxDepth: opts.maxDepth || 6,
+				includedScopes: ["compile", "runtime", "provided"],
+			});
+		} catch { continue; }
+
+		for (const [key, t] of trans) {
+			const v = t.version;
+			if (!isConcrete(v)) continue;
+			const existing = resolvedDeps.get(key);
+			if (!existing) continue;                               // additive to coords already scanned
+			if (existing.provenance === "embedded" || existing.provenance === "binary") continue;
+			if (!Array.isArray(existing.versions)) existing.versions = isConcrete(existing.version) ? [existing.version] : [];
+			if (existing.versions.includes(String(v))) continue;   // already scanned this version
+			existing.versions.push(String(v));
+			existing.maskedVersions = existing.maskedVersions || [];
+			existing.maskedVersions.push({ version: String(v), via: t.via, viaPaths: t.viaPaths, module: pomPath, depth: t.depth });
+			recovered.push({ coord: key, version: String(v), module: pomPath, had: existing.version });
+		}
+	}
+	return { appended: recovered.length, modules, recovered };
+}
+
+module.exports = { expandPerModuleOverlay, buildModuleManagement, buildModuleDirects, localChain };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fad-checker",
-  "version": "2.2.1",
+  "version": "2.2.2",
   "description": "Scan ALL Maven, npm, Yarn, Composer, Python, C#/.NET, Go & Ruby dependencies — plus embedded JARs (fat-jars/war/ear) — in a source tree ONE SHOT without mvn/python/etc — CVE (EPSS/KEV-prioritised), EOL, obsolete, outdated & licenses, with SBOM/CSAF/SARIF/JSON exports, CI gating and fix recos",
   "keywords": [
     "sca",