fad-checker 2.2.3 → 2.2.4

package/lib/cve-report.js

@@ -14,6 +14,7 @@ const { getCodec, allCodecs, ORDER } = require("./codecs");
 const { computePriority, sortByPriority } = require("./priority");
 const { buildInventory } = require("./unmanaged");
 const { buildEmbeddedInventory } = require("./embedded");
+const { renderCharts } = require("./charts");
 
 // CWE-id → short human name. Loaded once at module init. Unknown CWEs fall
 // back to the raw id (with a "—" placeholder name where the row asks for one).
@@ -98,10 +99,13 @@ h1 { margin: 0 0 4px 0; font-size: 28px; letter-spacing: -.5px; }
 .report-subtitle { color: #6b7280; font-size: 14px; font-weight: 500; margin-bottom: 12px; letter-spacing: .3px; }
 h2 { margin: 32px 0 12px; font-size: 20px; border-bottom: 2px solid #e5e7eb; padding-bottom: 6px; }
 .meta { color: #6b7280; font-size: 13px; margin-bottom: 16px; }
-.summary { display: flex; flex-wrap: wrap; gap: 12px; margin: 16px 0; }
-.summary .card { padding: 10px 16px; border-radius: 6px; background: #fff; border: 1px solid #e5e7eb; min-width: 120px; }
-.summary .card .v { font-size: 24px; font-weight: 700; }
-.summary .card .l { font-size: 11px; text-transform: uppercase; color: #6b7280; letter-spacing: .5px; }
+/* Totals row — compact cards that FLEX-GROW to spread evenly across the full
+   render width (flex:1), so the set fills the line above the overview charts
+   instead of clustering on the left. */
+.summary { display: flex; flex-wrap: wrap; gap: 7px; margin: 14px 0; }
+.summary .card { flex: 1 1 0; padding: 6px 11px; border-radius: 5px; background: #fff; border: 1px solid #e5e7eb; min-width: 100px; }
+.summary .card .v { font-size: 20px; font-weight: 700; line-height: 1.1; }
+.summary .card .l { font-size: 11px; text-transform: uppercase; color: #6b7280; letter-spacing: .3px; white-space: nowrap; }
 .summary .card.sev-critical { border-left: 4px solid #dc2626; }
 .summary .card.sev-critical .v { color: #dc2626; }
 .summary .card.sev-high { border-left: 4px solid #f97316; }
@@ -112,13 +116,25 @@ h2 { margin: 32px 0 12px; font-size: 20px; border-bottom: 2px solid #e5e7eb; pad
 .summary .card.sev-low .v { color: #2563eb; }
 .summary .card.sev-vendored { border-left: 4px solid #6366f1; }
 .summary .card.sev-warn { border-left: 4px solid #f59e0b; background: #fffbeb; }
+/* Overview charts — four equal-width (25%) cards on one row, stretched to the
+   same height. All four donuts share one viewBox width (see lib/charts.js) so
+   they scale identically and stay the SAME size whatever the legend length.
+   The copy button overlays the top-right. */
+.charts-row { display: flex; flex-wrap: wrap; gap: 12px; margin: 12px 0 18px; align-items: stretch; }
+.charts-row .chart-card { flex: 1 1 0; min-width: 200px; position: relative; margin: 0; padding: 10px 12px; border: 1px solid #e5e7eb; border-radius: 8px; background: #fff; }
+.charts-row .chart-copy { position: absolute; top: 6px; right: 8px; padding: 2px 7px; font-size: 11px; z-index: 1; }
+.charts-row .chart-svg { display: block; width: 100%; height: auto; }
+.charts-row .chart-head { display: flex; align-items: center; gap: 8px; margin-bottom: 4px; }
+.charts-row .chart-title { font-size: 11px; font-weight: 700; text-transform: uppercase; letter-spacing: .4px; color: #4b5563; }
+.charts-row .chart-empty { color: #9ca3af; font-style: italic; font-size: 11px; padding: 14px 0; }
 .toc { position: sticky; top: 0; z-index: 50; background: #fff; border: 1px solid #e5e7eb; border-radius: 6px; padding: 8px 12px; margin: 16px 0; display: flex; flex-wrap: wrap; gap: 6px 14px; font-size: 12px; box-shadow: 0 1px 4px rgba(0,0,0,.04); }
 .toc a { color: #4338ca; text-decoration: none; padding: 2px 6px; border-radius: 3px; }
 .toc a:hover { background: #eef2ff; }
 .exec-summary .exec-top { margin-top: 8px; padding-top: 10px; border-top: 1px dashed #e5e7eb; }
 .exec-summary .exec-top-title { font-size: 11px; font-weight: 700; text-transform: uppercase; letter-spacing: .8px; color: #6b7280; margin-bottom: 6px; }
 .exec-summary .exec-top-list { list-style: none; padding: 0; margin: 0; font-size: 12px; }
-.exec-summary .exec-top-list li { display: flex; align-items: center; gap: 8px; padding: 3px 0; font-family: ui-monospace, monospace; }
+.exec-summary .exec-top-list li { display: flex; align-items: center; flex-wrap: wrap; gap: 6px; padding: 3px 0; font-family: ui-monospace, monospace; }
+.exec-summary .exec-cwes-chips { display: inline-flex; flex-wrap: wrap; gap: 4px; }
 .exec-summary .exec-cve-link { color: #1d4ed8; text-decoration: none; font-weight: 600; }
 .exec-summary .exec-cve-link:hover { text-decoration: underline; }
 .exec-summary .exec-ver { color: #6b7280; }
@@ -153,6 +169,17 @@ td.cwe .cwe-name { font-family: -apple-system, "Segoe UI", Roboto, sans-serif; f
 .exec-summary .exec-cwe { display: inline-flex; align-items: baseline; gap: 4px; font-size: 11px; color: #4b5563; background: #eef2ff; border: 1px solid #c7d2fe; padding: 1px 6px; border-radius: 3px; margin-left: 2px; }
 .exec-summary .exec-cwe .exec-cwe-id { font-family: ui-monospace, monospace; font-weight: 600; color: #4338ca; }
 .exec-summary .exec-cwe .exec-cwe-name { color: #4b5563; }
+.exec-summary .exec-cwe .exec-cwe-count { font-family: ui-monospace, monospace; font-size: 10px; color: #6366f1; font-weight: 700; }
+/* transitive-fallback tag on a top-3 row */
+.exec-summary .exec-scope-tag { font-size: 9px; font-weight: 700; text-transform: uppercase; letter-spacing: .5px; color: #92400e; background: #fef3c7; border: 1px solid #fde68a; padding: 1px 5px; border-radius: 3px; }
+/* top-EOL block */
+.exec-summary .exec-eol { margin-top: 8px; padding-top: 10px; border-top: 1px dashed #e5e7eb; }
+.exec-summary .exec-eol-title { font-size: 11px; font-weight: 700; text-transform: uppercase; letter-spacing: .8px; color: #6b7280; margin-bottom: 6px; }
+.exec-summary .exec-eol-list { list-style: none; padding: 0; margin: 0; font-size: 12px; }
+.exec-summary .exec-eol-list li { display: flex; align-items: center; gap: 8px; padding: 3px 0; font-family: ui-monospace, monospace; }
+/* short summary of everything else */
+.exec-summary .exec-rest { margin-top: 8px; padding-top: 10px; border-top: 1px dashed #e5e7eb; font-size: 12px; color: #374151; line-height: 1.6; }
+.exec-summary .exec-rest .exec-rest-label { font-weight: 700; text-transform: uppercase; letter-spacing: .8px; color: #6b7280; font-size: 11px; margin-right: 4px; }
 td.published { font-family: ui-monospace, monospace; font-size: 11px; color: #6b7280; white-space: nowrap; }
 tr.cve-row.cpe-fp td { opacity: .55; }
 .jump-badge { display: inline-block; padding: 1px 8px; border-radius: 4px; font-size: 10px; font-weight: 700; text-transform: uppercase; letter-spacing: .5px; }
@@ -1194,21 +1221,19 @@ function renderRetireTable(matches) {
 }
 
 /**
- * One "vulnerable to" clause for a match, in the format requested for the
- * Word-pasteable summary: prefer the primary CWE ("CWE-79 : Cross-site
- * Scripting"), fall back to the CVE id when no weakness is recorded.
+ * The "vulnerable to" clause for a match in the Word-pasteable summary: ALL of
+ * the finding's CWEs ("CWE-79 : Cross-site Scripting, CWE-89 : SQL Injection"),
+ * falling back to the CVE id when no weakness is recorded.
  */
 function execWeakness(m) {
 	const cwes = Array.isArray(m.cve.cwes) ? m.cve.cwes : [];
-	const primary = cwes.find(c => cweName(c)) || cwes[0];
-	if (primary) {
-		const label = cweName(primary);
-		return label ? `${primary} : ${label}` : primary;
+	if (cwes.length) {
+		return cwes.map(c => { const label = cweName(c); return label ? `${c} : ${label}` : c; }).join(", ");
 	}
 	return m.cve.id || "an unspecified weakness";
 }
 
-function renderExecutiveSummary({ projectInfo, prodStats, devStats, retireStats, eolResults, obsoleteResults, outdatedResults, warnings, totalDeps, topCriticalMatches, interactive = false }) {
+function renderExecutiveSummary({ projectInfo, prodStats, devStats, retireStats, eolResults, obsoleteResults, outdatedResults, warnings, totalDeps, topCriticalMatches, nativeBinaryCount = 0, interactive = false }) {
 	const eolN = eolResults?.length || 0;
 	const obsN = obsoleteResults?.length || 0;
 	const outN = outdatedResults?.length || 0;
@@ -1222,77 +1247,102 @@ function renderExecutiveSummary({ projectInfo, prodStats, devStats, retireStats,
 	else if (prodStats.low > 0 || retireStats.low > 0 || outN > 0) level = "LOW";
 	else if (prodStats.total > 0) level = "UNKNOWN";
 
-	const bullets = [];
-	if (prodStats.total) bullets.push(`<strong>${prodStats.total}</strong> CVE in production deps (critical=${prodStats.critical}, high=${prodStats.high}, medium=${prodStats.medium}, low=${prodStats.low})`);
-	if (devStats.total)  bullets.push(`<strong>${devStats.total}</strong> CVE in dev/test deps`);
-	if (retireStats.total) bullets.push(`<strong>${retireStats.total}</strong> vulnerable vendored JS finding(s) (retire.js)`);
-	if (eolN) bullets.push(`<strong>${eolN}</strong> end-of-life framework${eolN > 1 ? "s" : ""}`);
-	if (obsN) bullets.push(`<strong>${obsN}</strong> obsolete / deprecated lib${obsN > 1 ? "s" : ""}`);
-	if (outN) bullets.push(`<strong>${outN}</strong> outdated lib${outN > 1 ? "s" : ""}`);
-	if (warnings?.length) bullets.push(`<strong>${warnings.length}</strong> scan-completeness alert${warnings.length > 1 ? "s" : ""} — see chapter 0`);
-
-	const topPreview = (topCriticalMatches || []).length ? `<div class="exec-top">
-		<div class="exec-top-title">Top ${topCriticalMatches.length} most critical (preview)</div>
-		<ul class="exec-top-list">${topCriticalMatches.map(m => {
-			// First known-CWE on the match gets surfaced in the summary so the
-			// reader has a one-line answer to "what kind of weakness is this?"
+	const top = topCriticalMatches || [];
+	const topEol = pickTopEol(eolResults, 2);
+
+	const cweChipHtml = (id, name) => `<span class="exec-cwe" title="${esc(id)}${name ? ": " + esc(name) : ""}"><span class="exec-cwe-id">${esc(id)}</span>${name ? `<span class="exec-cwe-name">${esc(name)}</span>` : ""}</span>`;
+
+	// ---- Block 1: the 3 most critical (direct prod, transitive fallback) ----
+	// Each row lists ALL of its CWEs right beside it (the weakness fingerprint
+	// of that specific finding) — NOT a separate report-wide CWE aggregate.
+	const topBlock = top.length ? `<div class="exec-top">
+		<div class="exec-top-title">Top ${top.length} most critical · direct production dependencies</div>
+		<ul class="exec-top-list">${top.map(m => {
 			const cwes = Array.isArray(m.cve.cwes) ? m.cve.cwes : [];
-			const primary = cwes.find(c => cweName(c)) || cwes[0];
-			const primaryName = primary ? cweName(primary) : "";
-			const cweChip = primary ? `<span class="exec-cwe" title="${esc(primary)}${primaryName ? ": " + esc(primaryName) : ""}"><span class="exec-cwe-id">${esc(primary)}</span>${primaryName ? `<span class="exec-cwe-name">${esc(primaryName)}</span>` : ""}</span>` : "";
+			const cweChips = cwes.length ? `<span class="exec-cwes-chips">${cwes.map(c => cweChipHtml(c, cweName(c))).join("")}</span>` : "";
+			const transitiveTag = m.dep?.scope === "transitive"
+				? `<span class="exec-scope-tag" title="Pulled in transitively — fewer than ${top.length} direct production findings, so the worst transitive ones fill the rest">transitive</span>` : "";
 			return `<li>
 				${badge((m.cve.severity || "HIGH").toUpperCase())}
 				<a class="exec-cve-link" href="#ch${m.dep?.scope === "vendored" ? "2" : "1"}">${esc(m.cve.id)}</a>
 				<code>${esc(depDisplayName(m.dep))}</code>
 				<span class="exec-ver">${esc(m.dep.version || "?")}</span>
 				${m.cve.fixVersion ? `<span class="exec-fix">→ ${esc(m.cve.fixVersion)}</span>` : ""}
-				${cweChip}
+				${cweChips}
+				${transitiveTag}
 			</li>`;
 		}).join("")}</ul>
 	</div>` : "";
 
+	// ---- Block 2: the 2 most-overdue end-of-life frameworks ----
+	const eolWhen = e => (e.eol && e.eol !== "true" ? `EOL since ${esc(e.eol)}` : "end-of-life");
+	const eolBlock = topEol.length ? `<div class="exec-eol">
+		<div class="exec-eol-title">${topEol.length === 1 ? "Top end-of-life framework" : `Top ${topEol.length} end-of-life frameworks`}</div>
+		<ul class="exec-eol-list">${topEol.map(e => `<li>
+				<a class="exec-cve-link" href="#ch4">${esc(e.product || e.productSlug || "")}${e.cycle ? " " + esc(e.cycle) : ""}</a>
+				<code>${esc(depDisplayName(e.dep))}</code>
+				<span class="exec-ver">${eolWhen(e)}</span>
+				${e.latest ? `<span class="exec-fix">→ latest ${esc(e.latest)}</span>` : ""}
+			</li>`).join("")}</ul>
+	</div>` : "";
+
+	// ---- Block 3: a very short summary of everything else ----
+	const restParts = [];
+	if (prodStats.total) restParts.push(`<strong>${prodStats.total}</strong> production CVE (critical=${prodStats.critical}, high=${prodStats.high}, medium=${prodStats.medium}, low=${prodStats.low})`);
+	if (devStats.total)  restParts.push(`<strong>${devStats.total}</strong> dev/test CVE`);
+	if (retireStats.total) restParts.push(`<strong>${retireStats.total}</strong> vulnerable vendored-JS`);
+	if (eolN) restParts.push(`<strong>${eolN}</strong> EOL framework${eolN > 1 ? "s" : ""}`);
+	if (obsN) restParts.push(`<strong>${obsN}</strong> obsolete`);
+	if (outN) restParts.push(`<strong>${outN}</strong> outdated`);
+	if (nativeBinaryCount) restParts.push(`<strong>${nativeBinaryCount}</strong> unmanaged native binar${nativeBinaryCount > 1 ? "ies" : "y"}`);
+	if (warnings?.length) restParts.push(`<strong>${warnings.length}</strong> scan alert${warnings.length > 1 ? "s" : ""}`);
+	const restBlock = `<div class="exec-rest"><span class="exec-rest-label">Everything else:</span> ${restParts.length ? restParts.join(" · ") : "no other findings"}</div>`;
+
 	// ---- Word-pasteable copy payload (built only for the interactive HTML) ----
 	let copyUi = "";
 	if (interactive) {
 		const stripTags = s => s.replace(/<[^>]+>/g, "");
-		const plainBullets = bullets.map(stripTags);
-		const top = topCriticalMatches || [];
 		const topSentences = top.map(m => ({
 			lib: depDisplayName(m.dep),
 			ver: m.dep.version || "?",
 			weakness: execWeakness(m),
 			crit: (m.cve.severity || "HIGH").toUpperCase(),
+			transitive: m.dep?.scope === "transitive",
 		}));
+		const eolSentence = e => {
+			const when = e.eol && e.eol !== "true" ? `end-of-life since ${e.eol}` : "end-of-life";
+			return `- "${e.product || e.productSlug || ""}${e.cycle ? " " + e.cycle : ""}" (${depDisplayName(e.dep)}) is ${when}${e.latest ? `; latest is ${e.latest}` : ""}`;
+		};
+		const restText = stripTags(restParts.join(" · ")) || "no other findings";
 
-		// Plain-text version (text/plain) — exact bullet format requested.
-		const plainLines = [];
-		plainLines.push(`EXECUTIVE SUMMARY — ${level}`);
-		plainLines.push(`${totalDeps} dependencies scanned`);
-		plainLines.push("");
-		if (plainBullets.length) for (const b of plainBullets) plainLines.push(`- ${b}`);
-		else plainLines.push("- No findings detected.");
+		// Plain-text (text/plain).
+		const plainLines = [`EXECUTIVE SUMMARY — ${level}`, `${totalDeps} dependencies scanned`];
 		if (topSentences.length) {
-			plainLines.push("");
-			plainLines.push(`Top ${topSentences.length} most critical:`);
-			for (const t of topSentences) {
-				plainLines.push(`- The library "${t.lib}" version "${t.ver}" is vulnerable to "${t.weakness}" ( ${t.crit} )`);
-			}
+			plainLines.push("", `Top ${topSentences.length} most critical (direct production dependencies):`);
+			for (const t of topSentences) plainLines.push(`- The library "${t.lib}" version "${t.ver}" is vulnerable to "${t.weakness}" ( ${t.crit} )${t.transitive ? " [transitive]" : ""}`);
 		}
+		if (topEol.length) {
+			plainLines.push("", `Top ${topEol.length} end-of-life framework${topEol.length > 1 ? "s" : ""}:`);
+			for (const e of topEol) plainLines.push(eolSentence(e));
+		}
+		plainLines.push("", `Everything else: ${restText}`);
 		const plainText = plainLines.join("\n");
 
-		// Rich version (text/html) — inline styles so Word keeps the formatting.
-		const richBullets = plainBullets.length
-			? `<ul style="margin:4px 0 0; padding-left:22px;">${plainBullets.map(b => `<li style="margin:2px 0;">${esc(b)}</li>`).join("")}</ul>`
-			: `<p style="margin:4px 0;">No findings detected.</p>`;
+		// Rich (text/html) — inline styles so Word keeps the formatting.
 		const richTop = topSentences.length
-			? `<p style="font-weight:bold; margin:12px 0 4px;">Top ${topSentences.length} most critical:</p>
+			? `<p style="font-weight:bold; margin:12px 0 4px;">Top ${topSentences.length} most critical (direct production dependencies):</p>
 			<ul style="margin:0; padding-left:22px;">${topSentences.map(t =>
-				`<li style="margin:3px 0;">The library "<b>${esc(t.lib)}</b>" version "<b>${esc(t.ver)}</b>" is vulnerable to "<b>${esc(t.weakness)}</b>" ( ${esc(t.crit)} )</li>`).join("")}</ul>`
+				`<li style="margin:3px 0;">The library "<b>${esc(t.lib)}</b>" version "<b>${esc(t.ver)}</b>" is vulnerable to "<b>${esc(t.weakness)}</b>" ( ${esc(t.crit)} )${t.transitive ? ` <i>[transitive]</i>` : ""}</li>`).join("")}</ul>`
+			: "";
+		const richEol = topEol.length
+			? `<p style="font-weight:bold; margin:12px 0 4px;">Top ${topEol.length} end-of-life framework${topEol.length > 1 ? "s" : ""}:</p>
+			<ul style="margin:0; padding-left:22px;">${topEol.map(e => `<li style="margin:3px 0;">${esc(stripTags(eolSentence(e)).replace(/^- /, ""))}</li>`).join("")}</ul>`
 			: "";
+		const richRest = `<p style="margin:12px 0 0;"><b>Everything else:</b> ${esc(restText)}</p>`;
 		const richHtml = `<div style="font-family:Calibri,Arial,sans-serif; font-size:11pt; color:#1f2937;">`
 			+ `<p style="font-size:14pt; font-weight:bold; margin:0 0 2px;">Executive Summary — ${esc(level)}</p>`
 			+ `<p style="margin:0 0 8px; color:#4b5563;">${esc(totalDeps)} dependencies scanned</p>`
-			+ richBullets + richTop + `</div>`;
+			+ richTop + richEol + richRest + `</div>`;
 
 		copyUi = `<button class="btn-copy exec-copy-btn" type="button" title="Copy the executive summary — paste it into Word with formatting preserved">📋 Copy summary</button>`
 			+ `<template class="exec-copy-rich">${richHtml}</template>`
@@ -1306,10 +1356,9 @@ function renderExecutiveSummary({ projectInfo, prodStats, devStats, retireStats,
 			${copyUi}
 		</div>
 		<div class="exec-meta">${esc(totalDeps)} dependencies scanned</div>
-		<ul class="exec-bullets">
-			${bullets.map(b => `<li>${b}</li>`).join("") || `<li>No findings detected.</li>`}
-		</ul>
-		${topPreview}
+		${topBlock}
+		${eolBlock}
+		${restBlock}
 	</div>`;
 }
 
@@ -1439,11 +1488,16 @@ function buildBody({ cveMatches, devCveMatches, embeddedMatches, retireMatches,
 		<span class="toolbar-label">Click a section header or a CVE row to toggle.</span>
 	</div>`;
 
+	// Committed native binaries no package manager governs (provenance:"binary",
+	// no resolved version) — surfaced as a count in the exec summary's rest line.
+	const nativeBinaryCount = [...(resolvedDeps?.values?.() || [])].filter(d => d.provenance === "binary").length;
+
 	const exec = renderExecutiveSummary({
 		projectInfo, prodStats, devStats, retireStats,
 		eolResults, obsoleteResults, outdatedResults,
 		warnings, totalDeps: resolvedDeps?.size || 0,
-		topCriticalMatches: pickTopCriticalMatches(prodMatchesActive, retireMatches, 5),
+		topCriticalMatches: pickTopCriticalMatches(prodMatchesActive, 3),
+		nativeBinaryCount,
 		interactive: wrapTables, // copy button + scripts only in the HTML output
 	});
 
@@ -1466,6 +1520,9 @@ function buildBody({ cveMatches, devCveMatches, embeddedMatches, retireMatches,
 		fpTotal: prodMatchesFP.length + devMatchesFP.length + embMatchesFP.length,
 	});
 
+	// Overview charts row, rendered right under the compact totals.
+	const chartsRow = renderCharts({ prodMatches: prodMatchesActive }, { interactive: wrapTables });
+
 	const body = `
 		<header class="report-header">
 			<h1>FAD-Checker Report</h1>
@@ -1477,6 +1534,7 @@ function buildBody({ cveMatches, devCveMatches, embeddedMatches, retireMatches,
 		</header>
 		${exec}
 		${summaryCards(prodStats, eolResults, obsoleteResults, outdatedResults, { warnings, vendored: retireMatches.length, licenseFlagged })}
+		${chartsRow}
 		${toc}
 		${toolbar}
 
@@ -1497,30 +1555,38 @@ function buildBody({ cveMatches, devCveMatches, embeddedMatches, retireMatches,
 	return wrapTables ? wrapTablesWithCopyButtons(body) : body;
 }
 
+// Descending composite-priority comparator: KEV first, then the blended
+// CVSS+EPSS score, tie-broken on having an actionable fix, then CVE id.
+function byCvePriority(a, b) {
+	const pa = a.cve?.priority || computePriority(a.cve || {});
+	const pb = b.cve?.priority || computePriority(b.cve || {});
+	const ka = pa.sortKey || [0, 0], kb = pb.sortKey || [0, 0];
+	if (kb[0] !== ka[0]) return kb[0] - ka[0];
+	if (kb[1] !== ka[1]) return kb[1] - ka[1];
+	const af = a.cve?.fixVersion ? 1 : 0, bf = b.cve?.fixVersion ? 1 : 0;
+	if (bf !== af) return bf - af;
+	return String(a.cve?.id || "").localeCompare(String(b.cve?.id || ""));
+}
+
+function coordKeyOf(dep) {
+	return dep.coordKey || `${dep.ecosystem === "npm" ? "npm:" : (dep.groupId || "") + ":"}${dep.artifactId}`;
+}
+
 /**
- * Pick the most impactful matches to preview in the exec summary.
- * Sort by severity rank, prefer entries with a fix-version (more actionable),
- * dedupe per dep coord so the preview shows diversity instead of 5 rows of
- * the same tomcat CVE.
+ * Pick the N most critical matches for the exec summary, scoped to NON-DEV
+ * dependencies and biased to DIRECT (declared) deps: direct findings fill the
+ * slots first (ranked by composite priority); only if fewer than N direct
+ * findings exist do we top up with the worst TRANSITIVE ones (flagged as such
+ * downstream). Deduped per dep coord so the list shows distinct libraries.
  */
-function pickTopCriticalMatches(prodMatches, retireMatches, n) {
-	const rank = { CRITICAL: 4, HIGH: 3, MEDIUM: 2, LOW: 1, NONE: 0, UNKNOWN: 0 };
-	const all = [...prodMatches, ...retireMatches]
-		.filter(m => (rank[(m.cve?.severity || "").toUpperCase()] || 0) >= 3); // HIGH+
-	all.sort((a, b) => {
-		const sa = rank[(a.cve.severity || "").toUpperCase()] || 0;
-		const sb = rank[(b.cve.severity || "").toUpperCase()] || 0;
-		if (sb !== sa) return sb - sa;
-		// Prefer those with a known fixVersion (actionable)
-		const af = a.cve.fixVersion ? 1 : 0, bf = b.cve.fixVersion ? 1 : 0;
-		if (bf !== af) return bf - af;
-		return (a.cve.id || "").localeCompare(b.cve.id || "");
-	});
+function pickTopCriticalMatches(prodMatches, n) {
+	const isTransitive = m => m.dep?.scope === "transitive";
+	const direct = (prodMatches || []).filter(m => !isTransitive(m)).slice().sort(byCvePriority);
+	const transitive = (prodMatches || []).filter(isTransitive).slice().sort(byCvePriority);
 	const seen = new Set();
 	const out = [];
-	for (const m of all) {
-		const dep = m.dep;
-		const k = dep.coordKey || `${dep.ecosystem === "npm" ? "npm:" : dep.groupId + ":"}${dep.artifactId}`;
+	for (const m of [...direct, ...transitive]) {       // direct-first, transitive fallback
+		const k = coordKeyOf(m.dep);
 		if (seen.has(k)) continue;
 		seen.add(k);
 		out.push(m);
@@ -1529,6 +1595,25 @@ function pickTopCriticalMatches(prodMatches, retireMatches, n) {
 	return out;
 }
 
+/**
+ * The 2 (or N) most significant end-of-life findings for the exec summary:
+ * direct frameworks first, then the most overdue (oldest EOL date). Findings
+ * with no concrete EOL date (eol === "true") sort after dated ones.
+ */
+function pickTopEol(eolResults, n) {
+	const dateMs = e => {
+		if (!e || !e.eol || e.eol === "true") return Number.POSITIVE_INFINITY;
+		const t = Date.parse(e.eol);
+		return Number.isNaN(t) ? Number.POSITIVE_INFINITY : t;
+	};
+	const directRank = e => (e?.dep?.scope === "transitive" ? 1 : 0);
+	return (eolResults || []).slice().sort((a, b) => {
+		const da = directRank(a), db = directRank(b);
+		if (da !== db) return da - db;
+		return dateMs(a) - dateMs(b);
+	}).slice(0, n);
+}
+
 function renderToc({ hasWarnings, prodTotal, embeddedTotal, unmanagedTotal, vendoredJsTotal, retireTotal, devTotal, eolTotal, obsoleteTotal, outdatedTotal, licenseTotal, licenseFlagged, fpTotal }) {
 	const entries = [];
 	if (hasWarnings)                  entries.push({ id: "ch0", label: "0. Warnings" });
@@ -1774,9 +1859,11 @@ const COPY_SCRIPT = `
 		return writeClipboard(clone.outerHTML, tableToTsv(table), btn);
 	}
 	document.querySelectorAll('.btn-copy').forEach(function(btn){
-		// The executive-summary button is wired separately (it copies a prose
-		// summary, not a table).
+		// The executive-summary button and the chart buttons are wired separately
+		// (prose summary / SVG→PNG). Skipping them here also avoids the table
+		// handler's stopPropagation() swallowing the chart click.
 		if (btn.classList.contains('exec-copy-btn')) return;
+		if (btn.classList.contains('chart-copy')) return;
 		btn.addEventListener('click', function(e){
 			e.stopPropagation();
 			var wrap = btn.closest('.table-wrap');
@@ -1849,10 +1936,86 @@ const TOGGLE_SCRIPT = `
 })();
 </script>`;
 
+// Chart copy: rasterise the clicked card's <svg> to PNG (SVG → Image → canvas →
+// toBlob) and put image/png on the clipboard so it pastes into Word as a picture.
+// A white background is painted first (Word has no page background) and the canvas
+// is scaled ×3 for a crisp paste. Falls back to copying the SVG markup as rich
+// HTML when the browser lacks image-clipboard support.
+const CHART_COPY_SCRIPT = `
+<script>
+(function(){
+	function flash(btn, ok){
+		if(!btn) return;
+		var t = btn.textContent;
+		btn.classList.add(ok ? 'flashing-ok' : 'flashing-err');
+		btn.textContent = ok ? '✓' : '✕';
+		setTimeout(function(){ btn.classList.remove('flashing-ok','flashing-err'); btn.textContent = t; }, 1100);
+	}
+	function fallbackHtml(svg, btn){
+		try {
+			var xml = new XMLSerializer().serializeToString(svg);
+			var item = new ClipboardItem({'text/html': new Blob([xml], {type:'text/html'})});
+			navigator.clipboard.write([item]).then(function(){ flash(btn,true); }).catch(function(){ flash(btn,false); });
+		} catch(e){ flash(btn,false); }
+	}
+	function roundRectPath(ctx, x, y, w, h, r){
+		if (ctx.roundRect){ ctx.beginPath(); ctx.roundRect(x, y, w, h, r); return; }
+		ctx.beginPath();
+		ctx.moveTo(x+r, y);
+		ctx.arcTo(x+w, y, x+w, y+h, r);
+		ctx.arcTo(x+w, y+h, x, y+h, r);
+		ctx.arcTo(x, y+h, x, y, r);
+		ctx.arcTo(x, y, x+w, y, r);
+		ctx.closePath();
+	}
+	function svgToPng(svg, ok, err){
+		try {
+			var xml = new XMLSerializer().serializeToString(svg);
+			var vb = svg.viewBox && svg.viewBox.baseVal;
+			var w = (vb && vb.width) || svg.clientWidth || 250;
+			var h = (vb && vb.height) || svg.clientHeight || 150;
+			var img = new Image();
+			img.onload = function(){
+				// Draw the chart inside a rounded white card with an outer margin,
+				// inner padding and a light border — so the pasted PNG matches the
+				// on-screen card instead of being a flush, square-cornered image.
+				var scale = 3, M = 8, P = 12, RAD = 8;
+				var cw = w + 2*P + 2*M, ch = h + 2*P + 2*M;
+				var c = document.createElement('canvas');
+				c.width = Math.round(cw*scale); c.height = Math.round(ch*scale);
+				var ctx = c.getContext('2d');
+				ctx.setTransform(scale,0,0,scale,0,0);          // transparent margin (corners show through)
+				roundRectPath(ctx, M, M, w + 2*P, h + 2*P, RAD);
+				ctx.fillStyle = '#ffffff'; ctx.fill();
+				ctx.lineWidth = 1; ctx.strokeStyle = '#e5e7eb'; ctx.stroke();
+				ctx.drawImage(img, M+P, M+P, w, h);
+				c.toBlob(function(blob){ blob ? ok(blob) : err(); }, 'image/png');
+			};
+			img.onerror = err;
+			img.src = 'data:image/svg+xml;charset=utf-8,' + encodeURIComponent(xml);
+		} catch(e){ err(); }
+	}
+	document.addEventListener('click', function(ev){
+		var btn = ev.target.closest && ev.target.closest('.chart-copy');
+		if(!btn) return;
+		var card = btn.closest('.chart-card');
+		var svg = card && card.querySelector('svg.chart-svg');
+		if(!svg) return;
+		svgToPng(svg, function(blob){
+			if(navigator.clipboard && window.ClipboardItem){
+				navigator.clipboard.write([new ClipboardItem({'image/png': blob})])
+					.then(function(){ flash(btn,true); })
+					.catch(function(){ fallbackHtml(svg, btn); });
+			} else { fallbackHtml(svg, btn); }
+		}, function(){ fallbackHtml(svg, btn); });
+	});
+})();
+</script>`;
+
 function generateHtmlReport(payload) {
 	return `<!doctype html>
 <html><head><meta charset="utf-8"><title>FAD-Checker Report</title><style>${CSS}</style></head>
-<body>${buildBody(payload)}${TOGGLE_SCRIPT}${COPY_SCRIPT}</body></html>`;
+<body>${buildBody(payload)}${TOGGLE_SCRIPT}${COPY_SCRIPT}${CHART_COPY_SCRIPT}</body></html>`;
 }
 
 // Word-specific CSS tweaks layered on top of the shared CSS:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fad-checker",
-  "version": "2.2.3",
+  "version": "2.2.4",
   "description": "Scan ALL Maven, npm, Yarn, Composer, Python, C#/.NET, Go & Ruby dependencies — plus embedded JARs (fat-jars/war/ear) — in a source tree ONE SHOT without mvn/python/etc — CVE (EPSS/KEV-prioritised), EOL, obsolete, outdated & licenses, with SBOM/CSAF/SARIF/JSON exports, CI gating and fix recos",
   "keywords": [
     "sca",