fad-checker 2.4.0 → 2.4.1

package/lib/cve-report.js

@@ -403,11 +403,20 @@ function renderDefinedIn(dep, srcRoot) {
 	const paths = (dep.manifestPaths && dep.manifestPaths.length) ? dep.manifestPaths
 		: (dep.pomPaths && dep.pomPaths.length) ? dep.pomPaths
 		: [];
-	if (!paths.length) return "";
-	const rel = paths.map(p => makeRelative(p, srcRoot));
-	const shown = rel.slice(0, 3).map(p => `<code>${esc(p)}</code>`).join(", ");
-	const more = rel.length > 3 ? ` <span class="defined-more">+${rel.length - 3} more</span>` : "";
-	return `<div class="defined-in"><span class="defined-label">defined in:</span> ${shown}${more}</div>`;
+	let definedLine = "";
+	if (paths.length) {
+		const rel = paths.map(p => makeRelative(p, srcRoot));
+		const shown = rel.slice(0, 3).map(p => `<code>${esc(p)}</code>`).join(", ");
+		const more = rel.length > 3 ? ` <span class="defined-more">+${rel.length - 3} more</span>` : "";
+		definedLine = `<div class="defined-in"><span class="defined-label">defined in:</span> ${shown}${more}</div>`;
+	}
+	// A versionless declared dep (typical Spring Boot / Gradle) gets its version from an import
+	// BOM, not the manifest it's declared in. Disclose that so 6.0.3 doesn't read as fabricated.
+	const vs = dep.versionSource;
+	const versionLine = (vs && vs.via === "bom" && vs.bom)
+		? `<div class="defined-in"><span class="defined-label">version managed by:</span> <code>${esc(vs.bom)}</code> (BOM)</div>`
+		: "";
+	return definedLine + versionLine;
 }
 
 function makeRelative(absPath, srcRoot) {

package/lib/json-export.js

@@ -30,6 +30,9 @@ function depBrief(dep) {
 		provenance: dep.provenance || "manifest",
 		purl: purlFor(dep),
 		manifestPaths: dep.manifestPaths || dep.pomPaths || [],
+		// When the version was backfilled from an import/platform BOM, record which BOM
+		// supplied it — { via: "bom", bom: "g:a:v" } — so the finding is traceable.
+		versionSource: dep.versionSource || null,
 	};
 }
 

package/lib/maven-bom.js

@@ -48,6 +48,12 @@ function collectImportBoms(propsByPom) {
 /**
  * Resolve each import BOM to its managed-version table and merge them into one map.
  * First BOM to manage a given g:a wins (mirrors Maven's declaration-order precedence).
+ *
+ * Each value is `{ version, bom }` where `bom` is the `groupId:artifactId:version` of the
+ * TOP-LEVEL platform/import BOM that supplied the version (e.g. spring-boot-dependencies),
+ * not the nested BOM it may import (spring-batch-bom) — that's the coordinate the user wrote
+ * in `platform(...)`/`<scope>import</scope>` and recognizes. Carried so backfillVersions can
+ * record per-dep provenance ("version managed by <bom>").
  */
 async function resolveBomManagedVersions(boms, opts = {}) {
 	const effectivePom = opts.effectivePom || transitive.effectivePom;
@@ -57,11 +63,12 @@ async function resolveBomManagedVersions(boms, opts = {}) {
 		try { eff = await effectivePom(bom.groupId, bom.artifactId, bom.version, opts); }
 		catch { eff = null; }
 		if (!eff || !eff.depMgmt) continue;
+		const bomCoord = `${bom.groupId}:${bom.artifactId}:${bom.version}`;
 		for (const d of eff.depMgmt) {
 			if (!d.groupId || !d.artifactId) continue;
 			const k = `${d.groupId}:${d.artifactId}`;
 			if (map.has(k)) continue;
-			if (d.version && !/\$\{/.test(String(d.version))) map.set(k, String(d.version));
+			if (d.version && !/\$\{/.test(String(d.version))) map.set(k, { version: String(d.version), bom: bomCoord });
 		}
 	}
 	return map;
@@ -69,7 +76,10 @@ async function resolveBomManagedVersions(boms, opts = {}) {
 
 /**
  * Fill the version of every Maven dep that has no concrete version (null or `${…}`)
- * from the BOM-managed map. Mutates the resolvedDeps Map entries in place.
+ * from the BOM-managed map. Mutates the resolvedDeps Map entries in place. Each filled
+ * dep is stamped with `versionSource = { via: "bom", bom: "<coord>" }` so the report can
+ * disclose that the version came from a BOM (e.g. "version managed by spring-boot-dependencies")
+ * rather than the manifest it's declared in — the usual versionless Spring Boot / Gradle case.
  * @returns number of deps filled
  */
 function backfillVersions(resolvedDeps, mgmtMap) {
@@ -78,11 +88,13 @@ function backfillVersions(resolvedDeps, mgmtMap) {
 		if (dep.ecosystem !== "maven") continue;
 		if (dep.provenance === "embedded" || dep.provenance === "binary") continue;
 		if (dep.version && !/\$\{/.test(String(dep.version))) continue; // already concrete
-		const v = mgmtMap.get(`${dep.groupId}:${dep.artifactId}`);
-		if (!v) continue;
+		const entry = mgmtMap.get(`${dep.groupId}:${dep.artifactId}`);
+		if (!entry) continue;
+		const v = entry.version;
 		dep.version = v;
 		if (!Array.isArray(dep.versions)) dep.versions = [];
 		if (!dep.versions.includes(v)) dep.versions.push(v);
+		dep.versionSource = { via: "bom", bom: entry.bom };
 		filled++;
 	}
 	return filled;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fad-checker",
-  "version": "2.4.0",
+  "version": "2.4.1",
   "description": "Scan ALL Maven, Gradle, npm, Yarn, Composer, Python, C#/.NET, Go & Ruby dependencies — plus embedded JARs (fat-jars/war/ear) — in a source tree ONE SHOT without mvn/python/etc — CVE (EPSS/KEV-prioritised), EOL, obsolete, outdated & licenses, with SBOM/CSAF/SARIF/JSON exports, CI gating and fix recos",
   "keywords": [
     "sca",