fad-checker 2.2.3 → 2.3.0

package/fad-checker.js

@@ -229,7 +229,7 @@ program
 	.option("--export-cache <file>", "tar.gz/zip the ~/.fad-checker/ caches to <file> (excludes config.json by default)")
 	.option("--import-cache <file>", "restore ~/.fad-checker/ from a previously exported archive (existing dir is moved to .bak unless --force)")
 	.option("--include-config", "with --export-cache: also bundle config.json (contains the NVD API key)")
-	.option("--export-anonymized <file>", "offline: write an anonymized dependency descriptor (public coordinates only, no paths/URLs) for PASSI audits, then exit")
+	.option("--export-anonymized <file>", "offline: write an anonymized dependency descriptor (public coordinates only, no paths/URLs) for air-gapped audits, then exit")
 	.option("--import-anonymized <file>", "online: scan an anonymized descriptor (no --src) to warm the caches; pair with --export-cache for offline reporting")
 	.option("--force", "with --import-cache: replace ~/.fad-checker/ without backup")
 	.option("--report-output <dir>", "report output directory", "./fad-checker-report")
@@ -246,6 +246,7 @@ program
 	.option("--transitive-depth <n>", "max transitive depth", "6")
 	.option("--ecosystem <list>", "codecs to run: auto|all|<comma list> e.g. maven,npm,nuget,composer,pypi,go,ruby (default: auto = detected)", "auto")
 	.option("--no-maven", "skip the Maven codec")
+	.option("--no-gradle", "skip the Gradle codec")
 	.option("--no-npm", "skip the npm codec")
 	.option("--no-yarn", "skip the Yarn codec")
 	.option("--no-nuget", "skip the NuGet (C#/.NET) codec")
@@ -451,10 +452,10 @@ async function timedPhase(label, fn) {
 	].filter(Boolean))];
 	const defaultExcludes = options.defaultExcludes !== false;
 	const walkOpts = { excludePath, defaultExcludes };
-	// PASSI phase 1 (--export-anonymized) is a purely local operation — parse the tree,
+	// Anonymized export (phase 1, --export-anonymized) is a purely local operation — parse the tree,
 	// emit public coordinates, exit. Force offline so no source ever touches the network.
 	if (options.exportAnonymized) options.offline = true;
-	const runMode = options.exportAnonymized ? "offline (PASSI phase 1 · export descriptor)"
+	const runMode = options.exportAnonymized ? "offline (anonymized export · phase 1)"
 		: options.importAnonymized ? "import descriptor"
 		: (options.offline ? "offline" : "online");
 	if (options.src) ui.kv("source", chalk.white(options.src));
@@ -467,7 +468,7 @@ async function timedPhase(label, fn) {
 
 	let wrotePom = 0;
 
-	// --- PASSI phase 2: import an anonymized descriptor instead of collecting ---
+	// --- Anonymized phase 2: import a descriptor instead of collecting ---
 	// Scans the descriptor's public coordinates online to WARM the coordinate-keyed
 	// caches (OSV/NVD/CVE/registry/EOL) + retire signatures. Pair with --export-cache.
 	if (options.importAnonymized) {
@@ -488,6 +489,12 @@ async function timedPhase(label, fn) {
 			const { warmRetireSignatures } = require("./lib/retire");
 			await warmRetireSignatures({ verbose });
 		}
+		// --import-anonymized is a cache-WARMING step (pair with --export-cache), not a
+		// reporting one: the path-bearing report is produced later, offline, from the warmed
+		// cache against the real source tree. So suppress the default HTML+doc output here
+		// (still honor an explicit --report-<type> if a user really wants a path-free one).
+		const anyReportRequested = [options.reportHtml, options.reportDoc, options.reportSbom, options.reportCsaf, options.reportJson, options.reportSarif].some(v => v !== undefined);
+		if (!anyReportRequested) options.report = false;
 		await runReportFlow(resolved, { activeIds, runMaven, runNpm, privateLibIds: [], mavenRepos, regMap, collectWarnings: [] });
 		return;
 	}
@@ -503,11 +510,12 @@ async function timedPhase(label, fn) {
 	// project), and detectCodecs' manifest-glob matcher misses versioned sonames
 	// (libz.so.1). Always make it a candidate in auto mode; --no-binaries removes it.
 	if (eco === "auto" && !detected.includes("binary")) detected.push("binary");
-	const noCodecs = ["maven", "npm", "yarn", "nuget", "composer", "pypi", "go", "ruby"].filter(id => options[id] === false);
+	const noCodecs = ["maven", "gradle", "npm", "yarn", "nuget", "composer", "pypi", "go", "ruby"].filter(id => options[id] === false);
 	// `--no-binaries` maps to options.binaries (plural) but the codec id is `binary`.
 	if (options.binaries === false) noCodecs.push("binary");
 	const activeIds = resolveActiveCodecs(eco, detected, { noCodecs, noJs: !options.js });
 	const runMaven = activeIds.includes("maven");
+	const runGradle = activeIds.includes("gradle");
 	const runNpm = activeIds.includes("npm") || activeIds.includes("yarn");
 
 	// --- Collect deps from every active codec into one Map (coordKeys never collide) ---
@@ -516,7 +524,13 @@ async function timedPhase(label, fn) {
 	ui.section("Collection");
 	const resolved = new Map();
 	let mavenCtx = null;
+	let gradleCtx = null;
 	const collectWarnings = [];
+	// Every descriptor file each codec actually parsed (tagged with its ecosystemType =
+	// codec id), so the report's "Scanned dependency descriptors" appendix is a COMPLETE
+	// inventory — including files parsed that contributed no scannable dep (ranges-only /
+	// no lockfile), which would otherwise be invisible.
+	const parsedManifests = [];
 	for (const id of activeIds) {
 		if (id === "yarn") continue;   // the npm codec already collects yarn.lock
 		const codec = getCodec(id);
@@ -529,7 +543,9 @@ async function timedPhase(label, fn) {
 		}
 		for (const [k, v] of res.deps) resolved.set(k, v);
 		if (res.warnings?.length) collectWarnings.push(...res.warnings);
+		for (const p of (res.parsedManifests || [])) parsedManifests.push({ path: p, ecosystemType: id });
 		if (id === "maven") mavenCtx = res._maven;
+		if (id === "gradle") gradleCtx = res._gradle;
 	}
 
 	// --- Collection summary ---
@@ -539,12 +555,15 @@ async function timedPhase(label, fn) {
 	for (const d of resolved.values()) {
 		if (d.provenance === "embedded") { embeddedCount++; continue; } // counted separately below
 		if (d.provenance === "binary") { binaryCount++; continue; }     // committed native libs, no manifest
-		ecoCount[d.ecosystem] = (ecoCount[d.ecosystem] || 0) + 1;
+		// Key by ecosystemType so Gradle (ecosystem "maven") gets its own line/label.
+		const ecoKey = d.ecosystemType || d.ecosystem;
+		ecoCount[ecoKey] = (ecoCount[ecoKey] || 0) + 1;
 	}
 	if (runMaven) ui.ok(`${chalk.bold("Maven".padEnd(8))} ${mavenCtx ? mavenCtx.pomFiles.length + " module(s) · " : ""}${ecoCount.maven || 0} direct dep(s)`);
+	if (runGradle) ui.ok(`${chalk.bold("Gradle".padEnd(8))} ${ecoCount.gradle || 0} direct dep(s)`);
 	if (runNpm)   ui.ok(`${chalk.bold("npm/yarn".padEnd(8))} ${ecoCount.npm || 0} dep(s)`);
 	for (const [id, n] of Object.entries(ecoCount)) {
-		if (id === "maven" || id === "npm") continue;
+		if (id === "maven" || id === "gradle" || id === "npm") continue;
 		ui.ok(`${chalk.bold(((getCodec(id)?.label) || id).padEnd(8))} ${n} dep(s)`);
 	}
 	if (embeddedCount) ui.ok(`${chalk.bold("Embedded".padEnd(8))} ${embeddedCount} coord(s) in .jar/.war/.ear`);
@@ -556,7 +575,7 @@ async function timedPhase(label, fn) {
 		if (collectWarnings.length > 5) ui.info(chalk.dim(`…and ${collectWarnings.length - 5} more`));
 	}
 
-	// --- PASSI phase 1: export an anonymized descriptor and exit (no network, no report) ---
+	// --- Anonymized phase 1: export a descriptor and exit (no network, no report) ---
 	if (options.exportAnonymized) {
 		const { serializeDeps } = require("./lib/deps-descriptor");
 		const pkgVersion = require("./package.json").version;
@@ -697,7 +716,7 @@ async function timedPhase(label, fn) {
 	// The scan always runs — it feeds the terminal summary, the file outputs and the
 	// CI gate. Which files get written is decided by the --report-* family inside
 	// (HTML + .doc by default; --no-report writes nothing).
-	await runReportFlow(resolved, { activeIds, runMaven, runNpm, privateLibIds, mavenRepos, regMap, collectWarnings, mavenPropsByPom: mavenCtx?.propsByPom, mavenStore: mavenCtx?.store });
+	await runReportFlow(resolved, { activeIds, runMaven, runGradle, runNpm, privateLibIds, mavenRepos, regMap, collectWarnings, mavenPropsByPom: mavenCtx?.propsByPom, mavenStore: mavenCtx?.store, gradlePlatformBoms: gradleCtx?.platformBoms || [], parsedManifests });
 	if (!readOnly) {
 		ui.section("Next step");
 		ui.info(`run Snyk on the cleaned tree:`);
@@ -706,7 +725,7 @@ async function timedPhase(label, fn) {
 })();
 
 async function runReportFlow(resolved, ecoFlags = {}) {
-	const { activeIds = [], runMaven = true, runNpm = false, privateLibIds = [], mavenRepos = [], regMap = {}, collectWarnings = [], mavenPropsByPom = null, mavenStore = null } = ecoFlags;
+	const { activeIds = [], runMaven = true, runGradle = false, runNpm = false, privateLibIds = [], mavenRepos = [], regMap = {}, collectWarnings = [], mavenPropsByPom = null, mavenStore = null, gradlePlatformBoms = [], parsedManifests = [] } = ecoFlags;
 	const registriesFor = eco => regMap[eco] || [];
 	const { expandWithTransitives } = require("./lib/cve-match");
 	const { writeReports, computeStats } = require("./lib/cve-report");
@@ -736,11 +755,14 @@ async function runReportFlow(resolved, ecoFlags = {}) {
 	}
 
 	// Decide which update steps will run (from flags) so the [n/N] counter is accurate.
-	const cveScanner = runMaven ? (getCodec("maven").nativeScanners || []).find(s => s.kind === "cve") : null;
+	// Gradle deps are Maven coordinates (ecosystem "maven"), so the Maven CVE-index scanner
+	// and the Maven-Central transitive/BOM/outdated/EOL passes cover them — they're EXCLUDED
+	// from the per-codec registry loop below to avoid double-processing.
+	const cveScanner = (runMaven || runGradle) ? (getCodec("maven").nativeScanners || []).find(s => s.kind === "cve") : null;
 	const cveIndexExists = fs.existsSync(require("./lib/cve-download").CVE_INDEX_PATH);
-	const otherRegistryIds = activeIds.filter(id => id !== "maven" && id !== "npm" && id !== "yarn" && getCodec(id)?.checkRegistry);
+	const otherRegistryIds = activeIds.filter(id => id !== "maven" && id !== "gradle" && id !== "npm" && id !== "yarn" && getCodec(id)?.checkRegistry);
 	const willCve = !!cveScanner && (!(options.cveOffline || offline) || cveIndexExists);
-	const willTransitive = !!(options.transitive && runMaven);
+	const willTransitive = !!(options.transitive && (runMaven || runGradle));
 	// Per-module version mediation overlay: recover transitive versions the global
 	// transitive pass masks via cross-module depMgmt bleed. Runs after (and only when)
 	// the global pass runs, and needs the parsed store + per-module props.
@@ -751,11 +773,18 @@ async function runReportFlow(resolved, ecoFlags = {}) {
 	// never the network — same as transitive resolution).
 	const importBoms = (runMaven && mavenPropsByPom)
 		? require("./lib/maven-bom").collectImportBoms(mavenPropsByPom) : [];
-	const willBom = importBoms.length > 0;
+	// Gradle `platform(...)` BOMs are the same as Maven `<scope>import</scope>` BOMs — feed
+	// them through the same managed-version backfill (e.g. spring-boot-dependencies → all the
+	// versionless spring-boot-starter-* declared in build.gradle get their version).
+	const gradleBoms = (gradlePlatformBoms || [])
+		.map(b => ({ groupId: b.group, artifactId: b.name, version: b.version }))
+		.filter(b => b.groupId && b.artifactId && b.version);
+	const allBoms = importBoms.concat(gradleBoms);
+	const willBom = allBoms.length > 0;
 	const willOsv = !!options.osv;
 	// Local OSV DB import (Maven): offline-complete OSV recall, independent of the per-dep
 	// OSV.dev cache. Opt-in (downloads ~9 MB once); then matches online or offline.
-	const willOsvDb = !!options.osvDb && runMaven;
+	const willOsvDb = !!options.osvDb && (runMaven || runGradle);
 	const willOutdated = !!options.allLibs;
 	const willNvd = !!options.nvd;
 	const willEpss = !!options.epss;
@@ -772,9 +801,10 @@ async function runReportFlow(resolved, ecoFlags = {}) {
 	if (willBom) {
 		const st = progress.start("BOM version resolution (Maven Central)");
 		try {
-			const { resolveAndBackfill } = require("./lib/maven-bom");
-			const r = await resolveAndBackfill(mavenPropsByPom, resolved, { repos: mavenRepos, offline, verbose });
-			st.done(`${r.filled} dep version(s) from ${r.boms} import BOM(s)`);
+			const { resolveBomManagedVersions, backfillVersions } = require("./lib/maven-bom");
+			const mgmt = await resolveBomManagedVersions(allBoms, { repos: mavenRepos, offline, verbose });
+			const filled = backfillVersions(resolved, mgmt);
+			st.done(`${filled} dep version(s) from ${allBoms.length} import BOM(s)`);
 		} catch (err) { st.fail(err.message); }
 	}
 
@@ -811,7 +841,7 @@ async function runReportFlow(resolved, ecoFlags = {}) {
 	// Scan-completeness signals — computed NOW (after BOM backfill) so only the deps
 	// still without a concrete version (external BOM truly unreachable, or offline)
 	// are flagged, not the ones we just resolved from spring-boot-dependencies & co.
-	if (runMaven) {
+	if (runMaven || runGradle) {
 		const { detectScanCompletenessWarnings } = require("./lib/scan-completeness");
 		scanWarnings = detectScanCompletenessWarnings(resolved, { ranSnyk: !!options.snyk, ranTransitive: !!options.transitive });
 	}
@@ -903,6 +933,11 @@ async function runReportFlow(resolved, ecoFlags = {}) {
 		const k = `${r.dep.groupId}:${r.dep.artifactId}`;
 		return !eolKeys.has(k) && !obsKeys.has(k);
 	});
+	// Outdated is a maintenance signal for deps you actually declare and can bump. An
+	// INDIRECT (transitive) dep's "latest" isn't directly actionable — you'd bump the parent
+	// — so drop transitives from the Outdated chapter (EOL/obsolete keep them: security).
+	// scope==="transitive" is the marker set by the Maven/Gradle resolver and the npm parser.
+	outdatedResults = outdatedResults.filter(r => r.dep.scope !== "transitive");
 
 	// 4b. OSV.dev — Maven-native CVE+GHSA feed (huge recall win over raw CVEProject)
 	if (willOsv) {
@@ -1192,7 +1227,7 @@ async function runReportFlow(resolved, ecoFlags = {}) {
 	let licenseResults = null;
 	if (willLicenses) {
 		try {
-			if (runMaven) {
+			if (runMaven || runGradle) {
 				const { collectMavenLicenses } = require("./lib/maven-license");
 				licenseFindings = licenseFindings.concat(collectMavenLicenses(resolved));
 			}
@@ -1265,7 +1300,7 @@ async function runReportFlow(resolved, ecoFlags = {}) {
 		const { htmlPath, docPath } = await writeReports({
 			cveMatches: prodMatches, devCveMatches: devMatches, embeddedMatches, retireMatches, vendoredJsInventory,
 			eolResults, obsoleteResults, outdatedResults, licenseResults,
-			resolvedDeps: resolved, projectInfo, warnings: reportWarnings,
+			resolvedDeps: resolved, projectInfo, warnings: reportWarnings, parsedManifests,
 			htmlPath: out.html, docPath: out.doc,
 		});
 		if (htmlPath) wrote.push(["HTML report", htmlPath]);
@@ -1311,7 +1346,9 @@ async function runReportFlow(resolved, ecoFlags = {}) {
 		ui.section("Output");
 		for (const [label, p] of wrote) ui.ok(`${label} → ${chalk.white(p)}`);
 	} else if (options.report === false) {
-		ui.info(chalk.dim("--no-report: no files written (scan + gate only)"));
+		ui.info(chalk.dim(options.importAnonymized
+			? "import-anonymized: caches warmed, no report written (pair with --export-cache, then report offline from the real source tree)"
+			: "--no-report: no files written (scan + gate only)"));
 	}
 	console.log();
 

package/lib/charts.js

@@ -0,0 +1,293 @@
+/**
+ * lib/charts.js — compact, dependency-free SVG charts for the HTML report's
+ * "Overview" row (rendered right under the summary totals).
+ *
+ * Why hand-rolled inline SVG (not <canvas>, not a chart lib, not pure-CSS):
+ *   - self-contained: the report ships zero external assets, and an SVG is just
+ *     markup — no runtime, no CDN. It even renders in the static .doc (no JS).
+ *   - copy-to-Word: each chart rasterises SVG→<canvas>→PNG entirely in the
+ *     browser (see the report's chart-copy script) and a PNG pastes into Word
+ *     perfectly. A <div> has no native "→ PNG" API; an SVG does.
+ *
+ * Every visual attribute is INLINE on the SVG elements (fill/font-size/…), never
+ * a CSS class — a class would not survive the canvas rasterisation (the document
+ * stylesheet is not applied to the serialised SVG).
+ *
+ * Charts: (1) CWE of DIRECT vulns — donut, sliced by CWE, coloured by that CWE's
+ * worst severity, legend carries the human CWE title; (2) vulnerable transitive
+ * sub-deps per (root) dependency — readable horizontal bars stacked by severity,
+ * with rootless transitives reported as a note rather than a bogus "unknown
+ * root" bar; (3) reported CVE/elements — donut; (4) fix-priority bands — donut.
+ *
+ * Pure: aggregators take match arrays + counts → plain data; renderers turn that
+ * into SVG strings. No I/O, no network.
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
+ */
+const { computePriority } = require("./priority");
+
+const CWE_NAMES = (() => {
+	try { const raw = { ...require("../data/cwe-names.json") }; delete raw._comment; return raw; }
+	catch { return {}; }
+})();
+const cweName = id => CWE_NAMES[String(id || "").toUpperCase()] || "";
+
+function esc(s) {
+	if (s == null) return "";
+	return String(s).replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+
+// Severity series (stacked bars) — colours mirror the report's severity badges.
+const SEV_SERIES = [
+	{ key: "critical", label: "Critical", color: "#7c0008" },
+	{ key: "high",     label: "High",     color: "#c92a2a" },
+	{ key: "medium",   label: "Medium",   color: "#f08c00" },
+	{ key: "low",      label: "Low",      color: "#3b82f6" },
+	{ key: "unknown",  label: "Unknown",  color: "#9ca3af" },
+];
+const SEV_COLOR = Object.fromEntries(SEV_SERIES.map(s => [s.key, s.color]));
+const SEV_RANK = { critical: 4, high: 3, medium: 2, low: 1, unknown: 0 };
+const sevKey = m => {
+	const s = (m && m.cve && m.cve.severity || "").toLowerCase();
+	return s in SEV_RANK ? s : "unknown";
+};
+const emptySeg = () => ({ critical: 0, high: 0, medium: 0, low: 0, unknown: 0 });
+const worstSev = seg => SEV_SERIES.map(s => s.key).find(k => seg[k] > 0) || "unknown";
+const coordKeyOf = dep => dep.coordKey || `${dep.ecosystem === "npm" ? "npm:" : (dep.groupId || "") + ":"}${dep.artifactId}`;
+
+// Keep the top-N rows; fold the remainder into a single "+K more" aggregate row
+// (a chart must never silently drop categories).
+function capRows(rows, topN, { stacked = false } = {}) {
+	if (rows.length <= topN) return rows;
+	const kept = rows.slice(0, topN);
+	const rest = rows.slice(topN);
+	if (stacked) {
+		const seg = emptySeg();
+		let total = 0;
+		for (const r of rest) { for (const k of Object.keys(seg)) seg[k] += r.segments[k] || 0; total += r.total; }
+		kept.push({ key: "__more__", label: `+${rest.length} more`, segments: seg, total, more: true });
+	} else {
+		const value = rest.reduce((a, r) => a + r.value, 0);
+		kept.push({ key: "__more__", label: `+${rest.length} more`, value, color: "#9ca3af", more: true });
+	}
+	return kept;
+}
+
+// ---------------------------------------------------------------- aggregators
+
+/** Chart 1 — CWE distribution of DIRECT production vulns, with per-severity counts. */
+function cweByCriticality(prodMatches, { topN = 7 } = {}) {
+	const map = new Map();
+	for (const m of prodMatches || []) {
+		if (m.dep && m.dep.scope === "transitive") continue;          // direct (declared) only
+		const cwes = Array.isArray(m.cve && m.cve.cwes) ? m.cve.cwes : [];
+		if (!cwes.length) continue;                                   // a "by CWE" chart only counts categorised findings
+		const sev = sevKey(m);
+		for (const c of cwes) {
+			const id = String(c || "").toUpperCase();
+			if (!id) continue;
+			if (!map.has(id)) map.set(id, emptySeg());
+			map.get(id)[sev]++;
+		}
+	}
+	const rows = [...map.entries()].map(([id, segments]) => ({
+		key: id,
+		label: id,
+		name: cweName(id),
+		segments,
+		total: SEV_SERIES.reduce((a, s) => a + segments[s.key], 0),
+	})).sort((a, b) => b.total - a.total || a.key.localeCompare(b.key));
+	return capRows(rows, topN, { stacked: true });
+}
+
+// Readable label for a root coordKey: the artifact / package name (the part a
+// human recognises), e.g. "org.spring.boot:spring-boot-starter-web" → "spring-boot-starter-web".
+function readableDepLabel(coordKey) {
+	const s = String(coordKey || "");
+	const seg = s.split("/").pop();                                   // npm "@scope/name" path tail
+	const tail = seg.includes(":") ? seg.slice(seg.indexOf(":") + 1) : seg;
+	return tail || s;
+}
+
+/** Chart 2 — sub-dep CVEs grouped by their ROOT (direct) dep, by severity.
+ *  Counts CVEs (a sub-dep with 3 CVEs contributes 3), each in its own bucket. */
+function vulnSubdepsByDep(prodMatches, { topN = 7 } = {}) {
+	const roots = new Map();                                          // rootKey -> segments
+	for (const m of prodMatches || []) {
+		if (!m.dep || m.dep.scope !== "transitive") continue;
+		const root = m.dep.via && m.dep.via[0];
+		if (!root) continue;                                          // rootless → unattributedSubdeps()
+		if (!roots.has(root)) roots.set(root, emptySeg());
+		roots.get(root)[sevKey(m)]++;                                 // one count per CVE, in its own severity
+	}
+	const rows = [...roots.entries()].map(([root, segments]) => ({
+		key: root,
+		label: readableDepLabel(root),
+		segments,
+		total: SEV_SERIES.reduce((a, s) => a + segments[s.key], 0),
+	})).filter(r => r.total > 0).sort((a, b) => b.total - a.total || a.key.localeCompare(b.key));
+	return capRows(rows, topN, { stacked: true });
+}
+
+/** Sub-dep CVEs on transitive deps with no resolved root (e.g. npm). */
+function unattributedSubdeps(prodMatches) {
+	let n = 0;
+	for (const m of prodMatches || []) {
+		if (!m.dep || m.dep.scope !== "transitive") continue;
+		if (m.dep.via && m.dep.via[0]) continue;
+		n++;
+	}
+	return n;
+}
+
+/** Chart 3 — where the risk lives: direct vs transitive production vulns, with
+ *  each side's per-severity breakdown carried in the legend (e.g. "2C 1H 1M"). */
+function directVsTransitive(prodMatches) {
+	const g = { direct: emptySeg(), transitive: emptySeg() };
+	for (const m of prodMatches || []) {
+		g[(m.dep && m.dep.scope === "transitive") ? "transitive" : "direct"][sevKey(m)]++;
+	}
+	const tot = seg => SEV_SERIES.reduce((a, s) => a + seg[s.key], 0);
+	const summary = seg => SEV_SERIES.filter(s => seg[s.key] > 0).map(s => `${seg[s.key]}${s.label[0]}`).join(" ");
+	const out = [];
+	if (tot(g.direct))     out.push({ key: "direct",     label: "Direct",     name: summary(g.direct),     value: tot(g.direct),     color: "#4338ca" });
+	if (tot(g.transitive)) out.push({ key: "transitive", label: "Transitive", name: summary(g.transitive), value: tot(g.transitive), color: "#d97706" });
+	return out;
+}
+
+const FIX_BANDS = [
+	{ key: "exploited", label: "Exploited", color: "#7c0008" },
+	{ key: "critical",  label: "Critical",  color: "#b91c1c" },
+	{ key: "high",      label: "High",      color: "#ea580c" },
+	{ key: "medium",    label: "Medium",    color: "#ca8a04" },
+	{ key: "low",       label: "Low",       color: "#2563eb" },
+];
+/** Chart 4 — fix-priority distribution (composite KEV/EPSS-weighted bands). */
+function fixPriority(prodMatches) {
+	const counts = { exploited: 0, critical: 0, high: 0, medium: 0, low: 0 };
+	for (const m of prodMatches || []) {
+		const p = (m.cve && m.cve.priority) || computePriority(m.cve || {});
+		if (counts[p.band] != null) counts[p.band]++;
+	}
+	return FIX_BANDS.map(b => ({ key: b.key, label: b.label, value: counts[b.key], color: b.color })).filter(r => r.value > 0);
+}
+
+// ------------------------------------------------------------------ renderers
+
+const FONT = "font-family='-apple-system,Segoe UI,Roboto,sans-serif'";
+
+const legendStr = s => s.name ? `${s.label} · ${s.name} · ${s.value}` : `${s.label} · ${s.value}`;
+const LEGEND_CHARW = 4.15;                          // ~px per char at the 7.5px legend font
+
+// The viewBox width needed to fit the FULL legend text (no ellipsis). The caller
+// takes the MAX across all four charts and feeds it to every donut, so they share
+// one viewBox width → uniform donut size when each card is the same 25% slot.
+function legendBoxWidth(slices, note) {
+	const items = (slices || []).filter(s => s.value > 0);
+	return Math.ceil(Math.max(0, ...items.map(s => 13 + legendStr(s).length * LEGEND_CHARW), note ? note.length * 4 : 0)) + 8;
+}
+
+// A donut + a legend underneath. slices: [{label, name?, value, color}].
+// The legend carries the human title (so the principal CWEs read in plain text).
+function donutChart({ slices, width = 250, note }) {
+	const items = (slices || []).filter(s => s.value > 0);
+	const total = items.reduce((a, s) => a + s.value, 0);
+	const legendTxt = legendStr;
+	const R = 47, cy = R + 4, cx = width / 2;
+	const parts = [];
+	if (items.length === 1) {
+		parts.push(`<circle cx="${cx}" cy="${cy}" r="${R}" fill="${items[0].color}"/>`);
+	} else {
+		let a0 = -Math.PI / 2;
+		for (const s of items) {
+			const a1 = a0 + (s.value / total) * 2 * Math.PI;
+			const x0 = cx + R * Math.cos(a0), y0 = cy + R * Math.sin(a0);
+			const x1 = cx + R * Math.cos(a1), y1 = cy + R * Math.sin(a1);
+			const large = (a1 - a0) > Math.PI ? 1 : 0;
+			const tip = s.name ? `${s.label} — ${s.name}: ${s.value}` : `${s.label}: ${s.value}`;
+			parts.push(`<path d="M${cx.toFixed(1)} ${cy.toFixed(1)} L${x0.toFixed(1)} ${y0.toFixed(1)} A${R} ${R} 0 ${large} 1 ${x1.toFixed(1)} ${y1.toFixed(1)} Z" fill="${s.color}" stroke="#ffffff" stroke-width="1"><title>${esc(tip)}</title></path>`);
+			a0 = a1;
+		}
+	}
+	parts.push(`<circle cx="${cx}" cy="${cy}" r="${(R * 0.58).toFixed(1)}" fill="#ffffff"/>`);
+	parts.push(`<text x="${cx}" y="${cy + 5}" text-anchor="middle" ${FONT} font-size="17" font-weight="700" fill="#374151">${total}</text>`);
+	let ly = R * 2 + 23;                             // +10px breathing room donut → legend
+	for (const s of items) {                         // full legend text — no ellipsis
+		parts.push(`<rect x="0" y="${ly - 7}" width="8" height="8" rx="1" fill="${s.color}"/>`);
+		parts.push(`<text x="11" y="${ly}" ${FONT} font-size="7.5" fill="#4b5563">${esc(legendTxt(s))}</text>`);
+		ly += 11;
+	}
+	if (note) { parts.push(`<text x="0" y="${ly}" ${FONT} font-size="7" font-style="italic" fill="#9ca3af">${esc(note)}</text>`); ly += 11; }
+	return { body: parts.join(""), width, height: ly + 2 };
+}
+
+function chartCard({ id, title, body, width, height, interactive }) {
+	// The title lives INSIDE the svg (so it travels with the copied PNG); the body
+	// is shifted down to make room. The copy button is an HTML overlay (top-right).
+	const titleH = 18;
+	const h = Math.max(1, Math.round(height + titleH));
+	const titleSvg = `<text x="0" y="12" ${FONT} font-size="10.5" font-weight="700" fill="#4b5563">${esc(title)}</text>`;
+	const svg = `<svg class="chart-svg" xmlns="http://www.w3.org/2000/svg" width="${width}" height="${h}" viewBox="0 0 ${width} ${h}" role="img" aria-label="${esc(title)}"><rect x="0" y="0" width="${width}" height="${h}" fill="#ffffff"/>${titleSvg}<g transform="translate(0,${titleH})">${body}</g></svg>`;
+	const copyBtn = interactive ? `<button class="btn-copy chart-copy" type="button" title="Copy this chart as a PNG — paste it into Word">📋</button>` : "";
+	return `<figure class="chart-card" id="${esc(id)}">${copyBtn}${svg}</figure>`;
+}
+
+function emptyCard(id, title, note) {
+	return `<figure class="chart-card" id="${esc(id)}"><figcaption class="chart-head"><span class="chart-title">${esc(title)}</span></figcaption><div class="chart-empty">${esc(note)}</div></figure>`;
+}
+
+/**
+ * Build the four-chart "Overview" row. Returns "" when there is nothing to plot.
+ */
+function renderCharts(payload = {}, opts = {}) {
+	const prod = payload.prodMatches || [];
+	const cwe = cweByCriticality(prod);
+	const subs = vulnSubdepsByDep(prod);
+	const unattr = unattributedSubdeps(prod);
+	const scope = directVsTransitive(prod);
+	const prio = fixPriority(prod);
+
+	if (!(cwe.length || subs.length || scope.length || prio.length || unattr)) return "";
+
+	const interactive = opts.interactive !== false;       // copy button only in the interactive HTML
+
+	const cweSlices = cwe.map(r => ({ label: r.key, name: r.name, value: r.total, color: SEV_COLOR[worstSev(r.segments)] }));
+	// Donut per direct dep: slice size = its sub-dep CVE count, colour = worst
+	// severity among them, legend = readable dep name + count.
+	const subSlices = subs.map(r => ({ label: r.label, value: r.total, color: SEV_COLOR[worstSev(r.segments)] }));
+	const note2 = unattr ? `+${unattr} transitive CVE(s) with no resolved root` : "";
+
+	// One shared viewBox width across all four donuts (the widest legend) → with
+	// equal-width (25%) flex cards they scale identically, so the donuts stay the
+	// SAME size regardless of how long any single chart's legend is.
+	const W = Math.max(250, legendBoxWidth(cweSlices), legendBoxWidth(subSlices, note2), legendBoxWidth(scope), legendBoxWidth(prio));
+
+	const card1 = cwe.length
+		? chartCard({ id: "chart-cwe", title: "CWE — direct vulns (by criticality)", interactive, ...donutChart({ slices: cweSlices, width: W }) })
+		: emptyCard("chart-cwe", "CWE — direct vulns (by criticality)", "No categorised direct CVE.");
+
+	const card2 = (subs.length || unattr)
+		? chartCard({ id: "chart-subdeps", title: "Sub-dep CVEs per dependency", interactive, ...donutChart({ slices: subSlices, width: W, note: note2 }) })
+		: emptyCard("chart-subdeps", "Sub-dep CVEs per dependency", "No vulnerable transitive deps.");
+
+	const card3 = scope.length
+		? chartCard({ id: "chart-scope", title: "Direct vs transitive (by severity)", interactive, ...donutChart({ slices: scope, width: W }) })
+		: emptyCard("chart-scope", "Direct vs transitive (by severity)", "No production CVE.");
+
+	const card4 = prio.length
+		? chartCard({ id: "chart-priority", title: "Fix priority", interactive, ...donutChart({ slices: prio, width: W }) })
+		: emptyCard("chart-priority", "Fix priority", "No production CVE.");
+
+	return `<section class="charts-row" aria-label="Overview charts">${card1}${card2}${card3}${card4}</section>`;
+}
+
+module.exports = {
+	cweByCriticality,
+	vulnSubdepsByDep,
+	unattributedSubdeps,
+	directVsTransitive,
+	fixPriority,
+	renderCharts,
+	SEV_SERIES,
+};

package/lib/codecs/composer.codec.js

@@ -50,8 +50,10 @@ module.exports = {
 		const { ignoreTest, deps2Exclude } = opts;
 		const out = new Map();
 		const warnings = [];
+		const parsedManifests = [];
 		for (const g of findComposerManifests(dir, dirFilter(dir, opts))) {
 			if (g.composerLock) {
+				parsedManifests.push(g.composerLock);
 				let parsed;
 				try { parsed = parseComposerLock(g.composerLock); }
 				catch (e) { warnings.push({ type: "parse-error", manifestPath: g.composerLock, message: `composer.lock parse failed: ${e.message}` }); continue; }
@@ -64,6 +66,7 @@ module.exports = {
 				}
 			} else if (g.composerJson) {
 				// No lockfile → best-effort: pinned exact versions only + warning.
+				parsedManifests.push(g.composerJson);
 				let parsed;
 				try { parsed = parseComposerJson(g.composerJson); }
 				catch (e) { warnings.push({ type: "parse-error", manifestPath: g.composerJson, message: `composer.json parse failed: ${e.message}` }); continue; }
@@ -83,7 +86,7 @@ module.exports = {
 				warnings.push({ type: "no-lockfile", manifestPath: g.composerJson, message: `composer.json without composer.lock — best-effort: ${pinned} pinned, ${ranges} range(s) skipped (run "composer install")` });
 			}
 		}
-		return { deps: out, warnings };
+		return { deps: out, warnings, parsedManifests };
 	},
 
 	coordKey(d) { return coordKeyFor("composer", d.namespace || "", d.name); },

package/lib/codecs/go.codec.js

@@ -44,6 +44,7 @@ module.exports = {
 		const { deps2Exclude } = opts;
 		const out = new Map();
 		const warnings = [];
+		const parsedManifests = [];
 		const add = (d, manifestPath) => {
 			if (deps2Exclude && deps2Exclude.test(d.name)) return;
 			out.set(coordKeyFor("go", "", d.name), makeDepRecord({ ecosystem: "go", namespace: "", name: d.name, version: d.version, manifestPath, scope: d.scope, isDev: false }));
@@ -51,6 +52,7 @@ module.exports = {
 		for (const g of findGoDirs(dir, dirFilter(dir, opts))) {
 			if (g.names.has("go.mod")) {
 				const fp = path.join(g.dir, "go.mod");
+				parsedManifests.push(fp);
 				try {
 					const r = G.parseGoModFile(fp);
 					if (r.deps.length) { for (const d of r.deps) add(d, fp); continue; }
@@ -59,11 +61,12 @@ module.exports = {
 			}
 			if (g.names.has("go.sum")) {
 				const fp = path.join(g.dir, "go.sum");
+				parsedManifests.push(fp);
 				try { const r = G.parseGoSumFile(fp); for (const d of r.deps) add(d, fp); }
 				catch (e) { warnings.push({ type: "parse-error", manifestPath: fp, message: `go.sum parse failed: ${e.message}` }); }
 			}
 		}
-		return { deps: out, warnings };
+		return { deps: out, warnings, parsedManifests };
 	},
 
 	coordKey(d) { return coordKeyFor("go", "", d.name); },