fad-checker 2.2.4 → 2.3.0

package/README.md

@@ -8,7 +8,7 @@
 > **F**abulous **A**utonomous **D**ependency **C**hecker<br>
 > AKA **F**uckin' **A**utonomous **D**ependency **C**hecker<br>
 
-`fad-checker` audits **Maven · npm · Yarn · pnpm · Composer · PyPI · NuGet · Go · Ruby**, vendored JavaScript and committed native binaries in any source tree — multi-module, monorepo, polyglot — and produces a self-contained **HTML + Word report** (CVE prioritised by EPSS + CISA KEV, EOL, obsolete, outdated, licenses) plus **CycloneDX SBOM / CSAF VEX / SARIF / JSON** exports. **No build tools, no Docker, no network needed** — it reads lockfiles and manifests straight off disk.
+`fad-checker` audits **Maven · Gradle · npm · Yarn · pnpm · Composer · PyPI · NuGet · Go · Ruby**, vendored JavaScript and committed native binaries in any source tree — multi-module, monorepo, polyglot — and produces a self-contained **HTML + Word report** (CVE prioritised by EPSS + CISA KEV, EOL, obsolete, outdated, licenses) plus **CycloneDX SBOM / CSAF VEX / SARIF / JSON** exports. **No build tools, no Docker, no network needed** — it reads lockfiles and manifests straight off disk.
 
 🌐 **[Project site & docs →](https://n8tz.github.io/fad-checker/)**
 
@@ -16,11 +16,11 @@
 
 ## Features
 
-- **9 ecosystems in one pass** — Maven, npm/Yarn/pnpm, Composer (PHP), PyPI, NuGet, Go, Ruby; plus **vendored JS** (retire.js), committed **native binaries** (`.dll`/`.exe`/`.so`/`.dylib`, identified by checksum via deps.dev + CIRCL) and **embedded JARs** (fat-jars/war/ear, unzipped in-memory).
-- **No build tools** — reads `pom.xml`, `package-lock`/`yarn.lock`/`pnpm-lock`, `composer.lock`, `poetry`/`Pipfile`/`uv`/`pdm` locks, `packages.lock.json`/`*.csproj`, `go.mod`, `Gemfile.lock` directly. No `mvn`/`npm install`/`pip`/`dotnet restore`/`go build`/`bundle`, no `node_modules/`. → [how it stays build-free](docs/COMPARISON.md#how-its-autonomous-no-build-tools)
+- **10 ecosystems in one pass** — Maven, **Gradle**, npm/Yarn/pnpm, Composer (PHP), PyPI, NuGet, Go, Ruby; plus **vendored JS** (retire.js), committed **native binaries** (`.dll`/`.exe`/`.so`/`.dylib`, identified by checksum via deps.dev + CIRCL) and **embedded JARs** (fat-jars/war/ear, unzipped in-memory).
+- **No build tools** — reads `pom.xml`, `build.gradle(.kts)`/`gradle.lockfile`/`libs.versions.toml`, `package-lock`/`yarn.lock`/`pnpm-lock`, `composer.lock`, `poetry`/`Pipfile`/`uv`/`pdm` locks, `packages.lock.json`/`*.csproj`, `go.mod`, `Gemfile.lock` directly. No `mvn`/`gradle`/`npm install`/`pip`/`dotnet restore`/`go build`/`bundle`, no `node_modules/`. → [how it stays build-free](docs/COMPARISON.md#how-its-autonomous-no-build-tools)
 - **CVE, merged & prioritised** — CVEProject + OSV.dev + NVD, CPE/version cross-checked to cut false positives, ranked **CISA KEV → EPSS → CVSS**.
 - **Per-module Maven version mediation** — recovers vulnerable transitive versions that a global `<dependencyManagement>` pin hides in another module (lifted Snyk-corroborated coverage **156 → 181** on a real 25-module reactor, finding CVEs a single Snyk scan missed).
-- **Air-gapped / PASSI** — **zero network under `--offline`** (regression-tested), offline Maven transitive resolution, and `--osv-db` for cache-independent offline OSV recall. → [Air-gapped](#air-gapped--passi-audits)
+- **Air-gapped** — **zero network under `--offline`** (regression-tested), offline Maven transitive resolution, and `--osv-db` for cache-independent offline OSV recall. → [Air-gapped](#air-gapped-audits)
 - **Supply-chain risk** — known-**malicious** advisories (`MAL-`, always block the CI gate) + suspected **typosquats** (`--typosquat`).
 - **Lifecycle** — EOL (endoflife.date), obsolete/deprecated, outdated — across every ecosystem.
 - **Licenses** *(opt-in `--licenses`)* — SPDX-normalised, copyleft/proprietary flagged.
@@ -63,13 +63,13 @@ A single self-contained binary (no Node), from-source install and shell completi
 | **5. Obsolete libraries** | curated list (Maven) + registry maintainer flags | log4j 1.x, jackson-mapper-asl, joda-time, …; npm `deprecated`, Composer `abandoned`, PyPI `yanked`/inactive, NuGet `deprecation` |
 | **6. Outdated libraries** | Maven Central + npm / Packagist / PyPI / NuGet registries | Available newer versions, with release dates |
 | **7. Licenses** *(opt-in: `--licenses`)* | registry metadata + Maven POMs → SPDX policy | Each dep's license normalised to SPDX and classified; copyleft (GPL/AGPL/LGPL/MPL), proprietary and unknown flagged for review |
-| **8. Fix Recommendations** | computed | Per-ecosystem pin recipes: Maven `<dependencyManagement>`, npm `overrides`, yarn `resolutions`, `composer require`, `pip install`, `dotnet add package` |
+| **8. Fix Recommendations** | computed | Per-ecosystem pin recipes: Maven `<dependencyManagement>`, Gradle `constraints { }`, npm `overrides`, yarn `resolutions`, `composer require`, `pip install`, `dotnet add package` |
 
 The HTML report opens in any browser, contains every detail (CVSS vectors, references, full descriptions, CPE configurations, via-paths for transitives) and ships a Word-compatible `.doc` twin. Every match carries a **composite priority** (KEV-exploited > EPSS likelihood > CVSS severity), and the run can additionally emit a **CycloneDX 1.6 SBOM** (`--report-sbom`, vulnerabilities inline) and a **CSAF 2.0 VEX** (`--report-csaf`) for downstream tooling.
 
 <p align="center"><img src="docs/assets/report.png" alt="fad-checker HTML report — executive summary with severity tiles and a detailed CVE table with CWE, descriptions and fix versions" width="900"></p>
 
-## Air-gapped / PASSI audits
+## Air-gapped audits
 
 > **Zero-data-sent guarantee.** Under `--offline`, fad-checker makes **no network calls
 > whatsoever** — it reads only the warmed `~/.fad-checker/` caches and never transmits a
@@ -80,7 +80,7 @@ The HTML report opens in any browser, contains every detail (CVSS vectors, refer
 > mainstream OSS scanners, fad also resolves the **Maven transitive graph** offline — so on
 > an air-gapped multi-module project it finds the transitive CVEs they can't.
 
-When the audited system is **offline / confidential** (typical of a PASSI engagement) it
+When the audited system is **offline / confidential** (typical of a regulated or air-gapped audit) it
 can't reach OSV / NVD / Maven Central / npm. Split the work across machines while keeping
 **zero environment information** off the secure enclave: an anonymized descriptor carries
 only **public package coordinates** — no filesystem paths, no registry URLs, no

package/fad-checker.js

@@ -229,7 +229,7 @@ program
 	.option("--export-cache <file>", "tar.gz/zip the ~/.fad-checker/ caches to <file> (excludes config.json by default)")
 	.option("--import-cache <file>", "restore ~/.fad-checker/ from a previously exported archive (existing dir is moved to .bak unless --force)")
 	.option("--include-config", "with --export-cache: also bundle config.json (contains the NVD API key)")
-	.option("--export-anonymized <file>", "offline: write an anonymized dependency descriptor (public coordinates only, no paths/URLs) for PASSI audits, then exit")
+	.option("--export-anonymized <file>", "offline: write an anonymized dependency descriptor (public coordinates only, no paths/URLs) for air-gapped audits, then exit")
 	.option("--import-anonymized <file>", "online: scan an anonymized descriptor (no --src) to warm the caches; pair with --export-cache for offline reporting")
 	.option("--force", "with --import-cache: replace ~/.fad-checker/ without backup")
 	.option("--report-output <dir>", "report output directory", "./fad-checker-report")
@@ -246,6 +246,7 @@ program
 	.option("--transitive-depth <n>", "max transitive depth", "6")
 	.option("--ecosystem <list>", "codecs to run: auto|all|<comma list> e.g. maven,npm,nuget,composer,pypi,go,ruby (default: auto = detected)", "auto")
 	.option("--no-maven", "skip the Maven codec")
+	.option("--no-gradle", "skip the Gradle codec")
 	.option("--no-npm", "skip the npm codec")
 	.option("--no-yarn", "skip the Yarn codec")
 	.option("--no-nuget", "skip the NuGet (C#/.NET) codec")
@@ -451,10 +452,10 @@ async function timedPhase(label, fn) {
 	].filter(Boolean))];
 	const defaultExcludes = options.defaultExcludes !== false;
 	const walkOpts = { excludePath, defaultExcludes };
-	// PASSI phase 1 (--export-anonymized) is a purely local operation — parse the tree,
+	// Anonymized export (phase 1, --export-anonymized) is a purely local operation — parse the tree,
 	// emit public coordinates, exit. Force offline so no source ever touches the network.
 	if (options.exportAnonymized) options.offline = true;
-	const runMode = options.exportAnonymized ? "offline (PASSI phase 1 · export descriptor)"
+	const runMode = options.exportAnonymized ? "offline (anonymized export · phase 1)"
 		: options.importAnonymized ? "import descriptor"
 		: (options.offline ? "offline" : "online");
 	if (options.src) ui.kv("source", chalk.white(options.src));
@@ -467,7 +468,7 @@ async function timedPhase(label, fn) {
 
 	let wrotePom = 0;
 
-	// --- PASSI phase 2: import an anonymized descriptor instead of collecting ---
+	// --- Anonymized phase 2: import a descriptor instead of collecting ---
 	// Scans the descriptor's public coordinates online to WARM the coordinate-keyed
 	// caches (OSV/NVD/CVE/registry/EOL) + retire signatures. Pair with --export-cache.
 	if (options.importAnonymized) {
@@ -488,6 +489,12 @@ async function timedPhase(label, fn) {
 			const { warmRetireSignatures } = require("./lib/retire");
 			await warmRetireSignatures({ verbose });
 		}
+		// --import-anonymized is a cache-WARMING step (pair with --export-cache), not a
+		// reporting one: the path-bearing report is produced later, offline, from the warmed
+		// cache against the real source tree. So suppress the default HTML+doc output here
+		// (still honor an explicit --report-<type> if a user really wants a path-free one).
+		const anyReportRequested = [options.reportHtml, options.reportDoc, options.reportSbom, options.reportCsaf, options.reportJson, options.reportSarif].some(v => v !== undefined);
+		if (!anyReportRequested) options.report = false;
 		await runReportFlow(resolved, { activeIds, runMaven, runNpm, privateLibIds: [], mavenRepos, regMap, collectWarnings: [] });
 		return;
 	}
@@ -503,11 +510,12 @@ async function timedPhase(label, fn) {
 	// project), and detectCodecs' manifest-glob matcher misses versioned sonames
 	// (libz.so.1). Always make it a candidate in auto mode; --no-binaries removes it.
 	if (eco === "auto" && !detected.includes("binary")) detected.push("binary");
-	const noCodecs = ["maven", "npm", "yarn", "nuget", "composer", "pypi", "go", "ruby"].filter(id => options[id] === false);
+	const noCodecs = ["maven", "gradle", "npm", "yarn", "nuget", "composer", "pypi", "go", "ruby"].filter(id => options[id] === false);
 	// `--no-binaries` maps to options.binaries (plural) but the codec id is `binary`.
 	if (options.binaries === false) noCodecs.push("binary");
 	const activeIds = resolveActiveCodecs(eco, detected, { noCodecs, noJs: !options.js });
 	const runMaven = activeIds.includes("maven");
+	const runGradle = activeIds.includes("gradle");
 	const runNpm = activeIds.includes("npm") || activeIds.includes("yarn");
 
 	// --- Collect deps from every active codec into one Map (coordKeys never collide) ---
@@ -516,7 +524,13 @@ async function timedPhase(label, fn) {
 	ui.section("Collection");
 	const resolved = new Map();
 	let mavenCtx = null;
+	let gradleCtx = null;
 	const collectWarnings = [];
+	// Every descriptor file each codec actually parsed (tagged with its ecosystemType =
+	// codec id), so the report's "Scanned dependency descriptors" appendix is a COMPLETE
+	// inventory — including files parsed that contributed no scannable dep (ranges-only /
+	// no lockfile), which would otherwise be invisible.
+	const parsedManifests = [];
 	for (const id of activeIds) {
 		if (id === "yarn") continue;   // the npm codec already collects yarn.lock
 		const codec = getCodec(id);
@@ -529,7 +543,9 @@ async function timedPhase(label, fn) {
 		}
 		for (const [k, v] of res.deps) resolved.set(k, v);
 		if (res.warnings?.length) collectWarnings.push(...res.warnings);
+		for (const p of (res.parsedManifests || [])) parsedManifests.push({ path: p, ecosystemType: id });
 		if (id === "maven") mavenCtx = res._maven;
+		if (id === "gradle") gradleCtx = res._gradle;
 	}
 
 	// --- Collection summary ---
@@ -539,12 +555,15 @@ async function timedPhase(label, fn) {
 	for (const d of resolved.values()) {
 		if (d.provenance === "embedded") { embeddedCount++; continue; } // counted separately below
 		if (d.provenance === "binary") { binaryCount++; continue; }     // committed native libs, no manifest
-		ecoCount[d.ecosystem] = (ecoCount[d.ecosystem] || 0) + 1;
+		// Key by ecosystemType so Gradle (ecosystem "maven") gets its own line/label.
+		const ecoKey = d.ecosystemType || d.ecosystem;
+		ecoCount[ecoKey] = (ecoCount[ecoKey] || 0) + 1;
 	}
 	if (runMaven) ui.ok(`${chalk.bold("Maven".padEnd(8))} ${mavenCtx ? mavenCtx.pomFiles.length + " module(s) · " : ""}${ecoCount.maven || 0} direct dep(s)`);
+	if (runGradle) ui.ok(`${chalk.bold("Gradle".padEnd(8))} ${ecoCount.gradle || 0} direct dep(s)`);
 	if (runNpm)   ui.ok(`${chalk.bold("npm/yarn".padEnd(8))} ${ecoCount.npm || 0} dep(s)`);
 	for (const [id, n] of Object.entries(ecoCount)) {
-		if (id === "maven" || id === "npm") continue;
+		if (id === "maven" || id === "gradle" || id === "npm") continue;
 		ui.ok(`${chalk.bold(((getCodec(id)?.label) || id).padEnd(8))} ${n} dep(s)`);
 	}
 	if (embeddedCount) ui.ok(`${chalk.bold("Embedded".padEnd(8))} ${embeddedCount} coord(s) in .jar/.war/.ear`);
@@ -556,7 +575,7 @@ async function timedPhase(label, fn) {
 		if (collectWarnings.length > 5) ui.info(chalk.dim(`…and ${collectWarnings.length - 5} more`));
 	}
 
-	// --- PASSI phase 1: export an anonymized descriptor and exit (no network, no report) ---
+	// --- Anonymized phase 1: export a descriptor and exit (no network, no report) ---
 	if (options.exportAnonymized) {
 		const { serializeDeps } = require("./lib/deps-descriptor");
 		const pkgVersion = require("./package.json").version;
@@ -697,7 +716,7 @@ async function timedPhase(label, fn) {
 	// The scan always runs — it feeds the terminal summary, the file outputs and the
 	// CI gate. Which files get written is decided by the --report-* family inside
 	// (HTML + .doc by default; --no-report writes nothing).
-	await runReportFlow(resolved, { activeIds, runMaven, runNpm, privateLibIds, mavenRepos, regMap, collectWarnings, mavenPropsByPom: mavenCtx?.propsByPom, mavenStore: mavenCtx?.store });
+	await runReportFlow(resolved, { activeIds, runMaven, runGradle, runNpm, privateLibIds, mavenRepos, regMap, collectWarnings, mavenPropsByPom: mavenCtx?.propsByPom, mavenStore: mavenCtx?.store, gradlePlatformBoms: gradleCtx?.platformBoms || [], parsedManifests });
 	if (!readOnly) {
 		ui.section("Next step");
 		ui.info(`run Snyk on the cleaned tree:`);
@@ -706,7 +725,7 @@ async function timedPhase(label, fn) {
 })();
 
 async function runReportFlow(resolved, ecoFlags = {}) {
-	const { activeIds = [], runMaven = true, runNpm = false, privateLibIds = [], mavenRepos = [], regMap = {}, collectWarnings = [], mavenPropsByPom = null, mavenStore = null } = ecoFlags;
+	const { activeIds = [], runMaven = true, runGradle = false, runNpm = false, privateLibIds = [], mavenRepos = [], regMap = {}, collectWarnings = [], mavenPropsByPom = null, mavenStore = null, gradlePlatformBoms = [], parsedManifests = [] } = ecoFlags;
 	const registriesFor = eco => regMap[eco] || [];
 	const { expandWithTransitives } = require("./lib/cve-match");
 	const { writeReports, computeStats } = require("./lib/cve-report");
@@ -736,11 +755,14 @@ async function runReportFlow(resolved, ecoFlags = {}) {
 	}
 
 	// Decide which update steps will run (from flags) so the [n/N] counter is accurate.
-	const cveScanner = runMaven ? (getCodec("maven").nativeScanners || []).find(s => s.kind === "cve") : null;
+	// Gradle deps are Maven coordinates (ecosystem "maven"), so the Maven CVE-index scanner
+	// and the Maven-Central transitive/BOM/outdated/EOL passes cover them — they're EXCLUDED
+	// from the per-codec registry loop below to avoid double-processing.
+	const cveScanner = (runMaven || runGradle) ? (getCodec("maven").nativeScanners || []).find(s => s.kind === "cve") : null;
 	const cveIndexExists = fs.existsSync(require("./lib/cve-download").CVE_INDEX_PATH);
-	const otherRegistryIds = activeIds.filter(id => id !== "maven" && id !== "npm" && id !== "yarn" && getCodec(id)?.checkRegistry);
+	const otherRegistryIds = activeIds.filter(id => id !== "maven" && id !== "gradle" && id !== "npm" && id !== "yarn" && getCodec(id)?.checkRegistry);
 	const willCve = !!cveScanner && (!(options.cveOffline || offline) || cveIndexExists);
-	const willTransitive = !!(options.transitive && runMaven);
+	const willTransitive = !!(options.transitive && (runMaven || runGradle));
 	// Per-module version mediation overlay: recover transitive versions the global
 	// transitive pass masks via cross-module depMgmt bleed. Runs after (and only when)
 	// the global pass runs, and needs the parsed store + per-module props.
@@ -751,11 +773,18 @@ async function runReportFlow(resolved, ecoFlags = {}) {
 	// never the network — same as transitive resolution).
 	const importBoms = (runMaven && mavenPropsByPom)
 		? require("./lib/maven-bom").collectImportBoms(mavenPropsByPom) : [];
-	const willBom = importBoms.length > 0;
+	// Gradle `platform(...)` BOMs are the same as Maven `<scope>import</scope>` BOMs — feed
+	// them through the same managed-version backfill (e.g. spring-boot-dependencies → all the
+	// versionless spring-boot-starter-* declared in build.gradle get their version).
+	const gradleBoms = (gradlePlatformBoms || [])
+		.map(b => ({ groupId: b.group, artifactId: b.name, version: b.version }))
+		.filter(b => b.groupId && b.artifactId && b.version);
+	const allBoms = importBoms.concat(gradleBoms);
+	const willBom = allBoms.length > 0;
 	const willOsv = !!options.osv;
 	// Local OSV DB import (Maven): offline-complete OSV recall, independent of the per-dep
 	// OSV.dev cache. Opt-in (downloads ~9 MB once); then matches online or offline.
-	const willOsvDb = !!options.osvDb && runMaven;
+	const willOsvDb = !!options.osvDb && (runMaven || runGradle);
 	const willOutdated = !!options.allLibs;
 	const willNvd = !!options.nvd;
 	const willEpss = !!options.epss;
@@ -772,9 +801,10 @@ async function runReportFlow(resolved, ecoFlags = {}) {
 	if (willBom) {
 		const st = progress.start("BOM version resolution (Maven Central)");
 		try {
-			const { resolveAndBackfill } = require("./lib/maven-bom");
-			const r = await resolveAndBackfill(mavenPropsByPom, resolved, { repos: mavenRepos, offline, verbose });
-			st.done(`${r.filled} dep version(s) from ${r.boms} import BOM(s)`);
+			const { resolveBomManagedVersions, backfillVersions } = require("./lib/maven-bom");
+			const mgmt = await resolveBomManagedVersions(allBoms, { repos: mavenRepos, offline, verbose });
+			const filled = backfillVersions(resolved, mgmt);
+			st.done(`${filled} dep version(s) from ${allBoms.length} import BOM(s)`);
 		} catch (err) { st.fail(err.message); }
 	}
 
@@ -811,7 +841,7 @@ async function runReportFlow(resolved, ecoFlags = {}) {
 	// Scan-completeness signals — computed NOW (after BOM backfill) so only the deps
 	// still without a concrete version (external BOM truly unreachable, or offline)
 	// are flagged, not the ones we just resolved from spring-boot-dependencies & co.
-	if (runMaven) {
+	if (runMaven || runGradle) {
 		const { detectScanCompletenessWarnings } = require("./lib/scan-completeness");
 		scanWarnings = detectScanCompletenessWarnings(resolved, { ranSnyk: !!options.snyk, ranTransitive: !!options.transitive });
 	}
@@ -903,6 +933,11 @@ async function runReportFlow(resolved, ecoFlags = {}) {
 		const k = `${r.dep.groupId}:${r.dep.artifactId}`;
 		return !eolKeys.has(k) && !obsKeys.has(k);
 	});
+	// Outdated is a maintenance signal for deps you actually declare and can bump. An
+	// INDIRECT (transitive) dep's "latest" isn't directly actionable — you'd bump the parent
+	// — so drop transitives from the Outdated chapter (EOL/obsolete keep them: security).
+	// scope==="transitive" is the marker set by the Maven/Gradle resolver and the npm parser.
+	outdatedResults = outdatedResults.filter(r => r.dep.scope !== "transitive");
 
 	// 4b. OSV.dev — Maven-native CVE+GHSA feed (huge recall win over raw CVEProject)
 	if (willOsv) {
@@ -1192,7 +1227,7 @@ async function runReportFlow(resolved, ecoFlags = {}) {
 	let licenseResults = null;
 	if (willLicenses) {
 		try {
-			if (runMaven) {
+			if (runMaven || runGradle) {
 				const { collectMavenLicenses } = require("./lib/maven-license");
 				licenseFindings = licenseFindings.concat(collectMavenLicenses(resolved));
 			}
@@ -1265,7 +1300,7 @@ async function runReportFlow(resolved, ecoFlags = {}) {
 		const { htmlPath, docPath } = await writeReports({
 			cveMatches: prodMatches, devCveMatches: devMatches, embeddedMatches, retireMatches, vendoredJsInventory,
 			eolResults, obsoleteResults, outdatedResults, licenseResults,
-			resolvedDeps: resolved, projectInfo, warnings: reportWarnings,
+			resolvedDeps: resolved, projectInfo, warnings: reportWarnings, parsedManifests,
 			htmlPath: out.html, docPath: out.doc,
 		});
 		if (htmlPath) wrote.push(["HTML report", htmlPath]);
@@ -1311,7 +1346,9 @@ async function runReportFlow(resolved, ecoFlags = {}) {
 		ui.section("Output");
 		for (const [label, p] of wrote) ui.ok(`${label} → ${chalk.white(p)}`);
 	} else if (options.report === false) {
-		ui.info(chalk.dim("--no-report: no files written (scan + gate only)"));
+		ui.info(chalk.dim(options.importAnonymized
+			? "import-anonymized: caches warmed, no report written (pair with --export-cache, then report offline from the real source tree)"
+			: "--no-report: no files written (scan + gate only)"));
 	}
 	console.log();
 

package/lib/codecs/composer.codec.js

@@ -50,8 +50,10 @@ module.exports = {
 		const { ignoreTest, deps2Exclude } = opts;
 		const out = new Map();
 		const warnings = [];
+		const parsedManifests = [];
 		for (const g of findComposerManifests(dir, dirFilter(dir, opts))) {
 			if (g.composerLock) {
+				parsedManifests.push(g.composerLock);
 				let parsed;
 				try { parsed = parseComposerLock(g.composerLock); }
 				catch (e) { warnings.push({ type: "parse-error", manifestPath: g.composerLock, message: `composer.lock parse failed: ${e.message}` }); continue; }
@@ -64,6 +66,7 @@ module.exports = {
 				}
 			} else if (g.composerJson) {
 				// No lockfile → best-effort: pinned exact versions only + warning.
+				parsedManifests.push(g.composerJson);
 				let parsed;
 				try { parsed = parseComposerJson(g.composerJson); }
 				catch (e) { warnings.push({ type: "parse-error", manifestPath: g.composerJson, message: `composer.json parse failed: ${e.message}` }); continue; }
@@ -83,7 +86,7 @@ module.exports = {
 				warnings.push({ type: "no-lockfile", manifestPath: g.composerJson, message: `composer.json without composer.lock — best-effort: ${pinned} pinned, ${ranges} range(s) skipped (run "composer install")` });
 			}
 		}
-		return { deps: out, warnings };
+		return { deps: out, warnings, parsedManifests };
 	},
 
 	coordKey(d) { return coordKeyFor("composer", d.namespace || "", d.name); },

package/lib/codecs/go.codec.js

@@ -44,6 +44,7 @@ module.exports = {
 		const { deps2Exclude } = opts;
 		const out = new Map();
 		const warnings = [];
+		const parsedManifests = [];
 		const add = (d, manifestPath) => {
 			if (deps2Exclude && deps2Exclude.test(d.name)) return;
 			out.set(coordKeyFor("go", "", d.name), makeDepRecord({ ecosystem: "go", namespace: "", name: d.name, version: d.version, manifestPath, scope: d.scope, isDev: false }));
@@ -51,6 +52,7 @@ module.exports = {
 		for (const g of findGoDirs(dir, dirFilter(dir, opts))) {
 			if (g.names.has("go.mod")) {
 				const fp = path.join(g.dir, "go.mod");
+				parsedManifests.push(fp);
 				try {
 					const r = G.parseGoModFile(fp);
 					if (r.deps.length) { for (const d of r.deps) add(d, fp); continue; }
@@ -59,11 +61,12 @@ module.exports = {
 			}
 			if (g.names.has("go.sum")) {
 				const fp = path.join(g.dir, "go.sum");
+				parsedManifests.push(fp);
 				try { const r = G.parseGoSumFile(fp); for (const d of r.deps) add(d, fp); }
 				catch (e) { warnings.push({ type: "parse-error", manifestPath: fp, message: `go.sum parse failed: ${e.message}` }); }
 			}
 		}
-		return { deps: out, warnings };
+		return { deps: out, warnings, parsedManifests };
 	},
 
 	coordKey(d) { return coordKeyFor("go", "", d.name); },

package/lib/codecs/gradle/catalog.js

@@ -0,0 +1,91 @@
+/**
+ * lib/codecs/gradle/catalog.js — Gradle version catalog (gradle/libs.versions.toml).
+ *
+ * Parses the TOML [versions]/[libraries] tables into a normalized shape and resolves
+ * the Kotlin/Groovy DSL type-safe accessors (`libs.foo.bar` → alias `foo-bar`) plus the
+ * `findVersion(ref)`/`findLibrary(alias)` forms used inside convention plugins.
+ *
+ * A Gradle accessor normalizes `-`, `_` and `.` to the same separator, so `groovy-core`,
+ * `groovy.core` and `groovy_core` are the same library. We normalize both the alias keys
+ * and the looked-up accessor with `[-_.] → "."` so the reverse lookup is unambiguous.
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
+ */
+const TOML = require("smol-toml");
+
+function normKey(s) { return String(s || "").replace(/[-_.]/g, "."); }
+
+// A library entry's version may be an inline string, a { ref = "alias" } pointer into
+// [versions], or absent (BOM-managed). Return the concrete string or null.
+function resolveLibVersion(versionField, versions) {
+	if (versionField == null) return null;
+	if (typeof versionField === "string") return versionField || null;
+	if (typeof versionField === "object") {
+		if (typeof versionField.ref === "string") return versions[versionField.ref] || null;
+		// { strictly = "x" } / { require = "x" } / { prefer = "x" } rich version constraints.
+		return versionField.strictly || versionField.require || versionField.prefer || null;
+	}
+	return null;
+}
+
+/**
+ * Parse a libs.versions.toml text → { versions: {alias→str}, libraries: {alias→{group,name,version}},
+ * plugins: {alias→{id,version}}, _byAccessor: {normalizedAlias→libraryEntry} }.
+ */
+function parseVersionCatalog(text) {
+	let data = {};
+	try { data = TOML.parse(String(text || "")); } catch { data = {}; }
+	const versions = {};
+	for (const [k, v] of Object.entries(data.versions || {})) {
+		versions[k] = typeof v === "string" ? v : resolveLibVersion(v, {});
+	}
+	const libraries = {};
+	for (const [alias, raw] of Object.entries(data.libraries || {})) {
+		let group = null, name = null;
+		if (typeof raw === "string") {
+			// shorthand "group:name:version"
+			const parts = raw.split(":");
+			group = parts[0] || null; name = parts[1] || null;
+			libraries[alias] = { group, name, version: parts[2] || null };
+			continue;
+		}
+		if (raw && typeof raw === "object") {
+			if (typeof raw.module === "string") {
+				const i = raw.module.indexOf(":");
+				group = i >= 0 ? raw.module.slice(0, i) : raw.module;
+				name = i >= 0 ? raw.module.slice(i + 1) : null;
+			} else {
+				group = raw.group || null;
+				name = raw.name || null;
+			}
+			libraries[alias] = { group, name, version: resolveLibVersion(raw.version, versions) };
+		}
+	}
+	const plugins = {};
+	for (const [alias, raw] of Object.entries(data.plugins || {})) {
+		if (typeof raw === "string") { const [id, version] = raw.split(":"); plugins[alias] = { id: id || null, version: version || null }; continue; }
+		if (raw && typeof raw === "object") plugins[alias] = { id: raw.id || null, version: resolveLibVersion(raw.version, versions) };
+	}
+	const byAccessor = {};
+	for (const [alias, entry] of Object.entries(libraries)) byAccessor[normKey(alias)] = entry;
+	return { versions, libraries, plugins, _byAccessor: byAccessor };
+}
+
+/** Resolve a DSL accessor (the part after `libs.`, e.g. "clamav.client") → library entry or null. */
+function resolveLibraryAccessor(catalog, accessor) {
+	if (!catalog) return null;
+	return catalog._byAccessor[normKey(accessor)] || null;
+}
+
+/** Resolve a version alias (libs.findVersion("spring-boot")) → string or null. */
+function findCatalogVersion(catalog, ref) {
+	if (!catalog || !ref) return null;
+	if (catalog.versions[ref] != null) return catalog.versions[ref];
+	// tolerate accessor-style refs
+	const want = normKey(ref);
+	for (const [k, v] of Object.entries(catalog.versions)) if (normKey(k) === want) return v;
+	return null;
+}
+
+module.exports = { parseVersionCatalog, resolveLibraryAccessor, findCatalogVersion, normKey };

package/lib/codecs/gradle/parse.js

@@ -0,0 +1,211 @@
+/**
+ * lib/codecs/gradle/parse.js — Gradle manifest parsers (lockfile-first, best-effort DSL).
+ *
+ *   gradle.lockfile            → authoritative `g:a:v=conf,conf` (resolved, transitives incl.)
+ *   gradle.properties          → `key=value` (used to resolve `$var` versions)
+ *   build.gradle / .kts        → best-effort regex over `dependencies { … }`:
+ *                                string notation, map notation, version-catalog accessors
+ *                                (`libs.foo.bar`), and `platform(...)` BOMs (surfaced
+ *                                separately for the import-BOM backfill, NOT as a dep).
+ *
+ * A Gradle dependency IS a Maven coordinate, so the codec emits ecosystem "maven" records;
+ * this module only turns the various Gradle surfaces into {group,name,version} tuples.
+ * Versions that can't be resolved statically (programmatic constructs, missing var) come
+ * back null — never assumed-vulnerable — and are listed in `unresolved` for a warning.
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
+ */
+const { resolveLibraryAccessor, findCatalogVersion } = require("./catalog");
+
+const COORD = "[A-Za-z0-9_.\\-]+";
+
+// Function/keyword call sites that look like a configuration but are NOT external deps.
+const DENY = new Set([
+	"id", "kotlin", "version", "project", "exclude", "platform", "enforcedPlatform",
+	"files", "fileTree", "gradleApi", "localGroovy", "because", "create", "named",
+	"register", "maven", "url", "uri", "from", "into", "extendsFrom", "add", "plugin",
+	"apply", "alias", "set", "property", "the", "get", "named", "dependencies",
+]);
+
+function isTestConfig(c) { return /test/i.test(String(c || "")); }
+
+// Guard against non-coordinate string args that happen to contain a colon — e.g.
+// jvmArgs("-Xshare:off"), systemProperty("a:b"). A real Maven groupId is reverse-DNS:
+// it always starts with a letter (never "-" or a digit); an artifactId starts alphanumeric.
+function looksLikeCoord(group, name) {
+	return /^[A-Za-z][\w.\-]*$/.test(String(group || "")) && /^[A-Za-z0-9][\w.\-]*$/.test(String(name || ""));
+}
+
+function depScope(config) {
+	const isDev = isTestConfig(config);
+	return { scope: isDev ? "test" : "compile", isDev };
+}
+
+// Read the version expression that begins at s[i] (right after `g:a:` in a coord string).
+// Handles a `${ … }` template (balanced braces — so a nested findVersion("x") with its own
+// quotes/parens is captured whole), a bare `$var`, or a plain literal up to the closing quote.
+function readVersionExpr(s, i) {
+	if (s[i] === "$" && s[i + 1] === "{") {
+		let depth = 0;
+		for (let j = i + 1; j < s.length; j++) {
+			if (s[j] === "{") depth++;
+			else if (s[j] === "}" && --depth === 0) return s.slice(i, j + 1);
+		}
+		return s.slice(i);
+	}
+	if (s[i] === "$") { const m = s.slice(i).match(/^\$[\w.]+/); return m ? m[0] : null; }
+	const m = s.slice(i).match(/^[^"'\s)]+/);
+	return m ? m[0] : null;
+}
+
+/** Resolve a (possibly `$var` / catalog-backed) version expression → concrete string or null. */
+function resolveVer(raw, ctx) {
+	if (raw == null) return null;
+	const v = String(raw).trim();
+	if (!v) return null;
+	if (v.includes("$")) {
+		let m = v.match(/findVersion\(\s*["']([^"']+)["']\s*\)/);
+		if (m) return findCatalogVersion(ctx.catalog, m[1]) || null;
+		m = v.match(/libs\.versions\.([\w.]+?)(?:\.get\(\))?[\s}"')]*$/);
+		if (m) { const r = findCatalogVersion(ctx.catalog, m[1]); if (r) return r; }
+		m = v.match(/\$\{?([\w.]+)\}?/);
+		if (m) {
+			const k = m[1];
+			if (ctx.localVars && ctx.localVars[k] != null) return ctx.localVars[k];
+			if (ctx.properties && ctx.properties[k] != null) return ctx.properties[k];
+		}
+		return null;
+	}
+	const m = v.match(/[\w][\w.\-]*/);
+	return m ? m[0] : null;
+}
+
+/** Parse the inner content of a `platform( … )` call → {group,name,version} or null. */
+function parsePlatformCoord(content, ctx) {
+	const c = String(content || "").trim();
+	const head = c.match(new RegExp(`["']?\\s*(${COORD}):(${COORD}):`));
+	if (head) {
+		const tail = c.slice(c.indexOf(head[0]) + head[0].length);
+		return { group: head[1], name: head[2], version: resolveVer(tail, ctx) || null };
+	}
+	const ga = c.match(new RegExp(`["']\\s*(${COORD}):(${COORD})\\s*["']`));
+	if (ga) return { group: ga[1], name: ga[2], version: null };
+	const lib = c.match(/libs\.([\w.]+)/);
+	if (lib && ctx.catalog) {
+		const e = resolveLibraryAccessor(ctx.catalog, lib[1]);
+		if (e && e.group && e.name) return { group: e.group, name: e.name, version: e.version || null };
+	}
+	return null;
+}
+
+/** Parse a gradle.lockfile → { deps: [{group,name,version,scope,isDev,configurations}] }. */
+function parseGradleLockfile(text) {
+	const deps = [];
+	for (const raw of String(text || "").split(/\r?\n/)) {
+		const line = raw.trim();
+		if (!line || line.startsWith("#")) continue;
+		const eq = line.indexOf("=");
+		if (eq < 0) continue;
+		const coord = line.slice(0, eq).trim();
+		if (coord === "empty") continue;
+		const configurations = line.slice(eq + 1).split(",").map(s => s.trim()).filter(Boolean);
+		const parts = coord.split(":");
+		if (parts.length < 3 || !parts[0] || !parts[1] || !parts[2]) continue;
+		const isDev = configurations.length > 0 && configurations.every(isTestConfig);
+		deps.push({ group: parts[0], name: parts[1], version: parts[2], scope: isDev ? "test" : "compile", isDev, configurations });
+	}
+	return { deps };
+}
+
+/** Parse a gradle.properties → { key: value }. */
+function parseGradleProperties(text) {
+	const out = {};
+	for (const raw of String(text || "").split(/\r?\n/)) {
+		const line = raw.trim();
+		if (!line || line.startsWith("#") || line.startsWith("!")) continue;
+		const eq = line.indexOf("=");
+		if (eq < 0) continue;
+		const k = line.slice(0, eq).trim();
+		if (k) out[k] = line.slice(eq + 1).trim();
+	}
+	return out;
+}
+
+/**
+ * Best-effort parse of a build.gradle / build.gradle.kts.
+ * @param opts { catalog, properties, kotlin } — catalog from parseVersionCatalog, properties
+ *   from parseGradleProperties; `kotlin` is informational (the regexes accept both DSLs).
+ * @returns { deps: [{group,name,version,configuration,scope,isDev}], platformBoms, unresolved }
+ */
+function parseBuildScript(text, opts = {}) {
+	const src = String(text || "");
+	const ctx = { catalog: opts.catalog || null, properties: opts.properties || {}, localVars: {} };
+	for (const m of src.matchAll(/\b(?:val|def)\s+(\w+)\s*=\s*["']([^"']*)["']/g)) ctx.localVars[m[1]] = m[2];
+
+	const deps = [];
+	const platformBoms = [];
+	const unresolved = [];
+	const seen = new Set();
+	const addDep = (group, name, versionRaw, config) => {
+		if (!group || !name || !looksLikeCoord(group, name)) return;
+		const key = `${group}:${name}`;
+		if (seen.has(key)) return;
+		seen.add(key);
+		const version = resolveVer(versionRaw, ctx) || null;
+		if (versionRaw != null && /\$/.test(String(versionRaw)) && !version) unresolved.push({ group, name, raw: String(versionRaw), reason: "unresolved-variable" });
+		deps.push({ group, name, version, configuration: config, ...depScope(config) });
+	};
+
+	// 1. platform()/enforcedPlatform() — balanced-paren scan (handles nested ${...} templates
+	//    with their own quotes/parens), then blank the span so the inner coord isn't re-read.
+	const platSpans = [];
+	const re = /(?:enforced)?[Pp]latform\s*\(/g;
+	let pm;
+	while ((pm = re.exec(src))) {
+		const open = src.indexOf("(", pm.index + pm[0].length - 1);
+		if (open < 0) continue;
+		let depth = 0, end = -1;
+		for (let i = open; i < src.length; i++) {
+			if (src[i] === "(") depth++;
+			else if (src[i] === ")") { if (--depth === 0) { end = i; break; } }
+		}
+		if (end <= open) continue;
+		const coord = parsePlatformCoord(src.slice(open + 1, end), ctx);
+		if (coord && coord.group && coord.name && !platformBoms.some(b => b.group === coord.group && b.name === coord.name)) platformBoms.push(coord);
+		platSpans.push([pm.index, end + 1]);
+	}
+	let work = src;
+	if (platSpans.length) {
+		let out = "", last = 0;
+		for (const [s, e] of platSpans) { out += src.slice(last, s) + " ".repeat(e - s); last = e; }
+		work = out + src.slice(last);
+	}
+
+	// 2. map notation: conf group: 'x', name: 'y'[, version: 'z']
+	for (const m of work.matchAll(/\b(\w+)\s*\(?\s*group:\s*(["'])([^"']+)\2\s*,\s*name:\s*(["'])([^"']+)\4(?:\s*,\s*version:\s*(["'])([^"']+)\6)?/g)) {
+		if (DENY.has(m[1])) continue;
+		addDep(m[3], m[5], m[7] || null, m[1]);
+	}
+	// 3. string notation: conf("g:a[:v]") | conf 'g:a[:v]'. We match only the opening
+	//    `conf("g:a` + optional `:` and then read the version expression manually, so a
+	//    version like `${libs.findVersion("x").get()}` (nested quotes) isn't truncated.
+	const strRe = new RegExp(`\\b(\\w+)\\s*(?:\\(\\s*)?(["'])(${COORD}):(${COORD})(:?)`, "g");
+	let sm;
+	while ((sm = strRe.exec(work))) {
+		if (DENY.has(sm[1])) continue;
+		const versionRaw = sm[5] === ":" ? readVersionExpr(work, sm.index + sm[0].length) : null;
+		addDep(sm[3], sm[4], versionRaw, sm[1]);
+	}
+	// 4. version-catalog accessor: conf(libs.foo.bar)
+	for (const m of work.matchAll(/\b(\w+)\s*(?:\(\s*)?libs\.([\w.]+)/g)) {
+		if (DENY.has(m[1]) || m[1] === "libs") continue;
+		const accessor = m[2];
+		if (/^(versions|findVersion|bundles|plugins)\b/.test(accessor)) continue;
+		const lib = resolveLibraryAccessor(ctx.catalog, accessor);
+		if (lib && lib.group && lib.name) addDep(lib.group, lib.name, lib.version, m[1]);
+	}
+	return { deps, platformBoms, unresolved };
+}
+
+module.exports = { parseGradleLockfile, parseGradleProperties, parseBuildScript, resolveVer, depScope, isTestConfig };