fad-checker 2.2.3 → 2.3.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (25) hide show
  1. package/README.md +37 -333
  2. package/fad-checker.js +59 -22
  3. package/lib/charts.js +293 -0
  4. package/lib/codecs/composer.codec.js +4 -1
  5. package/lib/codecs/go.codec.js +4 -1
  6. package/lib/codecs/gradle/catalog.js +91 -0
  7. package/lib/codecs/gradle/parse.js +211 -0
  8. package/lib/codecs/gradle.codec.js +155 -0
  9. package/lib/codecs/index.js +3 -2
  10. package/lib/codecs/maven.codec.js +1 -1
  11. package/lib/codecs/npm/collect.js +3 -0
  12. package/lib/codecs/npm.codec.js +1 -1
  13. package/lib/codecs/nuget.codec.js +8 -2
  14. package/lib/codecs/pypi.codec.js +37 -14
  15. package/lib/codecs/recipes.js +18 -1
  16. package/lib/codecs/ruby.codec.js +3 -1
  17. package/lib/cpe.js +39 -2
  18. package/lib/cve-match.js +20 -1
  19. package/lib/cve-report.js +300 -86
  20. package/lib/deps-descriptor.js +2 -2
  21. package/lib/osv-db.js +1 -1
  22. package/lib/retire.js +1 -1
  23. package/package.json +2 -3
  24. package/fad-checker-report/cve-report.doc +0 -10987
  25. package/fad-checker-report/cve-report.html +0 -11126
package/lib/retire.js CHANGED
@@ -29,7 +29,7 @@ const RETIRE_CACHE_TTL_MS = 24 * 3600 * 1000;
29
29
 
30
30
  // retire's own signature DB. By default retire caches it in /tmp/.retire-cache
31
31
  // (outside ~/.fad-checker/, with a 1h TTL → a network refetch on expiry). For the
32
- // PASSI offline workflow we instead keep a stable local copy INSIDE ~/.fad-checker/
32
+ // air-gapped offline workflow we instead keep a stable local copy INSIDE ~/.fad-checker/
33
33
  // so `--export-cache` carries it, and feed it to retire via `--jsrepo <file>`
34
34
  // (loaded from file, never the network — no TTL).
35
35
  const RETIRE_SIG_DIR = path.join(os.homedir(), ".fad-checker", "retire-signatures");
package/package.json CHANGED
@@ -1,7 +1,7 @@
1
1
  {
2
2
  "name": "fad-checker",
3
- "version": "2.2.3",
4
- "description": "Scan ALL Maven, npm, Yarn, Composer, Python, C#/.NET, Go & Ruby dependencies — plus embedded JARs (fat-jars/war/ear) — in a source tree ONE SHOT without mvn/python/etc — CVE (EPSS/KEV-prioritised), EOL, obsolete, outdated & licenses, with SBOM/CSAF/SARIF/JSON exports, CI gating and fix recos",
3
+ "version": "2.3.0",
4
+ "description": "Scan ALL Maven, Gradle, npm, Yarn, Composer, Python, C#/.NET, Go & Ruby dependencies — plus embedded JARs (fat-jars/war/ear) — in a source tree ONE SHOT without mvn/python/etc — CVE (EPSS/KEV-prioritised), EOL, obsolete, outdated & licenses, with SBOM/CSAF/SARIF/JSON exports, CI gating and fix recos",
5
5
  "keywords": [
6
6
  "sca",
7
7
  "software-composition-analysis",
@@ -29,7 +29,6 @@
29
29
  "supply-chain",
30
30
  "offline",
31
31
  "air-gapped",
32
- "passi",
33
32
  "maven",
34
33
  "npm",
35
34
  "yarn",