fad-checker 2.2.3 → 2.3.0

package/lib/codecs/gradle/catalog.js

@@ -0,0 +1,91 @@
+/**
+ * lib/codecs/gradle/catalog.js — Gradle version catalog (gradle/libs.versions.toml).
+ *
+ * Parses the TOML [versions]/[libraries] tables into a normalized shape and resolves
+ * the Kotlin/Groovy DSL type-safe accessors (`libs.foo.bar` → alias `foo-bar`) plus the
+ * `findVersion(ref)`/`findLibrary(alias)` forms used inside convention plugins.
+ *
+ * A Gradle accessor normalizes `-`, `_` and `.` to the same separator, so `groovy-core`,
+ * `groovy.core` and `groovy_core` are the same library. We normalize both the alias keys
+ * and the looked-up accessor with `[-_.] → "."` so the reverse lookup is unambiguous.
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
+ */
+const TOML = require("smol-toml");
+
+function normKey(s) { return String(s || "").replace(/[-_.]/g, "."); }
+
+// A library entry's version may be an inline string, a { ref = "alias" } pointer into
+// [versions], or absent (BOM-managed). Return the concrete string or null.
+function resolveLibVersion(versionField, versions) {
+	if (versionField == null) return null;
+	if (typeof versionField === "string") return versionField || null;
+	if (typeof versionField === "object") {
+		if (typeof versionField.ref === "string") return versions[versionField.ref] || null;
+		// { strictly = "x" } / { require = "x" } / { prefer = "x" } rich version constraints.
+		return versionField.strictly || versionField.require || versionField.prefer || null;
+	}
+	return null;
+}
+
+/**
+ * Parse a libs.versions.toml text → { versions: {alias→str}, libraries: {alias→{group,name,version}},
+ * plugins: {alias→{id,version}}, _byAccessor: {normalizedAlias→libraryEntry} }.
+ */
+function parseVersionCatalog(text) {
+	let data = {};
+	try { data = TOML.parse(String(text || "")); } catch { data = {}; }
+	const versions = {};
+	for (const [k, v] of Object.entries(data.versions || {})) {
+		versions[k] = typeof v === "string" ? v : resolveLibVersion(v, {});
+	}
+	const libraries = {};
+	for (const [alias, raw] of Object.entries(data.libraries || {})) {
+		let group = null, name = null;
+		if (typeof raw === "string") {
+			// shorthand "group:name:version"
+			const parts = raw.split(":");
+			group = parts[0] || null; name = parts[1] || null;
+			libraries[alias] = { group, name, version: parts[2] || null };
+			continue;
+		}
+		if (raw && typeof raw === "object") {
+			if (typeof raw.module === "string") {
+				const i = raw.module.indexOf(":");
+				group = i >= 0 ? raw.module.slice(0, i) : raw.module;
+				name = i >= 0 ? raw.module.slice(i + 1) : null;
+			} else {
+				group = raw.group || null;
+				name = raw.name || null;
+			}
+			libraries[alias] = { group, name, version: resolveLibVersion(raw.version, versions) };
+		}
+	}
+	const plugins = {};
+	for (const [alias, raw] of Object.entries(data.plugins || {})) {
+		if (typeof raw === "string") { const [id, version] = raw.split(":"); plugins[alias] = { id: id || null, version: version || null }; continue; }
+		if (raw && typeof raw === "object") plugins[alias] = { id: raw.id || null, version: resolveLibVersion(raw.version, versions) };
+	}
+	const byAccessor = {};
+	for (const [alias, entry] of Object.entries(libraries)) byAccessor[normKey(alias)] = entry;
+	return { versions, libraries, plugins, _byAccessor: byAccessor };
+}
+
+/** Resolve a DSL accessor (the part after `libs.`, e.g. "clamav.client") → library entry or null. */
+function resolveLibraryAccessor(catalog, accessor) {
+	if (!catalog) return null;
+	return catalog._byAccessor[normKey(accessor)] || null;
+}
+
+/** Resolve a version alias (libs.findVersion("spring-boot")) → string or null. */
+function findCatalogVersion(catalog, ref) {
+	if (!catalog || !ref) return null;
+	if (catalog.versions[ref] != null) return catalog.versions[ref];
+	// tolerate accessor-style refs
+	const want = normKey(ref);
+	for (const [k, v] of Object.entries(catalog.versions)) if (normKey(k) === want) return v;
+	return null;
+}
+
+module.exports = { parseVersionCatalog, resolveLibraryAccessor, findCatalogVersion, normKey };

package/lib/codecs/gradle/parse.js

@@ -0,0 +1,211 @@
+/**
+ * lib/codecs/gradle/parse.js — Gradle manifest parsers (lockfile-first, best-effort DSL).
+ *
+ *   gradle.lockfile            → authoritative `g:a:v=conf,conf` (resolved, transitives incl.)
+ *   gradle.properties          → `key=value` (used to resolve `$var` versions)
+ *   build.gradle / .kts        → best-effort regex over `dependencies { … }`:
+ *                                string notation, map notation, version-catalog accessors
+ *                                (`libs.foo.bar`), and `platform(...)` BOMs (surfaced
+ *                                separately for the import-BOM backfill, NOT as a dep).
+ *
+ * A Gradle dependency IS a Maven coordinate, so the codec emits ecosystem "maven" records;
+ * this module only turns the various Gradle surfaces into {group,name,version} tuples.
+ * Versions that can't be resolved statically (programmatic constructs, missing var) come
+ * back null — never assumed-vulnerable — and are listed in `unresolved` for a warning.
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
+ */
+const { resolveLibraryAccessor, findCatalogVersion } = require("./catalog");
+
+const COORD = "[A-Za-z0-9_.\\-]+";
+
+// Function/keyword call sites that look like a configuration but are NOT external deps.
+const DENY = new Set([
+	"id", "kotlin", "version", "project", "exclude", "platform", "enforcedPlatform",
+	"files", "fileTree", "gradleApi", "localGroovy", "because", "create", "named",
+	"register", "maven", "url", "uri", "from", "into", "extendsFrom", "add", "plugin",
+	"apply", "alias", "set", "property", "the", "get", "named", "dependencies",
+]);
+
+function isTestConfig(c) { return /test/i.test(String(c || "")); }
+
+// Guard against non-coordinate string args that happen to contain a colon — e.g.
+// jvmArgs("-Xshare:off"), systemProperty("a:b"). A real Maven groupId is reverse-DNS:
+// it always starts with a letter (never "-" or a digit); an artifactId starts alphanumeric.
+function looksLikeCoord(group, name) {
+	return /^[A-Za-z][\w.\-]*$/.test(String(group || "")) && /^[A-Za-z0-9][\w.\-]*$/.test(String(name || ""));
+}
+
+function depScope(config) {
+	const isDev = isTestConfig(config);
+	return { scope: isDev ? "test" : "compile", isDev };
+}
+
+// Read the version expression that begins at s[i] (right after `g:a:` in a coord string).
+// Handles a `${ … }` template (balanced braces — so a nested findVersion("x") with its own
+// quotes/parens is captured whole), a bare `$var`, or a plain literal up to the closing quote.
+function readVersionExpr(s, i) {
+	if (s[i] === "$" && s[i + 1] === "{") {
+		let depth = 0;
+		for (let j = i + 1; j < s.length; j++) {
+			if (s[j] === "{") depth++;
+			else if (s[j] === "}" && --depth === 0) return s.slice(i, j + 1);
+		}
+		return s.slice(i);
+	}
+	if (s[i] === "$") { const m = s.slice(i).match(/^\$[\w.]+/); return m ? m[0] : null; }
+	const m = s.slice(i).match(/^[^"'\s)]+/);
+	return m ? m[0] : null;
+}
+
+/** Resolve a (possibly `$var` / catalog-backed) version expression → concrete string or null. */
+function resolveVer(raw, ctx) {
+	if (raw == null) return null;
+	const v = String(raw).trim();
+	if (!v) return null;
+	if (v.includes("$")) {
+		let m = v.match(/findVersion\(\s*["']([^"']+)["']\s*\)/);
+		if (m) return findCatalogVersion(ctx.catalog, m[1]) || null;
+		m = v.match(/libs\.versions\.([\w.]+?)(?:\.get\(\))?[\s}"')]*$/);
+		if (m) { const r = findCatalogVersion(ctx.catalog, m[1]); if (r) return r; }
+		m = v.match(/\$\{?([\w.]+)\}?/);
+		if (m) {
+			const k = m[1];
+			if (ctx.localVars && ctx.localVars[k] != null) return ctx.localVars[k];
+			if (ctx.properties && ctx.properties[k] != null) return ctx.properties[k];
+		}
+		return null;
+	}
+	const m = v.match(/[\w][\w.\-]*/);
+	return m ? m[0] : null;
+}
+
+/** Parse the inner content of a `platform( … )` call → {group,name,version} or null. */
+function parsePlatformCoord(content, ctx) {
+	const c = String(content || "").trim();
+	const head = c.match(new RegExp(`["']?\\s*(${COORD}):(${COORD}):`));
+	if (head) {
+		const tail = c.slice(c.indexOf(head[0]) + head[0].length);
+		return { group: head[1], name: head[2], version: resolveVer(tail, ctx) || null };
+	}
+	const ga = c.match(new RegExp(`["']\\s*(${COORD}):(${COORD})\\s*["']`));
+	if (ga) return { group: ga[1], name: ga[2], version: null };
+	const lib = c.match(/libs\.([\w.]+)/);
+	if (lib && ctx.catalog) {
+		const e = resolveLibraryAccessor(ctx.catalog, lib[1]);
+		if (e && e.group && e.name) return { group: e.group, name: e.name, version: e.version || null };
+	}
+	return null;
+}
+
+/** Parse a gradle.lockfile → { deps: [{group,name,version,scope,isDev,configurations}] }. */
+function parseGradleLockfile(text) {
+	const deps = [];
+	for (const raw of String(text || "").split(/\r?\n/)) {
+		const line = raw.trim();
+		if (!line || line.startsWith("#")) continue;
+		const eq = line.indexOf("=");
+		if (eq < 0) continue;
+		const coord = line.slice(0, eq).trim();
+		if (coord === "empty") continue;
+		const configurations = line.slice(eq + 1).split(",").map(s => s.trim()).filter(Boolean);
+		const parts = coord.split(":");
+		if (parts.length < 3 || !parts[0] || !parts[1] || !parts[2]) continue;
+		const isDev = configurations.length > 0 && configurations.every(isTestConfig);
+		deps.push({ group: parts[0], name: parts[1], version: parts[2], scope: isDev ? "test" : "compile", isDev, configurations });
+	}
+	return { deps };
+}
+
+/** Parse a gradle.properties → { key: value }. */
+function parseGradleProperties(text) {
+	const out = {};
+	for (const raw of String(text || "").split(/\r?\n/)) {
+		const line = raw.trim();
+		if (!line || line.startsWith("#") || line.startsWith("!")) continue;
+		const eq = line.indexOf("=");
+		if (eq < 0) continue;
+		const k = line.slice(0, eq).trim();
+		if (k) out[k] = line.slice(eq + 1).trim();
+	}
+	return out;
+}
+
+/**
+ * Best-effort parse of a build.gradle / build.gradle.kts.
+ * @param opts { catalog, properties, kotlin } — catalog from parseVersionCatalog, properties
+ *   from parseGradleProperties; `kotlin` is informational (the regexes accept both DSLs).
+ * @returns { deps: [{group,name,version,configuration,scope,isDev}], platformBoms, unresolved }
+ */
+function parseBuildScript(text, opts = {}) {
+	const src = String(text || "");
+	const ctx = { catalog: opts.catalog || null, properties: opts.properties || {}, localVars: {} };
+	for (const m of src.matchAll(/\b(?:val|def)\s+(\w+)\s*=\s*["']([^"']*)["']/g)) ctx.localVars[m[1]] = m[2];
+
+	const deps = [];
+	const platformBoms = [];
+	const unresolved = [];
+	const seen = new Set();
+	const addDep = (group, name, versionRaw, config) => {
+		if (!group || !name || !looksLikeCoord(group, name)) return;
+		const key = `${group}:${name}`;
+		if (seen.has(key)) return;
+		seen.add(key);
+		const version = resolveVer(versionRaw, ctx) || null;
+		if (versionRaw != null && /\$/.test(String(versionRaw)) && !version) unresolved.push({ group, name, raw: String(versionRaw), reason: "unresolved-variable" });
+		deps.push({ group, name, version, configuration: config, ...depScope(config) });
+	};
+
+	// 1. platform()/enforcedPlatform() — balanced-paren scan (handles nested ${...} templates
+	//    with their own quotes/parens), then blank the span so the inner coord isn't re-read.
+	const platSpans = [];
+	const re = /(?:enforced)?[Pp]latform\s*\(/g;
+	let pm;
+	while ((pm = re.exec(src))) {
+		const open = src.indexOf("(", pm.index + pm[0].length - 1);
+		if (open < 0) continue;
+		let depth = 0, end = -1;
+		for (let i = open; i < src.length; i++) {
+			if (src[i] === "(") depth++;
+			else if (src[i] === ")") { if (--depth === 0) { end = i; break; } }
+		}
+		if (end <= open) continue;
+		const coord = parsePlatformCoord(src.slice(open + 1, end), ctx);
+		if (coord && coord.group && coord.name && !platformBoms.some(b => b.group === coord.group && b.name === coord.name)) platformBoms.push(coord);
+		platSpans.push([pm.index, end + 1]);
+	}
+	let work = src;
+	if (platSpans.length) {
+		let out = "", last = 0;
+		for (const [s, e] of platSpans) { out += src.slice(last, s) + " ".repeat(e - s); last = e; }
+		work = out + src.slice(last);
+	}
+
+	// 2. map notation: conf group: 'x', name: 'y'[, version: 'z']
+	for (const m of work.matchAll(/\b(\w+)\s*\(?\s*group:\s*(["'])([^"']+)\2\s*,\s*name:\s*(["'])([^"']+)\4(?:\s*,\s*version:\s*(["'])([^"']+)\6)?/g)) {
+		if (DENY.has(m[1])) continue;
+		addDep(m[3], m[5], m[7] || null, m[1]);
+	}
+	// 3. string notation: conf("g:a[:v]") | conf 'g:a[:v]'. We match only the opening
+	//    `conf("g:a` + optional `:` and then read the version expression manually, so a
+	//    version like `${libs.findVersion("x").get()}` (nested quotes) isn't truncated.
+	const strRe = new RegExp(`\\b(\\w+)\\s*(?:\\(\\s*)?(["'])(${COORD}):(${COORD})(:?)`, "g");
+	let sm;
+	while ((sm = strRe.exec(work))) {
+		if (DENY.has(sm[1])) continue;
+		const versionRaw = sm[5] === ":" ? readVersionExpr(work, sm.index + sm[0].length) : null;
+		addDep(sm[3], sm[4], versionRaw, sm[1]);
+	}
+	// 4. version-catalog accessor: conf(libs.foo.bar)
+	for (const m of work.matchAll(/\b(\w+)\s*(?:\(\s*)?libs\.([\w.]+)/g)) {
+		if (DENY.has(m[1]) || m[1] === "libs") continue;
+		const accessor = m[2];
+		if (/^(versions|findVersion|bundles|plugins)\b/.test(accessor)) continue;
+		const lib = resolveLibraryAccessor(ctx.catalog, accessor);
+		if (lib && lib.group && lib.name) addDep(lib.group, lib.name, lib.version, m[1]);
+	}
+	return { deps, platformBoms, unresolved };
+}
+
+module.exports = { parseGradleLockfile, parseGradleProperties, parseBuildScript, resolveVer, depScope, isTestConfig };

package/lib/codecs/gradle.codec.js

@@ -0,0 +1,155 @@
+/**
+ * lib/codecs/gradle.codec.js — codec Gradle.
+ *
+ * A Gradle dependency IS a Maven coordinate resolved from Maven repositories, so records
+ * are emitted with `ecosystem: "maven"` (bare `g:a` coordKey → the Maven CVE-index, OSV
+ * "Maven", transitive resolution, import-BOM backfill, outdated and EOL all treat them
+ * unchanged) but `ecosystemType: "gradle"` so the report gives them a dedicated "Gradle"
+ * chapter and a Gradle fix recipe (cve-report's codecFor() resolves by ecosystemType).
+ *
+ * Parsing is lockfile-first (gradle.lockfile = resolved, authoritative) and otherwise
+ * best-effort over the build scripts + version catalog (see ./gradle/parse.js). `platform()`
+ * BOMs are surfaced in `_gradle.platformBoms` for the orchestrator to feed into the existing
+ * lib/maven-bom.js backfill, mirroring Maven's `<scope>import</scope>` BOMs.
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
+ */
+const fs = require("fs");
+const path = require("path");
+const { makeDepRecord, coordKeyFor } = require("../dep-record");
+const { parseGradleLockfile, parseGradleProperties, parseBuildScript } = require("./gradle/parse");
+const { parseVersionCatalog } = require("./gradle/catalog");
+
+const SKIP = new Set([".git", ".idea", ".vscode", "node_modules", "dist", "out", "target", "build", ".gradle", ".mvn", "bin"]);
+const BUILD_FILES = new Set(["build.gradle", "build.gradle.kts"]);
+const SETTINGS_FILES = new Set(["settings.gradle", "settings.gradle.kts"]);
+const DETECT_HITS = new Set([...BUILD_FILES, ...SETTINGS_FILES, "gradle.lockfile", "libs.versions.toml"]);
+
+function readSafe(fp) { try { return fs.readFileSync(fp, "utf8"); } catch { return ""; } }
+function inBuildSrc(fp) { return /(^|[\\/])buildSrc[\\/]/.test(fp); }
+
+function dirFilter(dir, opts) {
+	return require("../path-filter").makeDirFilter({ srcRoot: opts.srcRoot || dir, defaultSkip: SKIP, excludePath: opts.excludePath, useDefaults: opts.defaultExcludes !== false });
+}
+
+// One walk → classify every relevant Gradle file.
+function walkGradle(dir, skipDir) {
+	const buildFiles = [], catalogFiles = [], propsFiles = [];
+	const lockByDir = new Map();
+	const stack = [dir];
+	while (stack.length) {
+		const cur = stack.pop();
+		let entries; try { entries = fs.readdirSync(cur, { withFileTypes: true }); } catch { continue; }
+		for (const e of entries) {
+			const p = path.join(cur, e.name);
+			if (e.isDirectory()) { if (!skipDir(p, e.name)) stack.push(p); continue; }
+			if (!e.isFile()) continue;
+			if (BUILD_FILES.has(e.name)) buildFiles.push(p);
+			else if (SETTINGS_FILES.has(e.name)) { /* structure only; not a dep source */ }
+			else if (e.name === "gradle.lockfile") lockByDir.set(cur, p);
+			else if (e.name === "libs.versions.toml" || e.name.endsWith(".versions.toml")) catalogFiles.push(p);
+			else if (e.name === "gradle.properties") propsFiles.push(p);
+			else if (e.name.endsWith(".gradle.kts") || e.name.endsWith(".gradle")) buildFiles.push(p); // precompiled convention plugins (buildSrc)
+		}
+	}
+	return { buildFiles, catalogFiles, propsFiles, lockByDir };
+}
+
+// Merge every version catalog in the tree into one resolution table (root + buildSrc).
+function mergeCatalogs(files) {
+	const merged = { versions: {}, libraries: {}, plugins: {}, _byAccessor: {} };
+	for (const f of files) {
+		const c = parseVersionCatalog(readSafe(f));
+		Object.assign(merged.versions, c.versions);
+		Object.assign(merged.libraries, c.libraries);
+		Object.assign(merged.plugins, c.plugins);
+		Object.assign(merged._byAccessor, c._byAccessor);
+	}
+	return merged;
+}
+
+module.exports = {
+	id: "gradle",
+	label: "Gradle",
+	osvEcosystem: "Maven",
+	manifestNames: ["build.gradle", "build.gradle.kts", "settings.gradle", "settings.gradle.kts", "gradle.lockfile", "*.versions.toml"],
+
+	detect(dir) {
+		const skipDir = (p, name) => SKIP.has(name);
+		const stack = [dir];
+		while (stack.length) {
+			const cur = stack.pop();
+			let entries; try { entries = fs.readdirSync(cur, { withFileTypes: true }); } catch { continue; }
+			for (const e of entries) {
+				if (e.isFile() && (DETECT_HITS.has(e.name) || e.name.endsWith(".versions.toml"))) return true;
+				if (e.isDirectory() && !skipDir(path.join(cur, e.name), e.name)) stack.push(path.join(cur, e.name));
+			}
+		}
+		return false;
+	},
+
+	async collect(dir, opts = {}) {
+		const { deps2Exclude } = opts;
+		const skipDir = dirFilter(dir, opts);
+		const { buildFiles, catalogFiles, propsFiles, lockByDir } = walkGradle(dir, skipDir);
+
+		const catalog = mergeCatalogs(catalogFiles);
+		const properties = {};
+		for (const f of propsFiles) Object.assign(properties, parseGradleProperties(readSafe(f)));
+
+		const out = new Map();
+		const warnings = [];
+		const platformBoms = [];
+
+		const addRec = (d, manifestPath) => {
+			if (!d.group || !d.name) return;
+			if (deps2Exclude && deps2Exclude.test(d.name)) return;
+			const rec = makeDepRecord({ ecosystem: "maven", ecosystemType: "gradle", namespace: d.group, name: d.name, version: d.version, manifestPath, scope: d.scope, isDev: d.isDev });
+			const existing = out.get(rec.coordKey);
+			if (!existing) { out.set(rec.coordKey, rec); return; }
+			for (const p of rec.manifestPaths) if (!existing.manifestPaths.includes(p)) existing.manifestPaths.push(p);
+			for (const v of rec.versions) if (!existing.versions.includes(v)) existing.versions.push(v);
+			if (!existing.version && rec.version) existing.version = rec.version;
+			if (rec.isDev === false) existing.isDev = false; // prod scope wins over dev
+		};
+
+		// gradle.lockfile = authoritative resolved versions (transitives incl.) for its project.
+		const lockedDirs = new Set(lockByDir.keys());
+		for (const [, fp] of lockByDir) {
+			for (const d of parseGradleLockfile(readSafe(fp)).deps) addRec(d, fp);
+		}
+
+		// Build scripts: best-effort deps (skipped for a lock-governed top-level project) +
+		// platform() BOMs (always collected — they drive the import-BOM backfill).
+		for (const fp of buildFiles) {
+			const d = path.dirname(fp);
+			const r = parseBuildScript(readSafe(fp), { catalog, properties, kotlin: fp.endsWith(".kts") });
+			for (const b of r.platformBoms) if (b.group && b.name && !platformBoms.some(x => x.group === b.group && x.name === b.name)) platformBoms.push(b);
+			const lockGoverned = lockedDirs.has(d) && !inBuildSrc(fp);
+			if (lockGoverned) continue; // lockfile already provided resolved deps for this dir
+			for (const dep of r.deps) addRec(dep, fp);
+			if (!inBuildSrc(fp)) warnings.push({ type: "gradle-no-lockfile", manifestPath: fp, message: `no gradle.lockfile next to ${path.relative(dir, fp) || path.basename(fp)} — versions resolved best-effort from the build script + version catalog (dynamic/programmatic deps may be missed). Enable Gradle dependency locking for exact coverage.` });
+			for (const u of r.unresolved) warnings.push({ type: "unresolved-versions", manifestPath: fp, message: `could not resolve the version variable for ${u.group}:${u.name} (${u.raw}) — excluded from CVE matching` });
+		}
+
+		const parsedManifests = [...buildFiles, ...lockByDir.values(), ...catalogFiles, ...propsFiles];
+		return { deps: out, warnings, parsedManifests, _gradle: { platformBoms } };
+	},
+
+	coordKey(d) { return coordKeyFor("maven", d.namespace || d.groupId, d.name || d.artifactId); },
+	formatCoord(d) { return `${d.namespace || d.groupId}:${d.name || d.artifactId}`; },
+	osvPackageName(d) { return `${d.namespace || d.groupId}:${d.name || d.artifactId}`; },
+
+	async checkRegistry(deps, opts = {}) {
+		const outdated = require("../outdated");
+		const out = opts.allLibs ? await outdated.checkOutdatedDeps(deps, opts) : [];
+		const deprecated = outdated.checkObsoleteDeps(deps);
+		return { outdated: out, deprecated };
+	},
+	resolveEolProduct(d) { return require("../outdated").findEolProduct(d); },
+
+	recipe: require("./recipes").gradle,
+
+	nativeScanners: [],
+};

package/lib/codecs/index.js

@@ -12,6 +12,7 @@ const fs = require("fs");
 const path = require("path");
 const { assertCodecShape } = require("./codec.interface");
 const maven = require("./maven.codec");
+const gradle = require("./gradle.codec");
 const npm = require("./npm.codec");
 const yarn = require("./yarn.codec");
 const composer = require("./composer.codec");
@@ -23,10 +24,10 @@ const binary = require("./binary.codec");
 
 // Ordre stable pour le report (maven, npm, yarn, puis les nouveaux écosystèmes).
 // "binary" (committed native libs, no manifest) reste en dernier.
-const ORDER = ["maven", "npm", "yarn", "nuget", "composer", "pypi", "go", "ruby", "binary"];
+const ORDER = ["maven", "gradle", "npm", "yarn", "nuget", "composer", "pypi", "go", "ruby", "binary"];
 
 const REGISTRY = new Map();
-for (const c of [maven, npm, yarn, composer, pypi, nuget, go, ruby, binary]) {
+for (const c of [maven, gradle, npm, yarn, composer, pypi, nuget, go, ruby, binary]) {
 	assertCodecShape(c);
 	REGISTRY.set(c.id, c);
 }

package/lib/codecs/maven.codec.js

@@ -65,7 +65,7 @@ module.exports = {
 				warnings.push(...jarWarnings);
 			} catch (e) { warnings.push({ type: "embedded-jar", message: `embedded-jar scan failed: ${e.message}` }); }
 		}
-		return { deps, warnings, _maven: { store, propsByPom, pomFiles } };
+		return { deps, warnings, parsedManifests: pomFiles.slice(), _maven: { store, propsByPom, pomFiles } };
 	},
 
 	coordKey(d) { return coordKeyFor("maven", d.namespace || d.groupId, d.name || d.artifactId); },

package/lib/codecs/npm/collect.js

@@ -141,8 +141,10 @@ function collectNpmDeps(rootDir, opts = {}) {
 	// findJsManifestsAsync walk) to avoid a second, serial tree traversal.
 	const manifestGroups = opts.manifestGroups || findJsManifests(rootDir);
 	let parsedCount = 0;
+	const parsedManifests = [];
 
 	for (const group of manifestGroups) {
+		for (const f of [group.packageJson, group.packageLock, group.yarnLock, group.pnpmLock]) if (f) parsedManifests.push(f);
 		const pj = group.packageJson ? safeParse(parsePackageJson, group.packageJson, verbose) : null;
 		const pl = group.packageLock ? safeParse(parsePackageLock, group.packageLock, verbose) : null;
 		const yl = group.yarnLock ? safeParse(parseYarnLockV1, group.yarnLock, verbose) : null;
@@ -224,6 +226,7 @@ function collectNpmDeps(rootDir, opts = {}) {
 	// Backward compat: the Map carries the warnings under a non-enumerable prop
 	// so existing callers that iterate `for (const [k,v] of map)` still work.
 	Object.defineProperty(out, "warnings", { value: warnings, enumerable: false });
+	Object.defineProperty(out, "parsedManifests", { value: parsedManifests, enumerable: false });
 	return out;
 }
 

package/lib/codecs/npm.codec.js

@@ -56,6 +56,6 @@ module.exports = {
 		const skipDir = makeDirFilter({ srcRoot: opts.srcRoot || dir, defaultSkip: DEFAULT_JS_SKIP_DIRS, excludePath: opts.excludePath, useDefaults: opts.defaultExcludes !== false });
 		const manifestGroups = await findJsManifestsAsync(dir, { skipDir });
 		const deps = collectNpmDeps(dir, { ...opts, manifestGroups });
-		return { deps, warnings: deps.warnings || [] };
+		return { deps, warnings: deps.warnings || [], parsedManifests: deps.parsedManifests || [] };
 	},
 };

package/lib/codecs/nuget.codec.js

@@ -51,6 +51,7 @@ module.exports = {
 		const { deps2Exclude } = opts;
 		const out = new Map();
 		const warnings = [];
+		const parsedManifests = [];
 		const add = (d, manifestPath) => {
 			if (deps2Exclude && deps2Exclude.test(d.name)) return;
 			out.set(coordKeyFor("nuget", "", d.name), makeDepRecord({ ecosystem: "nuget", namespace: "", name: d.name, version: d.version, manifestPath, scope: d.scope, isDev: d.isDev }));
@@ -58,6 +59,7 @@ module.exports = {
 		for (const g of findNugetDirs(dir, dirFilter(dir, opts))) {
 			if (g.files.includes("packages.lock.json")) {
 				const fp = path.join(g.dir, "packages.lock.json");
+				parsedManifests.push(fp);
 				try { const { deps } = await N.parsePackagesLockJson(fp); for (const d of deps) add(d, fp); }
 				catch (e) { warnings.push({ type: "parse-error", manifestPath: fp, message: `packages.lock.json parse failed: ${e.message}` }); }
 				continue;   // lockfile is authoritative for this directory
@@ -65,11 +67,14 @@ module.exports = {
 			// No lockfile → best-effort from .csproj (+CPM) and packages.config + warning.
 			let cpm = {};
 			if (g.files.includes("Directory.Packages.props")) {
-				try { cpm = await N.parseDirectoryPackagesProps(path.join(g.dir, "Directory.Packages.props")); } catch { /* ignore */ }
+				const cpmFp = path.join(g.dir, "Directory.Packages.props");
+				parsedManifests.push(cpmFp);
+				try { cpm = await N.parseDirectoryPackagesProps(cpmFp); } catch { /* ignore */ }
 			}
 			let pinned = 0, skipped = 0;
 			for (const cs of g.csprojs) {
 				const fp = path.join(g.dir, cs);
+				parsedManifests.push(fp);
 				try {
 					const { deps, skipped: sk } = await N.parseCsproj(fp, cpm);
 					for (const d of deps) { add(d, fp); pinned++; }
@@ -78,13 +83,14 @@ module.exports = {
 			}
 			if (g.files.includes("packages.config")) {
 				const fp = path.join(g.dir, "packages.config");
+				parsedManifests.push(fp);
 				try { const { deps } = await N.parsePackagesConfig(fp); for (const d of deps) { add(d, fp); pinned++; } } catch { /* ignore */ }
 			}
 			if (g.csprojs.length || g.files.includes("packages.config")) {
 				warnings.push({ type: "no-lockfile", manifestPath: g.dir, message: `no packages.lock.json — best-effort: ${pinned} pinned, ${skipped} floating/unresolved skipped (enable RestorePackagesWithLockFile)` });
 			}
 		}
-		return { deps: out, warnings };
+		return { deps: out, warnings, parsedManifests };
 	},
 
 	coordKey(d) { return coordKeyFor("nuget", "", d.name); },