fad-checker 2.4.0 → 2.4.2

package/lib/codecs/nuget/registry.js

@@ -70,9 +70,29 @@ async function resolveRegistrationBase(base, fetcher, headers) {
 	return resolved;
 }
 
+// Packages with many versions ship a PAGED registration index: pages carry an
+// "@id" URL + [lower, upper] range instead of inline items. Without fetching
+// them, deprecation/outdated came back silently empty for exactly the popular
+// packages (Newtonsoft.Json, Serilog, …). Fetch only what the findings need:
+// the LAST page (latest version) and the page whose range covers `version`.
+async function inlineNeededPages(reg, version, fetcher, headers) {
+	const pages = reg.items || [];
+	const need = new Set();
+	const last = pages[pages.length - 1];
+	if (last && !Array.isArray(last.items) && last["@id"]) need.add(last);
+	for (const p of pages) {
+		if (Array.isArray(p.items) || !p["@id"]) continue;
+		if (version && p.lower != null && p.upper != null && cmp(version, p.lower) >= 0 && cmp(version, p.upper) <= 0) need.add(p);
+	}
+	await Promise.all([...need].map(async p => {
+		try { const r = await fetcher(p["@id"], { headers }); if (r.ok) { const j = await r.json(); if (Array.isArray(j.items)) p.items = j.items; } }
+		catch { /* page stays un-inlined — findings degrade, don't fail */ }
+	}));
+}
+
 // Custom registries first (NuGet v3 registration API: <regBase>/<lowerid>/index.json),
 // then api.nuget.org. A service-index base is resolved to its RegistrationsBaseUrl.
-async function fetchRegistration(name, { offline, registries = [], fetcher = globalThis.fetch } = {}) {
+async function fetchRegistration(name, { offline, version = null, registries = [], fetcher = globalThis.fetch } = {}) {
 	if (offline) return null;
 	const id = name.toLowerCase();
 	const bases = withPublic("nuget", registries);
@@ -86,7 +106,11 @@ async function fetchRegistration(name, { offline, registries = [], fetcher = glo
 		if (!regBase) { lastErr = "no registration base"; continue; }
 		try {
 			const res = await fetcher(`${regBase}${id}/index.json`, { headers });
-			if (res.ok) return await res.json();
+			if (res.ok) {
+				const reg = await res.json();
+				await inlineNeededPages(reg, version, fetcher, headers);
+				return reg;
+			}
 			lastErr = `HTTP ${res.status}`;
 		} catch (e) { lastErr = e.message; }
 	}
@@ -107,7 +131,7 @@ async function checkNugetRegistryDeps(deps, opts = {}) {
 		const key = `${t.name.toLowerCase()}@${t.version}`;
 		let ex = cache.entries[key];
 		if (!ex) {
-			const reg = await fetchRegistration(t.name, { offline, registries, ...(fetcher ? { fetcher } : {}) });
+			const reg = await fetchRegistration(t.name, { offline, version: t.version, registries, ...(fetcher ? { fetcher } : {}) });
 			if (reg && !reg.error) {
 				const f = nugetRegistrationToFindings(reg, { version: t.version });
 				ex = { deprecated: f.deprecated, latest: f.outdated?.latest || null, license: f.license || null };
@@ -126,7 +150,9 @@ async function checkNugetRegistryDeps(deps, opts = {}) {
 			if (verbose) process.stdout.write(`  outdated: ${t.name} ${t.version} → ${ex.latest}\n`);
 		}
 	})));
-	cache.meta = { fetchedAt: Date.now() };
+	// Offline reads must not re-stamp freshness — a stale cache would then look
+	// fresh to the next ONLINE run and skip its refetch.
+	if (!offline) cache.meta = { fetchedAt: Date.now() };
 	saveCache(cache);
 	return result;
 }

package/lib/codecs/nuget.codec.js

@@ -54,7 +54,40 @@ module.exports = {
 		const parsedManifests = [];
 		const add = (d, manifestPath) => {
 			if (deps2Exclude && deps2Exclude.test(d.name)) return;
-			out.set(coordKeyFor("nuget", "", d.name), makeDepRecord({ ecosystem: "nuget", namespace: "", name: d.name, version: d.version, manifestPath, scope: d.scope, isDev: d.isDev }));
+			const key = coordKeyFor("nuget", "", d.name);
+			const rec = makeDepRecord({ ecosystem: "nuget", namespace: "", name: d.name, version: d.version, manifestPath, scope: d.scope, isDev: d.isDev });
+			const existing = out.get(key);
+			if (!existing) { out.set(key, rec); return; }
+			// Same id across projects/TFMs: merge manifests and scan EVERY distinct
+			// resolved version (same convention as Maven) — set() overwrote the first.
+			for (const p of rec.manifestPaths) if (!existing.manifestPaths.includes(p)) existing.manifestPaths.push(p);
+			if (!existing.version && rec.version) { existing.version = rec.version; if (!existing.versions.includes(rec.version)) existing.versions.push(rec.version); }
+			else if (rec.version && !existing.versions.includes(rec.version)) existing.versions.push(rec.version);
+			if (existing.isDev && !rec.isDev) { existing.isDev = false; existing.scope = rec.scope || "prod"; }
+		};
+		// Directory.Packages.props applies to every project BELOW it (MSBuild walks
+		// UP from the project dir; nearest file wins). Looking only in the project's
+		// own directory missed root-level CPM — i.e. every modern centrally-managed
+		// solution collected ZERO deps. Memoised per starting dir.
+		const cpmMemo = new Map();
+		const cpmFor = async (startDir) => {
+			if (cpmMemo.has(startDir)) return cpmMemo.get(startDir);
+			let found = { map: {}, path: null };
+			let cur = startDir;
+			while (true) {
+				const fp = path.join(cur, "Directory.Packages.props");
+				if (fs.existsSync(fp)) {
+					try { found = { map: await N.parseDirectoryPackagesProps(fp), path: fp }; }
+					catch { /* unparsable props → best-effort without CPM */ }
+					break;
+				}
+				if (path.resolve(cur) === path.resolve(dir)) break;
+				const parent = path.dirname(cur);
+				if (parent === cur) break;
+				cur = parent;
+			}
+			cpmMemo.set(startDir, found);
+			return found;
 		};
 		for (const g of findNugetDirs(dir, dirFilter(dir, opts))) {
 			if (g.files.includes("packages.lock.json")) {
@@ -65,12 +98,9 @@ module.exports = {
 				continue;   // lockfile is authoritative for this directory
 			}
 			// No lockfile → best-effort from .csproj (+CPM) and packages.config + warning.
-			let cpm = {};
-			if (g.files.includes("Directory.Packages.props")) {
-				const cpmFp = path.join(g.dir, "Directory.Packages.props");
-				parsedManifests.push(cpmFp);
-				try { cpm = await N.parseDirectoryPackagesProps(cpmFp); } catch { /* ignore */ }
-			}
+			const cpmRes = g.csprojs.length ? await cpmFor(g.dir) : { map: {}, path: null };
+			const cpm = cpmRes.map;
+			if (cpmRes.path && !parsedManifests.includes(cpmRes.path)) parsedManifests.push(cpmRes.path);
 			let pinned = 0, skipped = 0;
 			for (const cs of g.csprojs) {
 				const fp = path.join(g.dir, cs);

package/lib/codecs/pypi/parse.js

@@ -40,6 +40,9 @@ function parseTomlPackages(filePath, type) {
 	const deps = [];
 	for (const p of pkgs) {
 		if (!p.name || !p.version) continue;
+		// uv.lock lists the project ITSELF as a package (source.virtual/editable = ".");
+		// it is not a registry dep and its name could shadow a real PyPI package.
+		if (p.source && (p.source.virtual != null || p.source.editable != null)) continue;
 		// pdm/poetry≥1.5 use `groups`; classic poetry.lock (≤1.4) uses `category = "dev"`.
 		const groups = Array.isArray(p.groups) ? p.groups : null;
 		const isDev = groups
@@ -130,14 +133,20 @@ function collectReqGraph(filePath, seen, kind, acc) {
 	catch { acc.missing.push(real); return; }
 	const dir = path.dirname(real);
 	for (const raw of lines) {
-		const line = raw.replace(/(^|\s)#.*$/, "").trim();
+		let line = raw.replace(/(^|\s)#.*$/, "").trim();
+		if (!line) continue;
+		// pip-compile --generate-hashes writes "pkg==1.0 \" + indented "--hash=…"
+		// continuation lines. The trailing backslash made isPinned() reject the
+		// spec, silently skipping EVERY dep of a hash-pinned file.
+		line = line.replace(/\\$/, "").trim();
 		if (!line) continue;
 		const rMatch = line.match(/^(?:-r|--requirement)[=\s]+(.+)$/);
 		if (rMatch) { collectReqGraph(path.resolve(dir, rMatch[1].trim()), seen, kind, acc); continue; }
 		const cMatch = line.match(/^(?:-c|--constraint)[=\s]+(.+)$/);
 		if (cMatch) { collectReqGraph(path.resolve(dir, cMatch[1].trim()), seen, "constraint", acc); continue; }
 		if (line.startsWith("-")) continue;              // -e ., --hash, other flags
-		const { name, spec } = splitPep508(line);
+		// Per-requirement options ("pkg==1.0 --hash=sha256:…") come after the spec.
+		const { name, spec } = splitPep508(line.split(/\s+--/)[0].trim());
 		if (!name) continue;
 		const n = pep503(name);
 		if (kind === "constraint") acc.constraints.set(n, spec);

package/lib/codecs/pypi/registry.js

@@ -106,7 +106,9 @@ async function checkPypiRegistryDeps(deps, opts = {}) {
 			if (verbose) process.stdout.write(`  outdated: ${t.name} ${t.version} → ${ex.latest}\n`);
 		}
 	})));
-	cache.meta = { fetchedAt: Date.now() };
+	// Offline reads must not re-stamp freshness — a stale cache would then look
+	// fresh to the next ONLINE run and skip its refetch.
+	if (!offline) cache.meta = { fetchedAt: Date.now() };
 	saveCache(cache);
 	return result;
 }

package/lib/codecs/pypi.codec.js

@@ -72,6 +72,9 @@ module.exports = {
 			// version, and let prod win over dev (declared prod anywhere ⇒ prod).
 			for (const p of rec.manifestPaths) if (!existing.manifestPaths.includes(p)) existing.manifestPaths.push(p);
 			if (!existing.version && rec.version) { existing.version = rec.version; if (!existing.versions.includes(rec.version)) existing.versions.push(rec.version); }
+			// Two files pinning DIFFERENT versions of the same package: every distinct
+			// concrete version is scanned (same convention as Maven), not just the first.
+			else if (rec.version && !existing.versions.includes(rec.version)) existing.versions.push(rec.version);
 			if (existing.isDev && !rec.isDev) { existing.isDev = false; existing.scope = rec.scope || "prod"; }
 		};
 		for (const g of findPyDirs(dir, pyDirFilter(dir, opts))) {

package/lib/cve-download.js

@@ -16,6 +16,8 @@ const { execFile } = require("child_process");
 const { promisify } = require("util");
 const execFileP = promisify(execFile);
 
+const { compareMavenVersions, versionLikeBound } = require("./maven-version");
+
 const CVE_DATA_DIR = path.join(os.homedir(), ".fad-checker", "cve-data");
 const CVE_INDEX_PATH = path.join(CVE_DATA_DIR, "maven-cve-index.json");
 const CVE_META_PATH = path.join(CVE_DATA_DIR, "meta.json");
@@ -42,6 +44,45 @@ const KNOWN_JAVA_VENDORS = new Set([
 	"squareup", "okhttp",
 ]);
 
+// Curated CPE vendor:product → Maven coord map, shared with lib/cpe.js. Used
+// here at index-build time to (1) keep product-only records that name a known
+// Java product and (2) backfill their packageName so tier-1 exact matching works.
+let COORD_MAP_CACHE = null;
+function coordMap() {
+	if (!COORD_MAP_CACHE) {
+		try { COORD_MAP_CACHE = require("../data/cpe-coord-map.json"); }
+		catch { COORD_MAP_CACHE = { byVendorProduct: {} }; }
+	}
+	return COORD_MAP_CACHE;
+}
+
+/**
+ * Resolve a CNA vendor/product pair to curated Maven coords. CNAs publish
+ * legal-entity vendors ("Apache Software Foundation") and display products
+ * ("Apache Log4j2"), so the lookup tries every vendor token against the
+ * product as written (spaces → "_", CPE convention) and with the leading
+ * vendor word stripped ("apache log4j2" → "log4j2").
+ */
+function curatedCoordsFor(vendor, product) {
+	if (!product) return [];
+	const map = coordMap().byVendorProduct || {};
+	const p = String(product).toLowerCase().trim();
+	const vTokens = String(vendor || "").toLowerCase().split(/[^a-z0-9.]+/).filter(Boolean);
+	const candidates = new Set([p.replace(/\s+/g, "_")]);
+	const words = p.split(/\s+/);
+	while (words.length > 1 && vTokens.includes(words[0])) words.shift();
+	candidates.add(words.join("_"));
+	const out = new Set();
+	for (const vt of vTokens) {
+		for (const cand of candidates) {
+			for (const c of map[`${vt}:${cand}`] || []) out.add(c);
+		}
+	}
+	return [...out];
+}
+
+const PRODUCT_HEURISTIC = /^(spring-|jackson-|commons-|hibernate-|netty-|guava|log4j|slf4j|okhttp|httpclient|jetty-|tomcat-|struts-)/;
+
 function isMavenRelevant(affected) {
 	if (!affected || !Array.isArray(affected)) return false;
 	for (const a of affected) {
@@ -50,9 +91,16 @@ function isMavenRelevant(affected) {
 		if (a.versions?.some(v => v.versionType === "maven")) return true;
 		const v = String(a.vendor || "").toLowerCase();
 		const p = String(a.product || "").toLowerCase();
+		// CNAs publish legal-entity vendor strings ("Apache Software Foundation",
+		// "QOS.ch Sarl"): any single token matching a known Java vendor counts —
+		// exact-set membership alone dropped CVE-2021-44228 from the index.
 		if (KNOWN_JAVA_VENDORS.has(v)) return true;
-		// Heuristic: product names that look like Maven artifactIds
-		if (/^(spring-|jackson-|commons-|hibernate-|netty-|guava|log4j|slf4j|okhttp|httpclient|jetty-|tomcat-|struts-)/.test(p)) return true;
+		if (v.split(/[^a-z0-9.]+/).some(t => KNOWN_JAVA_VENDORS.has(t))) return true;
+		// Heuristic: product names that look like Maven artifactIds — also after
+		// stripping a leading vendor word ("apache log4j2" → "log4j2").
+		const stripped = p.replace(/^[a-z0-9.]+\s+/, "");
+		if (PRODUCT_HEURISTIC.test(p) || PRODUCT_HEURISTIC.test(stripped)) return true;
+		if (curatedCoordsFor(a.vendor, a.product).length) return true;
 	}
 	return false;
 }
@@ -91,31 +139,70 @@ function severityFromScore(s) {
 	return "NONE";
 }
 
+/**
+ * CVE 5.x `versions[]` entries may carry a `changes[]` timeline: the range
+ * [version, lessThan*) starts in `status` and flips at each `at` boundary.
+ * That is how CVE-2021-44228 encodes its affected windows (2.0-beta9→2.3.1,
+ * 2.4→2.12.2, 2.13.0→2.15.0). Expand them into plain affected windows the
+ * matcher already understands; ignoring `changes` would both miss real hits
+ * and flag the patched 2.12.2/2.3.1 backport lines.
+ */
+function expandVersionChanges(v) {
+	const changes = Array.isArray(v.changes) ? v.changes.filter(c => c && c.at) : [];
+	if (!changes.length) return null;
+	const sorted = [...changes].sort((a, b) => compareMavenVersions(a.at, b.at));
+	const windows = [];
+	let status = String(v.status || "affected").toLowerCase();
+	let start = v.version;
+	for (const c of sorted) {
+		if (status === "affected") {
+			windows.push({ version: start, status: "affected", versionType: v.versionType, lessThan: c.at, lessThanOrEqual: undefined });
+		}
+		status = String(c.status || "").toLowerCase();
+		start = c.at;
+	}
+	if (status === "affected") {
+		windows.push({ version: start, status: "affected", versionType: v.versionType, lessThan: v.lessThan, lessThanOrEqual: v.lessThanOrEqual });
+	}
+	return windows;
+}
+
 function extractAffectedRanges(affected) {
 	const out = [];
 	for (const a of affected || []) {
-		const packageName = a.packageName && String(a.packageName).includes(":") ? a.packageName : null;
+		const explicit = a.packageName && String(a.packageName).includes(":") ? a.packageName : null;
+		// Product-only records (the common shape for pre-2023 CVEs) get their
+		// coordinate(s) from the curated map so they land in byPackageName and
+		// match at tier-1. One product may map to several artifacts.
+		const packageNames = explicit ? [explicit] : curatedCoordsFor(a.vendor, a.product);
 		const vendor = a.vendor ? String(a.vendor).toLowerCase() : null;
 		const product = a.product ? String(a.product).toLowerCase() : null;
 		const versions = Array.isArray(a.versions) ? a.versions : [];
-		const ranges = versions.map(v => ({
+		const ranges = versions.flatMap(v => expandVersionChanges(v) || [{
 			version: v.version,
 			status: v.status,
 			versionType: v.versionType,
 			lessThan: v.lessThan,
 			lessThanOrEqual: v.lessThanOrEqual,
-		}));
-		out.push({ packageName, vendor, product, ranges });
+		}]);
+		out.push({ packageName: packageNames[0] || null, packageNames, vendor, product, ranges });
 	}
 	return out;
 }
 
+// Highest version-like upper bound across the affected ranges — the safe
+// "upgrade to at least" target. (First-match was wrong for multi-branch
+// records: struts 2.3.x fixed in 2.3.32 vs 2.5.x fixed in 2.5.10.1.)
 function fixVersionFromRanges(ranges) {
+	let best = null;
 	for (const r of ranges) {
-		if (r.lessThan) return r.lessThan;
-		if (r.lessThanOrEqual) return r.lessThanOrEqual;
+		for (const u of [r.lessThan, r.lessThanOrEqual]) {
+			if (!versionLikeBound(u)) continue;
+			const s = String(u).trim();
+			if (!best || compareMavenVersions(s, best) > 0) best = s;
+		}
 	}
-	return null;
+	return best;
 }
 
 function extractMavenRelevantCve(json) {
@@ -160,8 +247,9 @@ function addToIndex(index, cve) {
 			vendor: a.vendor,
 			product: a.product,
 		};
-		if (a.packageName) {
-			(index.byPackageName[a.packageName.toLowerCase()] ||= []).push(entry);
+		const names = a.packageNames?.length ? a.packageNames : (a.packageName ? [a.packageName] : []);
+		for (const n of names) {
+			(index.byPackageName[String(n).toLowerCase()] ||= []).push(entry);
 		}
 		if (a.product) {
 			(index.byProduct[a.product] ||= []).push(entry);
@@ -369,4 +457,7 @@ module.exports = {
 	ensureCveIndex,
 	extractMavenRelevantCve,
 	isMavenRelevant,
+	curatedCoordsFor,
+	newIndex,
+	addToIndex,
 };

package/lib/cve-report.js

@@ -403,11 +403,20 @@ function renderDefinedIn(dep, srcRoot) {
 	const paths = (dep.manifestPaths && dep.manifestPaths.length) ? dep.manifestPaths
 		: (dep.pomPaths && dep.pomPaths.length) ? dep.pomPaths
 		: [];
-	if (!paths.length) return "";
-	const rel = paths.map(p => makeRelative(p, srcRoot));
-	const shown = rel.slice(0, 3).map(p => `<code>${esc(p)}</code>`).join(", ");
-	const more = rel.length > 3 ? ` <span class="defined-more">+${rel.length - 3} more</span>` : "";
-	return `<div class="defined-in"><span class="defined-label">defined in:</span> ${shown}${more}</div>`;
+	let definedLine = "";
+	if (paths.length) {
+		const rel = paths.map(p => makeRelative(p, srcRoot));
+		const shown = rel.slice(0, 3).map(p => `<code>${esc(p)}</code>`).join(", ");
+		const more = rel.length > 3 ? ` <span class="defined-more">+${rel.length - 3} more</span>` : "";
+		definedLine = `<div class="defined-in"><span class="defined-label">defined in:</span> ${shown}${more}</div>`;
+	}
+	// A versionless declared dep (typical Spring Boot / Gradle) gets its version from an import
+	// BOM, not the manifest it's declared in. Disclose that so 6.0.3 doesn't read as fabricated.
+	const vs = dep.versionSource;
+	const versionLine = (vs && vs.via === "bom" && vs.bom)
+		? `<div class="defined-in"><span class="defined-label">version managed by:</span> <code>${esc(vs.bom)}</code> (BOM)</div>`
+		: "";
+	return definedLine + versionLine;
 }
 
 function makeRelative(absPath, srcRoot) {
@@ -1493,7 +1502,7 @@ function renderLicenseChapter(licenseResults) {
 	return intro + blocks;
 }
 
-function buildBody({ cveMatches, devCveMatches, embeddedMatches, retireMatches, vendoredJsInventory, eolResults, obsoleteResults, outdatedResults, licenseResults, excludedDirs = [], resolvedDeps, projectInfo, warnings, parsedManifests = [], diff = null, wrapTables = true }) {
+function buildBody({ cveMatches, devCveMatches, embeddedMatches, retireMatches, vendoredJsInventory, certFindings, eolResults, obsoleteResults, outdatedResults, licenseResults, excludedDirs = [], resolvedDeps, projectInfo, warnings, parsedManifests = [], diff = null, wrapTables = true }) {
 	setRenderCtx({ srcRoot: projectInfo?.src || null });
 	// Dedupe rows so a single (dep, cve) shows once with all via paths merged.
 	cveMatches      = mergeMatches(cveMatches || []);
@@ -1533,6 +1542,8 @@ function buildBody({ cveMatches, devCveMatches, embeddedMatches, retireMatches,
 	const unmanagedContent = renderUnmanagedInventory(unmanagedInventory, projectInfo?.src);
 	const vendoredJsInv    = vendoredJsInventory || [];
 	const vendoredJsContent = renderVendoredJsInventory(vendoredJsInv, projectInfo?.src);
+	const certInv          = certFindings || [];
+	const certContent      = renderCertificatesChapter(certInv, projectInfo?.src);
 	const fpContent        = renderFalsePositives([...prodMatchesFP, ...devMatchesFP, ...embMatchesFP]);
 
 	const toolbar = `<div class="toolbar">
@@ -1565,6 +1576,8 @@ function buildBody({ cveMatches, devCveMatches, embeddedMatches, retireMatches,
 	const embTotal = embeddedInventory.length;
 	const unmTotal = unmanagedInventory.length;
 	const vjsTotal = vendoredJsInv.length;
+	const certTotal = certInv.length;
+	const certPrivTotal = certInv.filter(c => c.kind === "private-key").length;
 	const excTotal = excludedDirs?.length || 0;
 	// CVE root header breakdown: direct vs indirect (transitive) production vulns + the dev count.
 	const prodDirect   = prodMatchesActive.filter(m => m.dep?.scope !== "transitive").length;
@@ -1581,12 +1594,13 @@ function buildBody({ cveMatches, devCveMatches, embeddedMatches, retireMatches,
 
 	// Root 2 — Unmanaged / unversioned components (binaries + vendored JS, no package manager).
 	const binRoot = majorSection(
-		`2. Unmanaged / unversioned components (${embTotal} embedded, ${unmTotal} native, ${vjsTotal} vendored JS)`,
+		`2. Unmanaged / unversioned components (${embTotal} embedded, ${unmTotal} native, ${vjsTotal} vendored JS, ${certTotal} crypto)`,
 		(embTotal ? minorSection(`2.1 Embedded binaries — JAR/WAR/EAR (${embTotal})`, embeddedContent, { id: "ch1e", open: embTotal <= 50 }) : "") +
 		(unmTotal ? minorSection(`2.2 Unmanaged / vendored native binaries (${unmTotal})`, unmanagedContent, { id: "ch1c", open: unmTotal <= 50 }) : "") +
-		(vjsTotal ? minorSection(`2.3 Unmanaged / vendored JavaScript (${vjsTotal})`, vendoredJsContent, { id: "ch1d", open: vjsTotal <= 50 }) : "") ||
-		`<div class="empty">No unmanaged binaries or vendored JavaScript found.</div>`,
-		{ id: "chbin", open: (embTotal + unmTotal + vjsTotal) > 0 });
+		(vjsTotal ? minorSection(`2.3 Unmanaged / vendored JavaScript (${vjsTotal})`, vendoredJsContent, { id: "ch1d", open: vjsTotal <= 50 }) : "") +
+		(certTotal ? minorSection(`2.4 Certificates &amp; key material (${certTotal}${certPrivTotal ? `, ${certPrivTotal} private key${certPrivTotal > 1 ? "s" : ""}` : ""})`, certContent, { id: "ch1f", open: certTotal <= 50 }) : "") ||
+		`<div class="empty">No unmanaged binaries, vendored JavaScript or committed crypto material found.</div>`,
+		{ id: "chbin", open: (embTotal + unmTotal + vjsTotal + certTotal) > 0 });
 
 	// Root 3 — Maintenance / lifecycle (EOL + obsolete + outdated).
 	const maintRoot = majorSection(
@@ -1618,10 +1632,11 @@ function buildBody({ cveMatches, devCveMatches, embeddedMatches, retireMatches,
 			{ id: "ch3", label: `Dev (${devStats.total})` },
 			...(fpTotal ? [{ id: "ch9", label: `Likely FP (${fpTotal})` }] : []),
 		] },
-		{ id: "chbin", label: `2. Unmanaged components (${embTotal + unmTotal + vjsTotal})`, sub: [
+		{ id: "chbin", label: `2. Unmanaged components (${embTotal + unmTotal + vjsTotal + certTotal})`, sub: [
 			...(embTotal ? [{ id: "ch1e", label: `Embedded (${embTotal})` }] : []),
 			...(unmTotal ? [{ id: "ch1c", label: `Native (${unmTotal})` }] : []),
 			...(vjsTotal ? [{ id: "ch1d", label: `Vendored JS (${vjsTotal})` }] : []),
+			...(certTotal ? [{ id: "ch1f", label: `Crypto (${certTotal})` }] : []),
 		] },
 		{ id: "chmaint", label: `3. Maintenance (${eolTotal + obsTotal + outTotal})`, sub: [
 			{ id: "ch4", label: `EOL (${eolTotal})` },
@@ -1813,6 +1828,48 @@ function renderVendoredJsInventory(inventory, srcRoot) {
 	return intro + `<table><thead><tr><th>Library</th><th>Version</th><th>File</th><th>Detection</th><th>Status</th></tr></thead><tbody>${rows}</tbody></table>`;
 }
 
+// Certificate / key-material inventory chapter (2.4). Every committed certificate,
+// private/public key and keystore the scan found, with crypto-hygiene findings.
+// 100% offline (built-in crypto.X509Certificate + header parsing — no network).
+const CERT_ISSUE_LABEL = {
+	"private-key-committed": "private key committed",
+	"public-key-committed": "public key",
+	"keystore-committed": "keystore",
+	"cert-expired": "EXPIRED",
+	"cert-expiring": "expiring soon",
+	"cert-weak-key": "weak key",
+	"cert-weak-signature": "weak signature",
+	"cert-self-signed": "self-signed",
+};
+const CERT_SEV_BG = { critical: "#7c0008", high: "#b91c1c", medium: "#ea580c", low: "#6b7280", info: "#6b7280" };
+
+function renderCertificatesChapter(inventory, srcRoot) {
+	if (!inventory || !inventory.length) return `<div class="empty">No committed certificates or key material found.</div>`;
+	const priv = inventory.filter(c => c.kind === "private-key").length;
+	const pub = inventory.filter(c => c.kind === "public-key").length;
+	const expired = inventory.filter(c => c.issues.some(i => i.type === "cert-expired")).length;
+	const intro = `<div class="fp-intro">Cryptographic material committed into the source tree — X.509 certificates, <strong>private &amp; public keys</strong> (PEM / OpenSSH every algorithm / PuTTY / PGP / one-line SSH) and Java/PKCS#12 keystores. Each key is labelled <strong>private</strong> (a committed secret — critical) or <strong>public</strong> (inventory). Detected and parsed entirely offline (built-in X.509 parser; no network, no decryption). <strong>${priv}</strong> private key${priv === 1 ? "" : "s"}, <strong>${pub}</strong> public key${pub === 1 ? "" : "s"}, <strong>${expired}</strong> expired certificate${expired === 1 ? "" : "s"}.</div>`;
+	const typePill = c => c.kind === "private-key" ? pill("🔑 PRIVATE KEY", CERT_SEV_BG.critical)
+		: c.kind === "public-key" ? pill("public key", "#2563eb")
+		: c.kind === "keystore" ? pill("keystore", "#b45309")
+		: pill("certificate", "#475569");
+	const rows = inventory.map(c => {
+		let rel = c.path;
+		if (srcRoot) { try { rel = path.relative(srcRoot, c.path); } catch { /* keep abs */ } }
+		const algo = `${esc(c.algorithm || "?")}${c.bits ? " " + esc(String(c.bits)) : ""}`;
+		let detail;
+		if (c.kind === "certificate") {
+			const exp = c.notAfter ? `exp ${esc(c.notAfter.slice(0, 10))}${c.daysUntilExpiry != null ? ` (${c.daysUntilExpiry}d)` : ""}` : "";
+			detail = `${esc(c.subject || "?")} <span style="color:#6b7280">← ${esc(c.issuer || "?")}</span><br><span style="color:#6b7280">${exp}</span>`;
+		} else {
+			detail = `<span style="color:#6b7280">${esc(c.format || "")}${c.encrypted === true ? " · encrypted" : c.encrypted === false ? " · UNENCRYPTED" : ""}${c.count > 1 ? ` · ${c.count} keys` : ""}</span>`;
+		}
+		const status = (c.issues || []).map(i => pill(CERT_ISSUE_LABEL[i.type] || i.type, CERT_SEV_BG[i.severity] || "#6b7280")).join(" ");
+		return `<tr><td class="dep"><code class="path">${esc(rel)}</code></td><td>${typePill(c)}</td><td>${algo}</td><td>${detail}</td><td>${status}</td><td><code class="path" style="color:#6b7280">${esc((c.sha256 || "").slice(0, 16))}…</code></td></tr>`;
+	}).join("\n");
+	return intro + `<table><thead><tr><th>File</th><th>Type</th><th>Algorithm</th><th>Details</th><th>Findings</th><th>SHA-256</th></tr></thead><tbody>${rows}</tbody></table>`;
+}
+
 function renderExcludedDirs(excludedDirs) {
 	if (!excludedDirs || !excludedDirs.length) return `<div class="empty">No directories were excluded from the scan.</div>`;
 	const byDefault = excludedDirs.filter(e => e.type === "default").length;
@@ -2344,12 +2401,12 @@ ${WORD_SECTION_PR}
 // Render the HTML and/or Word report. Callers pass explicit target paths;
 // a null/omitted path skips that format (so `--report-html` alone writes only HTML).
 // Back-compat: `outputDir` still writes both under the default file names.
-async function writeReports({ cveMatches, devCveMatches, embeddedMatches, retireMatches, vendoredJsInventory, eolResults, obsoleteResults, outdatedResults, licenseResults, excludedDirs, resolvedDeps, projectInfo, outputDir, htmlPath, docPath, warnings, parsedManifests, diff }) {
+async function writeReports({ cveMatches, devCveMatches, embeddedMatches, retireMatches, vendoredJsInventory, certFindings, eolResults, obsoleteResults, outdatedResults, licenseResults, excludedDirs, resolvedDeps, projectInfo, outputDir, htmlPath, docPath, warnings, parsedManifests, diff }) {
 	if (outputDir) {
 		if (htmlPath === undefined) htmlPath = path.join(outputDir, "cve-report.html");
 		if (docPath === undefined) docPath = path.join(outputDir, "cve-report.doc");
 	}
-	const payload = { cveMatches, devCveMatches, embeddedMatches, retireMatches, vendoredJsInventory, eolResults, obsoleteResults, outdatedResults, licenseResults, excludedDirs, resolvedDeps, projectInfo, warnings, parsedManifests, diff };
+	const payload = { cveMatches, devCveMatches, embeddedMatches, retireMatches, vendoredJsInventory, certFindings, eolResults, obsoleteResults, outdatedResults, licenseResults, excludedDirs, resolvedDeps, projectInfo, warnings, parsedManifests, diff };
 	const written = { htmlPath: null, docPath: null };
 	if (htmlPath) {
 		await fs.promises.mkdir(path.dirname(path.resolve(htmlPath)), { recursive: true });

package/lib/json-export.js

@@ -30,6 +30,9 @@ function depBrief(dep) {
 		provenance: dep.provenance || "manifest",
 		purl: purlFor(dep),
 		manifestPaths: dep.manifestPaths || dep.pomPaths || [],
+		// When the version was backfilled from an import/platform BOM, record which BOM
+		// supplied it — { via: "bom", bom: "g:a:v" } — so the finding is traceable.
+		versionSource: dep.versionSource || null,
 	};
 }
 
@@ -66,7 +69,7 @@ const SEV = ["critical", "high", "medium", "low", "none", "unknown"];
  */
 function buildFindings(payload = {}) {
 	const {
-		cveMatches = [], retireMatches = [], vendoredJsInventory = [], eolResults = [], obsoleteResults = [],
+		cveMatches = [], retireMatches = [], vendoredJsInventory = [], certFindings = [], eolResults = [], obsoleteResults = [],
 		outdatedResults = [], licenseResults = null, resolvedDeps, projectInfo = {}, toolVersion = "0",
 		typosquats = [], excludedDirs = [], diff = null,
 	} = payload;
@@ -105,6 +108,8 @@ function buildFindings(payload = {}) {
 			unmanaged: unmanaged.length,
 			embedded: embedded.length,
 			vendoredJs: vendoredJsInventory.length,
+			certificates: certFindings.length,
+			certPrivateKeys: certFindings.filter(c => c.kind === "private-key").length,
 			suppressed: cveMatches.filter(m => m.suppressed).length,
 			malicious: cveMatches.filter(m => m.malicious && !m.suppressed).length,
 			typosquat: typosquats.length,
@@ -119,6 +124,7 @@ function buildFindings(payload = {}) {
 		unmanaged,
 		embedded,
 		vendoredJs: vendoredJsInventory,
+		certificates: certFindings,
 		typosquat: typosquats,
 		excludedDirs,
 		// Differential audit vs a --baseline document (summary + per-category deltas).

package/lib/maven-bom.js

@@ -48,6 +48,12 @@ function collectImportBoms(propsByPom) {
 /**
  * Resolve each import BOM to its managed-version table and merge them into one map.
  * First BOM to manage a given g:a wins (mirrors Maven's declaration-order precedence).
+ *
+ * Each value is `{ version, bom }` where `bom` is the `groupId:artifactId:version` of the
+ * TOP-LEVEL platform/import BOM that supplied the version (e.g. spring-boot-dependencies),
+ * not the nested BOM it may import (spring-batch-bom) — that's the coordinate the user wrote
+ * in `platform(...)`/`<scope>import</scope>` and recognizes. Carried so backfillVersions can
+ * record per-dep provenance ("version managed by <bom>").
  */
 async function resolveBomManagedVersions(boms, opts = {}) {
 	const effectivePom = opts.effectivePom || transitive.effectivePom;
@@ -57,11 +63,12 @@ async function resolveBomManagedVersions(boms, opts = {}) {
 		try { eff = await effectivePom(bom.groupId, bom.artifactId, bom.version, opts); }
 		catch { eff = null; }
 		if (!eff || !eff.depMgmt) continue;
+		const bomCoord = `${bom.groupId}:${bom.artifactId}:${bom.version}`;
 		for (const d of eff.depMgmt) {
 			if (!d.groupId || !d.artifactId) continue;
 			const k = `${d.groupId}:${d.artifactId}`;
 			if (map.has(k)) continue;
-			if (d.version && !/\$\{/.test(String(d.version))) map.set(k, String(d.version));
+			if (d.version && !/\$\{/.test(String(d.version))) map.set(k, { version: String(d.version), bom: bomCoord });
 		}
 	}
 	return map;
@@ -69,7 +76,10 @@ async function resolveBomManagedVersions(boms, opts = {}) {
 
 /**
  * Fill the version of every Maven dep that has no concrete version (null or `${…}`)
- * from the BOM-managed map. Mutates the resolvedDeps Map entries in place.
+ * from the BOM-managed map. Mutates the resolvedDeps Map entries in place. Each filled
+ * dep is stamped with `versionSource = { via: "bom", bom: "<coord>" }` so the report can
+ * disclose that the version came from a BOM (e.g. "version managed by spring-boot-dependencies")
+ * rather than the manifest it's declared in — the usual versionless Spring Boot / Gradle case.
  * @returns number of deps filled
  */
 function backfillVersions(resolvedDeps, mgmtMap) {
@@ -78,11 +88,13 @@ function backfillVersions(resolvedDeps, mgmtMap) {
 		if (dep.ecosystem !== "maven") continue;
 		if (dep.provenance === "embedded" || dep.provenance === "binary") continue;
 		if (dep.version && !/\$\{/.test(String(dep.version))) continue; // already concrete
-		const v = mgmtMap.get(`${dep.groupId}:${dep.artifactId}`);
-		if (!v) continue;
+		const entry = mgmtMap.get(`${dep.groupId}:${dep.artifactId}`);
+		if (!entry) continue;
+		const v = entry.version;
 		dep.version = v;
 		if (!Array.isArray(dep.versions)) dep.versions = [];
 		if (!dep.versions.includes(v)) dep.versions.push(v);
+		dep.versionSource = { via: "bom", bom: entry.bom };
 		filled++;
 	}
 	return filled;