fad-checker 2.3.0 → 2.3.1

package/README.md

@@ -2,7 +2,7 @@
 
 [![npm version](https://img.shields.io/npm/v/fad-checker.svg)](https://www.npmjs.com/package/fad-checker)
 [![npm downloads](https://img.shields.io/npm/dm/fad-checker.svg)](https://www.npmjs.com/package/fad-checker)
-[![license](https://img.shields.io/npm/l/fad-checker.svg)](https://github.com/n8tz/fad-checker/blob/main/package.json)
+[![license](https://img.shields.io/npm/l/fad-checker.svg)](https://github.com/9pings/fad-checker/blob/main/package.json)
 [![node](https://img.shields.io/node/v/fad-checker.svg)](https://nodejs.org)
 
 > **F**abulous **A**utonomous **D**ependency **C**hecker<br>
@@ -10,7 +10,10 @@
 
 `fad-checker` audits **Maven · Gradle · npm · Yarn · pnpm · Composer · PyPI · NuGet · Go · Ruby**, vendored JavaScript and committed native binaries in any source tree — multi-module, monorepo, polyglot — and produces a self-contained **HTML + Word report** (CVE prioritised by EPSS + CISA KEV, EOL, obsolete, outdated, licenses) plus **CycloneDX SBOM / CSAF VEX / SARIF / JSON** exports. **No build tools, no Docker, no network needed** — it reads lockfiles and manifests straight off disk.
 
-🌐 **[Project site & docs →](https://n8tz.github.io/fad-checker/)**
+🌐 **[Project site & docs →](https://9pings.github.io/fad-checker/)**
+
+> [!WARNING]
+> **Young project — expect rough edges.** fad-checker is new and under active development, so it may still contain bugs (including false positives and false negatives). Treat its output as a strong first pass, **double-check anything critical**, and please [report issues](https://github.com/9pings/fad-checker/issues) — they get fixed fast.
 
 <p align="center"><img src="docs/assets/demo.gif" alt="fad-checker animated terminal demo — a [n/N] checklist warming each vulnerability database, then CVE findings coloured by severity with KEV badges" height="600"></p>
 

package/lib/codecs/gradle.codec.js

@@ -129,7 +129,7 @@ module.exports = {
 			const lockGoverned = lockedDirs.has(d) && !inBuildSrc(fp);
 			if (lockGoverned) continue; // lockfile already provided resolved deps for this dir
 			for (const dep of r.deps) addRec(dep, fp);
-			if (!inBuildSrc(fp)) warnings.push({ type: "gradle-no-lockfile", manifestPath: fp, message: `no gradle.lockfile next to ${path.relative(dir, fp) || path.basename(fp)} — versions resolved best-effort from the build script + version catalog (dynamic/programmatic deps may be missed). Enable Gradle dependency locking for exact coverage.` });
+			if (!inBuildSrc(fp)) warnings.push({ type: "no-lockfile", manifestPath: fp, message: `no gradle.lockfile next to ${path.relative(dir, fp) || path.basename(fp)} — versions resolved best-effort from the build script + version catalog (dynamic/programmatic deps may be missed). Enable Gradle dependency locking for exact coverage.` });
 			for (const u of r.unresolved) warnings.push({ type: "unresolved-versions", manifestPath: fp, message: `could not resolve the version variable for ${u.group}:${u.name} (${u.raw}) — excluded from CVE matching` });
 		}
 

package/lib/cve-report.js

@@ -1188,7 +1188,7 @@ function minorSection(title, contentHtml, opts = {}) {
 }
 
 const WARNING_HEADINGS = {
-	"no-lockfile":            { icon: "⚠️", title: "JS manifest without lockfile" },
+	"no-lockfile":            { icon: "⚠️", title: "Manifest without a lockfile — best-effort (ranges skipped)" },
 	"yarn-berry-unsupported": { icon: "⚠️", title: "Yarn 2+/Berry lockfile" },
 	"unresolved-versions":    { icon: "⚠️", title: "Maven deps without a concrete version — silently skipped, run a real Maven/Snyk scan to complete" },
 	"private-libs":           { icon: "🔒", title: "Private / internal libraries — not on Maven Central, not scanned" },

package/lib/osv.js

@@ -121,18 +121,32 @@ function severityFromOsv(vuln) {
 
 function scoreFromVuln(vuln) { return cvssInfoFromVuln(vuln).score; }
 
-/** Extract the first fix version from OSV affected ranges (semver/ecosystem events). */
-function fixVersionFromOsv(vuln, depKey) {
+/**
+ * Pick the fix version to recommend from OSV's affected ranges. A multi-branch advisory
+ * (e.g. Tomcat fixed in 9.0.118, 10.1.55 AND 11.0.22) lists one `fixed` per branch — the
+ * old code returned the FIRST, which for an 11.0.21 dep meant "upgrade to 9.0.118", i.e. a
+ * DOWNGRADE. Instead pick the smallest fix strictly ABOVE the current version: that's the
+ * next patched release on the dep's own branch. If none is greater (the branch has no
+ * published fix, or the dep is already patched), return null rather than suggest a downgrade.
+ */
+function fixVersionFromOsv(vuln, depKey, depVersion) {
+	const { compareMavenVersions } = require("./maven-version");
+	const fixes = [];
 	for (const a of vuln.affected || []) {
 		const name = a.package?.name?.toLowerCase();
 		if (name && name !== depKey.toLowerCase()) continue;
 		for (const r of a.ranges || []) {
 			for (const ev of r.events || []) {
-				if (ev.fixed) return ev.fixed;
+				if (ev.fixed) fixes.push(String(ev.fixed));
 			}
 		}
 	}
-	return null;
+	if (!fixes.length) return null;
+	const cmp = (x, y) => { try { return compareMavenVersions(x, y); } catch { return String(x).localeCompare(String(y)); } };
+	const sorted = [...fixes].sort(cmp);
+	if (!depVersion) return sorted[0]; // no current version to compare against → lowest published fix
+	const upgrades = sorted.filter(f => cmp(f, depVersion) > 0);
+	return upgrades.length ? upgrades[0] : null;
 }
 
 /** Pick the best CVE id from an OSV vuln (prefer CVE-* aliases over GHSA-*). */
@@ -188,7 +202,7 @@ function vulnToMatch(dep, vuln) {
 			...(cvss.version ? { cvssVersion: `CVSS:${cvss.version}` } : {}),
 			description,
 			summary,
-			fixVersion: fixVersionFromOsv(vuln, osvPkgName(dep)),
+			fixVersion: fixVersionFromOsv(vuln, osvPkgName(dep), dep.version),
 			ghsa: (vuln.aliases || []).find(a => a.startsWith("GHSA-")) || (vuln.id?.startsWith("GHSA-") ? vuln.id : null),
 			published: vuln.published || null,
 			modified: vuln.modified || null,

package/lib/sarif-export.js

@@ -116,7 +116,7 @@ function buildSarif(matches, opts = {}) {
 				driver: {
 					name: "fad-checker",
 					version: String(toolVersion),
-					informationUri: "https://github.com/n8tz/fad-checker",
+					informationUri: "https://github.com/9pings/fad-checker",
 					rules: [...rulesById.values()],
 				},
 			},

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fad-checker",
-  "version": "2.3.0",
+  "version": "2.3.1",
   "description": "Scan ALL Maven, Gradle, npm, Yarn, Composer, Python, C#/.NET, Go & Ruby dependencies — plus embedded JARs (fat-jars/war/ear) — in a source tree ONE SHOT without mvn/python/etc — CVE (EPSS/KEV-prioritised), EOL, obsolete, outdated & licenses, with SBOM/CSAF/SARIF/JSON exports, CI gating and fix recos",
   "keywords": [
     "sca",
@@ -45,9 +45,9 @@
     "cli"
   ],
   "license": "MIT",
-  "repository": "https://github.com/n8tz/fad-checker",
-  "homepage": "https://github.com/n8tz/fad-checker#readme",
-  "bugs": "https://github.com/n8tz/fad-checker/issues",
+  "repository": "https://github.com/9pings/fad-checker",
+  "homepage": "https://github.com/9pings/fad-checker#readme",
+  "bugs": "https://github.com/9pings/fad-checker/issues",
   "author": "pp9Ping <pp9Ping@gmail.com>",
   "maintainers": [
     "pp9Ping <pp9Ping@gmail.com>"