fad-checker 2.2.4 → 2.3.0

package/lib/codecs/gradle.codec.js

@@ -0,0 +1,155 @@
+/**
+ * lib/codecs/gradle.codec.js — codec Gradle.
+ *
+ * A Gradle dependency IS a Maven coordinate resolved from Maven repositories, so records
+ * are emitted with `ecosystem: "maven"` (bare `g:a` coordKey → the Maven CVE-index, OSV
+ * "Maven", transitive resolution, import-BOM backfill, outdated and EOL all treat them
+ * unchanged) but `ecosystemType: "gradle"` so the report gives them a dedicated "Gradle"
+ * chapter and a Gradle fix recipe (cve-report's codecFor() resolves by ecosystemType).
+ *
+ * Parsing is lockfile-first (gradle.lockfile = resolved, authoritative) and otherwise
+ * best-effort over the build scripts + version catalog (see ./gradle/parse.js). `platform()`
+ * BOMs are surfaced in `_gradle.platformBoms` for the orchestrator to feed into the existing
+ * lib/maven-bom.js backfill, mirroring Maven's `<scope>import</scope>` BOMs.
+ *
+ * @author: N.BRAUN
+ * @email: pp9ping@gmail.com
+ */
+const fs = require("fs");
+const path = require("path");
+const { makeDepRecord, coordKeyFor } = require("../dep-record");
+const { parseGradleLockfile, parseGradleProperties, parseBuildScript } = require("./gradle/parse");
+const { parseVersionCatalog } = require("./gradle/catalog");
+
+const SKIP = new Set([".git", ".idea", ".vscode", "node_modules", "dist", "out", "target", "build", ".gradle", ".mvn", "bin"]);
+const BUILD_FILES = new Set(["build.gradle", "build.gradle.kts"]);
+const SETTINGS_FILES = new Set(["settings.gradle", "settings.gradle.kts"]);
+const DETECT_HITS = new Set([...BUILD_FILES, ...SETTINGS_FILES, "gradle.lockfile", "libs.versions.toml"]);
+
+function readSafe(fp) { try { return fs.readFileSync(fp, "utf8"); } catch { return ""; } }
+function inBuildSrc(fp) { return /(^|[\\/])buildSrc[\\/]/.test(fp); }
+
+function dirFilter(dir, opts) {
+	return require("../path-filter").makeDirFilter({ srcRoot: opts.srcRoot || dir, defaultSkip: SKIP, excludePath: opts.excludePath, useDefaults: opts.defaultExcludes !== false });
+}
+
+// One walk → classify every relevant Gradle file.
+function walkGradle(dir, skipDir) {
+	const buildFiles = [], catalogFiles = [], propsFiles = [];
+	const lockByDir = new Map();
+	const stack = [dir];
+	while (stack.length) {
+		const cur = stack.pop();
+		let entries; try { entries = fs.readdirSync(cur, { withFileTypes: true }); } catch { continue; }
+		for (const e of entries) {
+			const p = path.join(cur, e.name);
+			if (e.isDirectory()) { if (!skipDir(p, e.name)) stack.push(p); continue; }
+			if (!e.isFile()) continue;
+			if (BUILD_FILES.has(e.name)) buildFiles.push(p);
+			else if (SETTINGS_FILES.has(e.name)) { /* structure only; not a dep source */ }
+			else if (e.name === "gradle.lockfile") lockByDir.set(cur, p);
+			else if (e.name === "libs.versions.toml" || e.name.endsWith(".versions.toml")) catalogFiles.push(p);
+			else if (e.name === "gradle.properties") propsFiles.push(p);
+			else if (e.name.endsWith(".gradle.kts") || e.name.endsWith(".gradle")) buildFiles.push(p); // precompiled convention plugins (buildSrc)
+		}
+	}
+	return { buildFiles, catalogFiles, propsFiles, lockByDir };
+}
+
+// Merge every version catalog in the tree into one resolution table (root + buildSrc).
+function mergeCatalogs(files) {
+	const merged = { versions: {}, libraries: {}, plugins: {}, _byAccessor: {} };
+	for (const f of files) {
+		const c = parseVersionCatalog(readSafe(f));
+		Object.assign(merged.versions, c.versions);
+		Object.assign(merged.libraries, c.libraries);
+		Object.assign(merged.plugins, c.plugins);
+		Object.assign(merged._byAccessor, c._byAccessor);
+	}
+	return merged;
+}
+
+module.exports = {
+	id: "gradle",
+	label: "Gradle",
+	osvEcosystem: "Maven",
+	manifestNames: ["build.gradle", "build.gradle.kts", "settings.gradle", "settings.gradle.kts", "gradle.lockfile", "*.versions.toml"],
+
+	detect(dir) {
+		const skipDir = (p, name) => SKIP.has(name);
+		const stack = [dir];
+		while (stack.length) {
+			const cur = stack.pop();
+			let entries; try { entries = fs.readdirSync(cur, { withFileTypes: true }); } catch { continue; }
+			for (const e of entries) {
+				if (e.isFile() && (DETECT_HITS.has(e.name) || e.name.endsWith(".versions.toml"))) return true;
+				if (e.isDirectory() && !skipDir(path.join(cur, e.name), e.name)) stack.push(path.join(cur, e.name));
+			}
+		}
+		return false;
+	},
+
+	async collect(dir, opts = {}) {
+		const { deps2Exclude } = opts;
+		const skipDir = dirFilter(dir, opts);
+		const { buildFiles, catalogFiles, propsFiles, lockByDir } = walkGradle(dir, skipDir);
+
+		const catalog = mergeCatalogs(catalogFiles);
+		const properties = {};
+		for (const f of propsFiles) Object.assign(properties, parseGradleProperties(readSafe(f)));
+
+		const out = new Map();
+		const warnings = [];
+		const platformBoms = [];
+
+		const addRec = (d, manifestPath) => {
+			if (!d.group || !d.name) return;
+			if (deps2Exclude && deps2Exclude.test(d.name)) return;
+			const rec = makeDepRecord({ ecosystem: "maven", ecosystemType: "gradle", namespace: d.group, name: d.name, version: d.version, manifestPath, scope: d.scope, isDev: d.isDev });
+			const existing = out.get(rec.coordKey);
+			if (!existing) { out.set(rec.coordKey, rec); return; }
+			for (const p of rec.manifestPaths) if (!existing.manifestPaths.includes(p)) existing.manifestPaths.push(p);
+			for (const v of rec.versions) if (!existing.versions.includes(v)) existing.versions.push(v);
+			if (!existing.version && rec.version) existing.version = rec.version;
+			if (rec.isDev === false) existing.isDev = false; // prod scope wins over dev
+		};
+
+		// gradle.lockfile = authoritative resolved versions (transitives incl.) for its project.
+		const lockedDirs = new Set(lockByDir.keys());
+		for (const [, fp] of lockByDir) {
+			for (const d of parseGradleLockfile(readSafe(fp)).deps) addRec(d, fp);
+		}
+
+		// Build scripts: best-effort deps (skipped for a lock-governed top-level project) +
+		// platform() BOMs (always collected — they drive the import-BOM backfill).
+		for (const fp of buildFiles) {
+			const d = path.dirname(fp);
+			const r = parseBuildScript(readSafe(fp), { catalog, properties, kotlin: fp.endsWith(".kts") });
+			for (const b of r.platformBoms) if (b.group && b.name && !platformBoms.some(x => x.group === b.group && x.name === b.name)) platformBoms.push(b);
+			const lockGoverned = lockedDirs.has(d) && !inBuildSrc(fp);
+			if (lockGoverned) continue; // lockfile already provided resolved deps for this dir
+			for (const dep of r.deps) addRec(dep, fp);
+			if (!inBuildSrc(fp)) warnings.push({ type: "gradle-no-lockfile", manifestPath: fp, message: `no gradle.lockfile next to ${path.relative(dir, fp) || path.basename(fp)} — versions resolved best-effort from the build script + version catalog (dynamic/programmatic deps may be missed). Enable Gradle dependency locking for exact coverage.` });
+			for (const u of r.unresolved) warnings.push({ type: "unresolved-versions", manifestPath: fp, message: `could not resolve the version variable for ${u.group}:${u.name} (${u.raw}) — excluded from CVE matching` });
+		}
+
+		const parsedManifests = [...buildFiles, ...lockByDir.values(), ...catalogFiles, ...propsFiles];
+		return { deps: out, warnings, parsedManifests, _gradle: { platformBoms } };
+	},
+
+	coordKey(d) { return coordKeyFor("maven", d.namespace || d.groupId, d.name || d.artifactId); },
+	formatCoord(d) { return `${d.namespace || d.groupId}:${d.name || d.artifactId}`; },
+	osvPackageName(d) { return `${d.namespace || d.groupId}:${d.name || d.artifactId}`; },
+
+	async checkRegistry(deps, opts = {}) {
+		const outdated = require("../outdated");
+		const out = opts.allLibs ? await outdated.checkOutdatedDeps(deps, opts) : [];
+		const deprecated = outdated.checkObsoleteDeps(deps);
+		return { outdated: out, deprecated };
+	},
+	resolveEolProduct(d) { return require("../outdated").findEolProduct(d); },
+
+	recipe: require("./recipes").gradle,
+
+	nativeScanners: [],
+};

package/lib/codecs/index.js

@@ -12,6 +12,7 @@ const fs = require("fs");
 const path = require("path");
 const { assertCodecShape } = require("./codec.interface");
 const maven = require("./maven.codec");
+const gradle = require("./gradle.codec");
 const npm = require("./npm.codec");
 const yarn = require("./yarn.codec");
 const composer = require("./composer.codec");
@@ -23,10 +24,10 @@ const binary = require("./binary.codec");
 
 // Ordre stable pour le report (maven, npm, yarn, puis les nouveaux écosystèmes).
 // "binary" (committed native libs, no manifest) reste en dernier.
-const ORDER = ["maven", "npm", "yarn", "nuget", "composer", "pypi", "go", "ruby", "binary"];
+const ORDER = ["maven", "gradle", "npm", "yarn", "nuget", "composer", "pypi", "go", "ruby", "binary"];
 
 const REGISTRY = new Map();
-for (const c of [maven, npm, yarn, composer, pypi, nuget, go, ruby, binary]) {
+for (const c of [maven, gradle, npm, yarn, composer, pypi, nuget, go, ruby, binary]) {
 	assertCodecShape(c);
 	REGISTRY.set(c.id, c);
 }

package/lib/codecs/maven.codec.js

@@ -65,7 +65,7 @@ module.exports = {
 				warnings.push(...jarWarnings);
 			} catch (e) { warnings.push({ type: "embedded-jar", message: `embedded-jar scan failed: ${e.message}` }); }
 		}
-		return { deps, warnings, _maven: { store, propsByPom, pomFiles } };
+		return { deps, warnings, parsedManifests: pomFiles.slice(), _maven: { store, propsByPom, pomFiles } };
 	},
 
 	coordKey(d) { return coordKeyFor("maven", d.namespace || d.groupId, d.name || d.artifactId); },

package/lib/codecs/npm/collect.js

@@ -141,8 +141,10 @@ function collectNpmDeps(rootDir, opts = {}) {
 	// findJsManifestsAsync walk) to avoid a second, serial tree traversal.
 	const manifestGroups = opts.manifestGroups || findJsManifests(rootDir);
 	let parsedCount = 0;
+	const parsedManifests = [];
 
 	for (const group of manifestGroups) {
+		for (const f of [group.packageJson, group.packageLock, group.yarnLock, group.pnpmLock]) if (f) parsedManifests.push(f);
 		const pj = group.packageJson ? safeParse(parsePackageJson, group.packageJson, verbose) : null;
 		const pl = group.packageLock ? safeParse(parsePackageLock, group.packageLock, verbose) : null;
 		const yl = group.yarnLock ? safeParse(parseYarnLockV1, group.yarnLock, verbose) : null;
@@ -224,6 +226,7 @@ function collectNpmDeps(rootDir, opts = {}) {
 	// Backward compat: the Map carries the warnings under a non-enumerable prop
 	// so existing callers that iterate `for (const [k,v] of map)` still work.
 	Object.defineProperty(out, "warnings", { value: warnings, enumerable: false });
+	Object.defineProperty(out, "parsedManifests", { value: parsedManifests, enumerable: false });
 	return out;
 }
 

package/lib/codecs/npm.codec.js

@@ -56,6 +56,6 @@ module.exports = {
 		const skipDir = makeDirFilter({ srcRoot: opts.srcRoot || dir, defaultSkip: DEFAULT_JS_SKIP_DIRS, excludePath: opts.excludePath, useDefaults: opts.defaultExcludes !== false });
 		const manifestGroups = await findJsManifestsAsync(dir, { skipDir });
 		const deps = collectNpmDeps(dir, { ...opts, manifestGroups });
-		return { deps, warnings: deps.warnings || [] };
+		return { deps, warnings: deps.warnings || [], parsedManifests: deps.parsedManifests || [] };
 	},
 };

package/lib/codecs/nuget.codec.js

@@ -51,6 +51,7 @@ module.exports = {
 		const { deps2Exclude } = opts;
 		const out = new Map();
 		const warnings = [];
+		const parsedManifests = [];
 		const add = (d, manifestPath) => {
 			if (deps2Exclude && deps2Exclude.test(d.name)) return;
 			out.set(coordKeyFor("nuget", "", d.name), makeDepRecord({ ecosystem: "nuget", namespace: "", name: d.name, version: d.version, manifestPath, scope: d.scope, isDev: d.isDev }));
@@ -58,6 +59,7 @@ module.exports = {
 		for (const g of findNugetDirs(dir, dirFilter(dir, opts))) {
 			if (g.files.includes("packages.lock.json")) {
 				const fp = path.join(g.dir, "packages.lock.json");
+				parsedManifests.push(fp);
 				try { const { deps } = await N.parsePackagesLockJson(fp); for (const d of deps) add(d, fp); }
 				catch (e) { warnings.push({ type: "parse-error", manifestPath: fp, message: `packages.lock.json parse failed: ${e.message}` }); }
 				continue;   // lockfile is authoritative for this directory
@@ -65,11 +67,14 @@ module.exports = {
 			// No lockfile → best-effort from .csproj (+CPM) and packages.config + warning.
 			let cpm = {};
 			if (g.files.includes("Directory.Packages.props")) {
-				try { cpm = await N.parseDirectoryPackagesProps(path.join(g.dir, "Directory.Packages.props")); } catch { /* ignore */ }
+				const cpmFp = path.join(g.dir, "Directory.Packages.props");
+				parsedManifests.push(cpmFp);
+				try { cpm = await N.parseDirectoryPackagesProps(cpmFp); } catch { /* ignore */ }
 			}
 			let pinned = 0, skipped = 0;
 			for (const cs of g.csprojs) {
 				const fp = path.join(g.dir, cs);
+				parsedManifests.push(fp);
 				try {
 					const { deps, skipped: sk } = await N.parseCsproj(fp, cpm);
 					for (const d of deps) { add(d, fp); pinned++; }
@@ -78,13 +83,14 @@ module.exports = {
 			}
 			if (g.files.includes("packages.config")) {
 				const fp = path.join(g.dir, "packages.config");
+				parsedManifests.push(fp);
 				try { const { deps } = await N.parsePackagesConfig(fp); for (const d of deps) { add(d, fp); pinned++; } } catch { /* ignore */ }
 			}
 			if (g.csprojs.length || g.files.includes("packages.config")) {
 				warnings.push({ type: "no-lockfile", manifestPath: g.dir, message: `no packages.lock.json — best-effort: ${pinned} pinned, ${skipped} floating/unresolved skipped (enable RestorePackagesWithLockFile)` });
 			}
 		}
-		return { deps: out, warnings };
+		return { deps: out, warnings, parsedManifests };
 	},
 
 	coordKey(d) { return coordKeyFor("nuget", "", d.name); },

package/lib/codecs/pypi.codec.js

@@ -22,7 +22,13 @@ const LOCKS = [
 	["pdm.lock", P.parsePdmLock],
 ];
 
-const FALLBACK_MANIFESTS = ["pyproject.toml", "requirements.txt"];
+// The whole requirements*.txt family, not just the literal "requirements.txt": projects
+// using pip-compile/Dependabot keep their actual pins in requirements-pinned.txt (or
+// similar) while requirements.txt holds only ranges. requirements-(dev|test|lint|docs|…)
+// are dev/optional tooling.
+const REQ_RE = /^requirements.*\.txt$/i;
+const DEV_REQ_RE = /requirements[-_.](dev|test|tests|lint|docs?|typing|type|check|ci|mypy|style|format)\b/i;
+const reqFilesIn = names => [...names].filter(n => REQ_RE.test(n)).sort();
 
 function findPyDirs(dir, skipDir = (child, name) => SKIP.has(name)) {
 	const groups = [];
@@ -31,7 +37,8 @@ function findPyDirs(dir, skipDir = (child, name) => SKIP.has(name)) {
 		const cur = stack.pop();
 		let entries; try { entries = fs.readdirSync(cur, { withFileTypes: true }); } catch { continue; }
 		const names = new Set(entries.filter(e => e.isFile()).map(e => e.name));
-		if ([...LOCKS.map(l => l[0]), ...FALLBACK_MANIFESTS].some(n => names.has(n))) groups.push({ dir: cur, names });
+		const qualifies = LOCKS.some(l => names.has(l[0])) || names.has("pyproject.toml") || reqFilesIn(names).length > 0;
+		if (qualifies) groups.push({ dir: cur, names });
 		for (const e of entries) if (e.isDirectory() && !skipDir(path.join(cur, e.name), e.name)) stack.push(path.join(cur, e.name));
 	}
 	return groups;
@@ -53,46 +60,62 @@ module.exports = {
 		const { ignoreTest, deps2Exclude } = opts;
 		const out = new Map();
 		const warnings = [];
+		const parsedManifests = [];
 		const add = (d, manifestPath) => {
 			if (ignoreTest && d.isDev) return;
 			if (deps2Exclude && deps2Exclude.test(d.name)) return;
-			out.set(coordKeyFor("pypi", "", d.name), makeDepRecord({ ecosystem: "pypi", namespace: "", name: d.name, version: d.version, manifestPath, scope: d.scope, isDev: d.isDev }));
+			const key = coordKeyFor("pypi", "", d.name);
+			const rec = makeDepRecord({ ecosystem: "pypi", namespace: "", name: d.name, version: d.version, manifestPath, scope: d.scope, isDev: d.isDev });
+			const existing = out.get(key);
+			if (!existing) { out.set(key, rec); return; }
+			// Same package across several requirements files: merge manifests, keep a concrete
+			// version, and let prod win over dev (declared prod anywhere ⇒ prod).
+			for (const p of rec.manifestPaths) if (!existing.manifestPaths.includes(p)) existing.manifestPaths.push(p);
+			if (!existing.version && rec.version) { existing.version = rec.version; if (!existing.versions.includes(rec.version)) existing.versions.push(rec.version); }
+			if (existing.isDev && !rec.isDev) { existing.isDev = false; existing.scope = rec.scope || "prod"; }
 		};
 		for (const g of findPyDirs(dir, pyDirFilter(dir, opts))) {
 			const lock = LOCKS.find(([n]) => g.names.has(n));
 			if (lock) {
 				const fp = path.join(g.dir, lock[0]);
+				parsedManifests.push(fp);
 				try { const { deps } = lock[1](fp); for (const d of deps) add(d, fp); }
 				catch (e) { warnings.push({ type: "parse-error", manifestPath: fp, message: `${lock[0]} parse failed: ${e.message}` }); }
 				continue;   // lockfile is authoritative for this directory
 			}
-			// No lockfile → best-effort from pyproject.toml and/or requirements.txt.
-			let pinned = 0, skipped = 0;
+			// No lockfile → best-effort from pyproject.toml and EVERY requirements*.txt file.
+			let skipped = 0;
 			const sources = [];
+			const before = out.size;
 			if (g.names.has("pyproject.toml")) {
 				const fp = path.join(g.dir, "pyproject.toml");
+				parsedManifests.push(fp);
 				try {
 					const r = P.parsePyprojectToml(fp);
 					for (const d of r.deps) add(d, fp);
-					pinned += r.deps.length; skipped += r.skipped;
+					skipped += r.skipped;
 					if (r.deps.length || r.skipped) sources.push("pyproject.toml");
 				} catch (e) { warnings.push({ type: "parse-error", manifestPath: fp, message: `pyproject.toml parse failed: ${e.message}` }); }
 			}
-			if (g.names.has("requirements.txt")) {
-				const fp = path.join(g.dir, "requirements.txt");
+			for (const rf of reqFilesIn(g.names)) {
+				const fp = path.join(g.dir, rf);
+				parsedManifests.push(fp);
+				const devFile = DEV_REQ_RE.test(rf);
 				try {
 					const r = P.parseRequirementsTxt(fp);
-					for (const d of r.deps) add(d, fp);
-					pinned += r.deps.length; skipped += r.skipped;
-					sources.push("requirements.txt");
+					for (const d of r.deps) add(devFile ? { ...d, isDev: true, scope: "dev" } : d, fp);
+					skipped += r.skipped;
+					sources.push(rf);
 					for (const miss of (r.missing || [])) warnings.push({ type: "missing-include", manifestPath: fp, message: `referenced requirements file not found: ${miss}` });
-				} catch (e) { warnings.push({ type: "parse-error", manifestPath: fp, message: `requirements.txt parse failed: ${e.message}` }); }
+				} catch (e) { warnings.push({ type: "parse-error", manifestPath: fp, message: `${rf} parse failed: ${e.message}` }); }
 			}
 			if (sources.length) {
-				warnings.push({ type: "no-lockfile", manifestPath: g.dir, message: `no lockfile (${sources.join(" + ")}) — best-effort: ${pinned} pinned, ${skipped} range(s) skipped` });
+				const pinned = out.size - before;
+				const shownSrc = sources.length > 4 ? `${sources.slice(0, 4).join(" + ")} + ${sources.length - 4} more` : sources.join(" + ");
+				warnings.push({ type: "no-lockfile", manifestPath: g.dir, message: `no lockfile (${shownSrc}) — best-effort: ${pinned} pinned, ${skipped} range(s) skipped` });
 			}
 		}
-		return { deps: out, warnings };
+		return { deps: out, warnings, parsedManifests };
 	},
 
 	coordKey(d) { return coordKeyFor("pypi", "", d.name); },

package/lib/codecs/recipes.js

@@ -56,6 +56,23 @@ const maven = {
 	directSection: "B. Or update the direct dependencies pulling them in",
 };
 
+function gradleConstraintsSnippet(items) {
+	const inner = items.map(it => `        implementation("${esc(it.groupId)}:${esc(it.artifactId)}:${esc(it.fixVersion)}")`).join("\n");
+	return `dependencies {
+    constraints {
+${inner}
+    }
+}`;
+}
+
+const gradle = {
+	label: "Gradle",
+	pinSection: "A. Pin vulnerable transitives via a constraints { } block",
+	pinIntro: cnt => `Add to the (sub)project <code>build.gradle(.kts)</code> dependencies block to force ${cnt} transitive${cnt > 1 ? "s" : ""} to a fixed version:`,
+	snippet: gradleConstraintsSnippet,
+	directSection: "B. Or bump the direct dependency (or its version in <code>gradle/libs.versions.toml</code>)",
+};
+
 const npm = {
 	label: "npm",
 	pinSection: "A. Pin vulnerable transitives via npm overrides",
@@ -140,4 +157,4 @@ const binary = {
 	directSection: "B. Prefer declaring these through a package manager (Maven/npm/NuGet/…)",
 };
 
-module.exports = { maven, npm, yarn, composer, pypi, nuget, go, ruby, binary, dependencyManagementSnippet, npmOverridesSnippet, yarnResolutionsSnippet, composerRequireSnippet, pipInstallSnippet, dotnetAddSnippet, goGetSnippet, bundleUpdateSnippet };
+module.exports = { maven, gradle, npm, yarn, composer, pypi, nuget, go, ruby, binary, dependencyManagementSnippet, gradleConstraintsSnippet, npmOverridesSnippet, yarnResolutionsSnippet, composerRequireSnippet, pipInstallSnippet, dotnetAddSnippet, goGetSnippet, bundleUpdateSnippet };

package/lib/codecs/ruby.codec.js

@@ -44,7 +44,9 @@ module.exports = {
 		const { deps2Exclude } = opts;
 		const out = new Map();
 		const warnings = [];
+		const parsedManifests = [];
 		for (const fp of findGemfileLocks(dir, dirFilter(dir, opts))) {
+			parsedManifests.push(fp);
 			try {
 				const { deps } = R.parseGemfileLockFile(fp);
 				for (const d of deps) {
@@ -53,7 +55,7 @@ module.exports = {
 				}
 			} catch (e) { warnings.push({ type: "parse-error", manifestPath: fp, message: `Gemfile.lock parse failed: ${e.message}` }); }
 		}
-		return { deps: out, warnings };
+		return { deps: out, warnings, parsedManifests };
 	},
 
 	coordKey(d) { return coordKeyFor("ruby", "", d.name); },

package/lib/cpe.js

@@ -147,6 +147,31 @@ function nodeAffectsDep(node, dep, cpeCoordMap) {
 	return false;
 }
 
+/**
+ * Does ANY vulnerable cpeMatch in this CVE name the dep's product/vendor — IGNORING the
+ * version range? This distinguishes "NVD has a CPE for this product but the dep version is
+ * out of range" (a genuine false positive worth filtering) from "NVD's CPE never names this
+ * product at all" (a coverage gap — NOT a false positive: the dep's own matcher, OSV or the
+ * CVE index, found it on a real coordinate, and CPE simply can't speak to it).
+ */
+function cveCpeNamesDep(cveRecord, dep, cpeCoordMap) {
+	const map = cpeCoordMap || loadCpeCoordMap();
+	const scan = nodes => {
+		for (const n of (nodes || [])) {
+			for (const m of (n.cpeMatch || n.cpe_match || [])) {
+				if (m.vulnerable === false) continue;
+				const parsed = parseCpe23Cached(m);
+				if (parsed && cpeMatchesDep(parsed, dep, map)) return true;
+			}
+			if (Array.isArray(n.children) && scan(n.children)) return true;
+		}
+		return false;
+	};
+	for (const cfg of (cveRecord?.configurations || [])) if (scan(cfg.nodes)) return true;
+	for (const uri of (cveRecord?.cpes || [])) { const p = parseCpe23(uri); if (p && cpeMatchesDep(p, dep, map)) return true; }
+	return false;
+}
+
 /**
  * A node is "context-only" when it carries no vulnerable cpeMatch (recursively) —
  * e.g. the "…AND runs on linux_kernel" platform node, whose CPEs are all
@@ -309,8 +334,19 @@ function refineMatchesWithCpe(matches, opts = {}) {
 		if (!rec.configurations.length && !rec.cpes.length) continue;
 		const { affected, confidence } = evaluateCveForDep(rec, m.dep, map);
 		m.cpeConfidence = confidence;
-		if (!affected && rec.configurations.length) {
-			// Configurations exist but version doesn't satisfy any → likely FP
+		// Mark a match as a CPE false-positive ONLY for a genuine VERSION contradiction:
+		// NVD's CPE names this product but the dep version is outside the vulnerable range.
+		// NEVER filter when:
+		//   - the match is OSV-confirmed — OSV did a precise, ecosystem-native version match
+		//     (its data is authoritative for the package ecosystems; don't let NVD override it);
+		//   - NVD's CPE never names this product (`!productNamed`) — that's a coverage gap, not
+		//     a false positive (covers every pypi/composer/nuget/go/ruby coord, and any maven/
+		//     npm artifact whose CPE product name simply differs from its coordinate).
+		// Without these guards the filter silently hid REAL CVEs (e.g. cryptography 46.0.5,
+		// fixed in 46.0.6) by dumping them into the false-positives appendix.
+		const isOsv = String(m.source || "").includes("osv");
+		const productNamed = cveCpeNamesDep(rec, m.dep, map);
+		if (!affected && productNamed && !isOsv) {
 			m.cpeFiltered = true;
 		}
 		if (affected && confidence === "exact" && m.confidence !== "exact") m.confidence = "exact";
@@ -325,6 +361,7 @@ module.exports = {
 	cpeMatchesDep,
 	nodeAffectsDep,
 	evaluateCveForDep,
+	cveCpeNamesDep,
 	refineMatchesWithCpe,
 	loadCpeCoordMap,
 };

package/lib/cve-match.js

@@ -122,6 +122,19 @@ function collectResolvedDeps(allPomMetadata, allPropsByPom, opts = {}) {
  *     for transitive deps. This mirrors Maven's behaviour where the root
  *     project's <dependencyManagement> wins over transitive depMgmt.
  */
+/**
+ * A transitive coord is itself a Maven artifact (ecosystem "maven"), but for REPORT
+ * grouping we attribute its ecosystemType to the build tool that pulled it in: if every
+ * root reaching it (the first node of each via-chain) is a Gradle direct dep, it belongs
+ * in the Gradle chapter; a Maven (or mixed/unknown) root keeps it in the Maven chapter.
+ * @param viaPaths array of chains [[rootCoord, …], …]; @param rootEcoType Map coordKey→type
+ */
+function inheritEcoType(viaPaths, rootEcoType) {
+	const roots = (viaPaths || []).map(p => p && p[0]).filter(Boolean);
+	const types = new Set(roots.map(r => rootEcoType.get(r)).filter(Boolean));
+	return (types.size === 1 && types.has("gradle")) ? "gradle" : "maven";
+}
+
 async function expandWithTransitives(resolvedDeps, opts = {}) {
 	const { verbose } = opts;
 	// Root depMgmt: every dep in the Map that has a concrete version becomes a
@@ -146,6 +159,11 @@ async function expandWithTransitives(resolvedDeps, opts = {}) {
 
 	if (verbose) console.log(`🌳 Resolving transitives for ${directs.length} direct deps…`);
 
+	// Root → ecosystemType, so a transitive pulled only by Gradle roots is reported in the
+	// Gradle chapter (not the Maven one) on a pure-Gradle project.
+	const rootEcoType = new Map();
+	for (const d of directs) rootEcoType.set(`${d.groupId}:${d.artifactId}`, d.ecosystemType || d.ecosystem || "maven");
+
 	const transitives = await resolveTransitiveDeps(directs, {
 		...opts,
 		rootDepMgmt,
@@ -165,7 +183,7 @@ async function expandWithTransitives(resolvedDeps, opts = {}) {
 			viaPaths: t.viaPaths || [t.via],
 			depth: t.depth,
 			ecosystem: "maven",
-			ecosystemType: "maven",
+			ecosystemType: inheritEcoType(t.viaPaths || [t.via], rootEcoType),
 		});
 		added++;
 	}
@@ -281,6 +299,7 @@ function matchDepsAgainstCves(resolvedDeps, cveIndex, opts = {}) {
 module.exports = {
 	collectResolvedDeps,
 	expandWithTransitives,
+	inheritEcoType,
 	matchDepsAgainstCves,
 	resolveDepVersion,
 	vendorMatchesGroup,