fad-checker 2.4.2 → 2.4.4

package/CHANGELOG.md

@@ -6,6 +6,31 @@ This project adheres to [Semantic Versioning](https://semver.org/).
 ## [Unreleased]
 
 ### Fixed
+- **External `<parent>` POMs (spring-boot-starter-parent) now backfill their managed
+  versions.** A versionless dep whose version is inherited from an external `<parent>`
+  (e.g. `spring-boot-starter-actuator` under `spring-boot-starter-parent`, whose own
+  parent `spring-boot-dependencies` holds the version table) was left unresolved and
+  **dropped from the CVE/OSV/EOL/outdated scans** — the mainline backfill (`lib/maven-bom.js`)
+  only handled `<scope>import</scope>` BOMs, never the `<parent>` case, so this failed
+  even online (the `--transitive` overlay resolved the parent but couldn't backfill the
+  primary version). `collectExternalParents()` now feeds external parents through the same
+  `effectivePom` → `backfillVersions` path as import BOMs (import BOMs win on precedence),
+  stamped `versionSource={via:"parent",…}` → report "version managed by … (parent POM)".
+  It runs in the **mainline** flow (not just `--transitive`), so the warmed cache always
+  captures the parent POMs for **offline/air-gapped** reuse. **Child property overrides are
+  honored** (Maven semantics): a project that redefines `<log4j2.version>2.17.1</log4j2.version>`
+  to patch a CVE resolves the managed coord to `2.17.1`, not the framework default
+  (`collectPropertyOverrides()` → `effectivePom`'s new `propertyOverrides`; import-BOM-managed
+  coords are correctly left un-overridden). The "missing parent POM — potentially private"
+  warning now **partitions** parents fad resolves from Maven Central/cache (public) from the
+  truly-unresolvable ones (private), instead of flagging every external parent as suspect.
+- **Anonymized descriptor closes the versionless-Spring-Boot round-trip in one exchange.**
+  The `fad-deps/1` descriptor now carries a `maven` hints block (`externalParents[]` +
+  `importBoms[]` coords + version `propertyOverrides{}`) so a no-source-tree online
+  `--import-anonymized` run can resolve the versionless deps' versions and warm their
+  `coord+version`-keyed CVE caches — previously that needed a second air-gapped exchange.
+  Only public coords + version strings travel (a private parent listed is a harmless online
+  no-op); the source tree never leaves the enclave.
 - **CVE-index recall: real-world pre-2023 records were dropped (incl. Log4Shell).**
   `isMavenRelevant()` only accepted CVE 5.x records carrying machine-readable Maven
   metadata (`packageName`/`collectionURL`/`versionType:"maven"`) or an EXACT-match

package/fad-checker.js

@@ -526,11 +526,24 @@ async function timedPhase(label, fn) {
 		let imported;
 		try { imported = deserializeDeps(descriptor); }
 		catch (e) { console.error(chalk.red(`❌  invalid descriptor: ${e.message}`)); process.exit(1); }
-		const { resolved, activeIds, runMaven, runNpm } = imported;
+		const { resolved, activeIds, runMaven, runNpm, externalParents = [], importBoms = [], propertyOverrides = {} } = imported;
 		ui.section("Anonymized descriptor");
 		ui.ok(`imported ${chalk.bold(resolved.size)} dep(s) across ${activeIds.join(", ") || "—"}`);
 		if (options.offline) ui.warn("--offline: caches won't warm; only useful to re-render from an already-warm cache");
 		if (!resolved.size) { ui.warn("descriptor has no dependencies — nothing to scan"); process.exit(0); }
+		// Replay the external-parent / import-BOM backfill from the descriptor's carried hints.
+		// Workflow B has no source tree here, so the mainline store-based backfill can't run —
+		// without this, versionless deps (spring-boot-starter-*) stay unresolved and their CVE
+		// caches never warm, forcing a SECOND air-gapped exchange. Online only (needs the POMs).
+		if (runMaven && !options.offline && (externalParents.length || importBoms.length)) {
+			const { resolveBomManagedVersions, backfillVersions } = require("./lib/maven-bom");
+			const base = { repos: mavenRepos, offline: options.offline, verbose, effCache: new Map() };
+			const mgmt = await resolveBomManagedVersions(importBoms, base);
+			const parentMgmt = await resolveBomManagedVersions(externalParents, { ...base, via: "parent", propertyOverrides });
+			for (const [k, v] of parentMgmt) if (!mgmt.has(k)) mgmt.set(k, v);
+			const filled = backfillVersions(resolved, mgmt);
+			if (filled) ui.ok(`backfilled ${chalk.bold(filled)} version(s) from ${externalParents.length} parent(s) + ${importBoms.length} BOM(s) in the descriptor`);
+		}
 		// Warm retire signatures (online) so --export-cache carries them for offline JS scanning.
 		if (runNpm && !options.offline && options.retire !== false) {
 			const { warmRetireSignatures } = require("./lib/retire");
@@ -625,8 +638,14 @@ async function timedPhase(label, fn) {
 	// --- Anonymized phase 1: export a descriptor and exit (no network, no report) ---
 	if (options.exportAnonymized) {
 		const { serializeDeps } = require("./lib/deps-descriptor");
+		const { collectExternalParents, collectImportBoms, collectPropertyOverrides } = require("./lib/maven-bom");
 		const pkgVersion = require("./package.json").version;
-		const descriptor = serializeDeps(resolved, { generator: `fad-checker ${pkgVersion}` });
+		// Carry the Maven resolution hints so a no-source-tree online warm run (Phase 2) can
+		// resolve the versionless deps' versions and warm their CVE caches in ONE exchange.
+		const externalParents = mavenCtx?.store ? collectExternalParents(mavenCtx.store) : [];
+		const importBoms = mavenCtx?.propsByPom ? collectImportBoms(mavenCtx.propsByPom) : [];
+		const propertyOverrides = mavenCtx?.store ? collectPropertyOverrides(mavenCtx.store) : {};
+		const descriptor = serializeDeps(resolved, { generator: `fad-checker ${pkgVersion}`, externalParents, importBoms, propertyOverrides });
 		try { fs.writeFileSync(options.exportAnonymized, JSON.stringify(descriptor, null, 2) + "\n"); }
 		catch (e) { console.error(chalk.red(`❌  could not write --export-anonymized file: ${e.message}`)); process.exit(1); }
 		const ecoSummary = Object.entries(descriptor.summary.byEcosystem).map(([k, v]) => `${k}:${v}`).join(", ");
@@ -691,9 +710,29 @@ async function timedPhase(label, fn) {
 				return !(allPomMetadata.byId[id] || allPomMetadata.byId[`${parts[0]}:${parts[1]}`]);
 			});
 		if (missingParents.length) {
-			ui.warn(`${missingParents.length} missing parent POM(s) — Snyk will fail if these are private:`);
-			for (const id of missingParents.slice(0, 10)) ui.info(chalk.yellow(id));
-			if (missingParents.length > 10) ui.info(chalk.dim(`…and ${missingParents.length - 10} more`));
+			// A parent absent from the source tree is EXTERNAL, not necessarily private. fad
+			// resolves a PUBLIC one (spring-boot-starter-parent, …) from Maven Central / warmed
+			// cache and backfills its managed versions — so only classify as "likely private"
+			// the ones it genuinely can't resolve. effectivePom is cache-first + offline-aware,
+			// and warms the cache the BOM/parent backfill reuses later in the report flow.
+			const { effectivePom } = require("./lib/transitive");
+			const resolvable = [], unresolved = [];
+			await Promise.all(missingParents.map(async id => {
+				const [g, a, v] = id.split(":");
+				let eff = null;
+				if (g && a && v) { try { eff = await effectivePom(g, a, v, { repos: mavenRepos, offline: options.offline }); } catch { eff = null; } }
+				(eff && eff.depMgmt && eff.depMgmt.length ? resolvable : unresolved).push(id);
+			}));
+			if (resolvable.length) {
+				ui.ok(`${resolvable.length} external parent POM(s) resolved from Maven Central${options.offline ? " (cache)" : ""} — managed versions backfilled`);
+				for (const id of resolvable.slice(0, 10)) ui.info(chalk.green(id));
+				if (resolvable.length > 10) ui.info(chalk.dim(`…and ${resolvable.length - 10} more`));
+			}
+			if (unresolved.length) {
+				ui.warn(`${unresolved.length} parent POM(s) not resolvable — likely private${options.offline ? " (or not in the warmed cache)" : ""}; Snyk will fail on these:`);
+				for (const id of unresolved.slice(0, 10)) ui.info(chalk.yellow(id));
+				if (unresolved.length > 10) ui.info(chalk.dim(`…and ${unresolved.length - 10} more`));
+			}
 		} else {
 			ui.ok("no missing Maven parent POMs");
 		}
@@ -828,7 +867,14 @@ async function runReportFlow(resolved, ecoFlags = {}) {
 		.map(b => ({ groupId: b.group, artifactId: b.name, version: b.version }))
 		.filter(b => b.groupId && b.artifactId && b.version);
 	const allBoms = importBoms.concat(gradleBoms);
-	const willBom = allBoms.length > 0;
+	// External <parent> POMs (e.g. spring-boot-starter-parent) manage versionless declared
+	// deps via their own inherited depMgmt (spring-boot-dependencies). core.js only follows
+	// LOCAL parents, so feed the external ones through the SAME backfill as import BOMs. This
+	// runs in the MAINLINE flow (not just the --transitive overlay) so the warmed cache always
+	// captures the parent POMs for offline reuse.
+	const externalParents = (runMaven && mavenStore)
+		? require("./lib/maven-bom").collectExternalParents(mavenStore) : [];
+	const willBom = allBoms.length > 0 || externalParents.length > 0;
 	const willOsv = !!options.osv;
 	// Local OSV DB import (Maven): offline-complete OSV recall, independent of the per-dep
 	// OSV.dev cache. Opt-in (downloads ~9 MB once); then matches online or offline.
@@ -850,12 +896,24 @@ async function runReportFlow(resolved, ecoFlags = {}) {
 	const progress = new ui.Progress(totalSteps);
 
 	if (willBom) {
-		const st = progress.start("BOM version resolution (Maven Central)");
+		const st = progress.start("BOM / parent version resolution (Maven Central)");
 		try {
 			const { resolveBomManagedVersions, backfillVersions } = require("./lib/maven-bom");
-			const mgmt = await resolveBomManagedVersions(allBoms, { repos: mavenRepos, offline, verbose });
+			const effCache = new Map();
+			const base = { repos: mavenRepos, offline, verbose, effCache };
+			// Import BOMs first: a local <scope>import</scope> declaration wins over the
+			// versions inherited from an external parent (Maven precedence). Import BOMs
+			// resolve in their own context — the project's property overrides do NOT reach
+			// them (Maven), so they get no propertyOverrides.
+			const mgmt = await resolveBomManagedVersions(allBoms, base);
+			// External parents second: fill only coords the BOMs didn't already manage, and
+			// honor the project's own <properties> overrides (e.g. a patched <log4j2.version>)
+			// so the version reflects the classpath, not the framework default.
+			const propertyOverrides = require("./lib/maven-bom").collectPropertyOverrides(mavenStore);
+			const parentMgmt = await resolveBomManagedVersions(externalParents, { ...base, via: "parent", propertyOverrides });
+			for (const [k, v] of parentMgmt) if (!mgmt.has(k)) mgmt.set(k, v);
 			const filled = backfillVersions(resolved, mgmt);
-			st.done(`${filled} dep version(s) from ${allBoms.length} import BOM(s)`);
+			st.done(`${filled} dep version(s) from ${allBoms.length} BOM(s) + ${externalParents.length} parent(s)`);
 		} catch (err) { st.fail(err.message); }
 	}
 
@@ -1145,6 +1203,18 @@ async function runReportFlow(resolved, ecoFlags = {}) {
 		}
 	}
 
+	// 6a-bis. Attribute every match to the manifest/module that actually resolves the
+	// version it matched on. A depRecord is coord-wide (versions[] and manifestPaths[]
+	// with no link between them); a match carries ONE version. Must run after ALL match
+	// sources are merged and before anything reads scope/paths (exec summary, charts,
+	// chapters, exports, gate) — otherwise, on a root spanning several independent
+	// projects, every version is reported against every manifest holding the coord.
+	{
+		const { attributeMatchOrigins } = require("./lib/attribution");
+		const reattributed = attributeMatchOrigins(cveMatches);
+		if (reattributed && verbose) console.log(`   re-attributed ${reattributed} match(es) to their resolving manifest/module`);
+	}
+
 	// 6b. Supply-chain risk lane (pure + offline): flag KNOWN-MALICIOUS advisories
 	// (OSV MAL-… already in the match set) always, and detect suspected TYPOSQUATS
 	// (opt-in --typosquat, heuristic — names one edit from a popular package).

package/lib/attribution.js

@@ -0,0 +1,82 @@
+/**
+ * lib/attribution.js — attribute each MATCH to the manifest/module that actually
+ * resolves the version it was matched on.
+ *
+ * A depRecord is COORD-WIDE: the collectors merge every occurrence of a g:a across the
+ * whole scan root into ONE record, so `versions[]` and `manifestPaths[]` are both
+ * coord-wide sets with no link between them, and `scope` is a single merged value. A
+ * MATCH, by contrast, carries exactly ONE version (matchOne clones the record per
+ * version). Left alone that clone inherits the coord-wide manifest list and the merged
+ * scope — so every version is reported against every manifest holding the coord.
+ *
+ * Invisible on a single reactor; wrong on the real-world shape fad is pointed at: an
+ * audit root holding SEVERAL INDEPENDENT projects (each pom with its own external
+ * parent, no shared reactor). Project A pins jackson-databind 2.15.3, project B pins
+ * 2.17.0 → both projects get reported as holding BOTH versions, and each version's CVEs
+ * land on both. Same class of error for a version the per-module overlay recovered: it
+ * is a TRANSITIVE of one module, not the direct declaration the record describes —
+ * unattributed it tops the exec summary's "direct production dependencies" pointing at
+ * the very pom that pins the fixed version.
+ *
+ * Two provenance sources, checked per match:
+ *   - `maskedVersions[]` (lib/version-overlay) — the version is a transitive of ONE
+ *     module: re-stamp scope/via/depth and file it under that module.
+ *   - `versionPaths{}` (lib/dep-record, maintained by the collectors) — the version is
+ *     DECLARED in a known subset of manifests: narrow the match to that subset.
+ * A version with neither (e.g. a global-pass transitive) is left untouched.
+ *
+ * Runs ONCE, after every match source is merged (CVE index, OSV, snyk) and before
+ * anything reads scope/paths (exec summary, charts, chapters, exports, gate).
+ * Pure w.r.t. the scan set: replaces `m.dep` with a clone, never mutating the shared
+ * record — other matches still reference it.
+ */
+
+/** manifestPaths and pomPaths must stay the SAME array (dep-record.js invariant). */
+function withPaths(dep, paths) {
+	const p = paths.slice();
+	return { ...dep, manifestPaths: p, pomPaths: p };
+}
+
+function sameList(a, b) {
+	const x = a || [], y = b || [];
+	return x.length === y.length && x.every((v, i) => v === y[i]);
+}
+
+/**
+ * @param matches the merged match set (mutated: each m.dep may be replaced by a clone)
+ * @returns number of matches re-attributed
+ */
+function attributeMatchOrigins(matches) {
+	let fixed = 0;
+	for (const m of matches || []) {
+		const dep = m && m.dep;
+		if (!dep || !dep.version) continue;
+		const ver = String(dep.version);
+
+		// 1. Recovered by the per-module overlay → a transitive of ONE module.
+		const masked = dep.scope !== "transitive" && Array.isArray(dep.maskedVersions)
+			? dep.maskedVersions.find(x => String(x.version) === ver)
+			: null;
+		if (masked) {
+			m.dep = {
+				...withPaths(dep, masked.module ? [masked.module] : []),
+				scope: "transitive",
+				via: masked.via || [],
+				viaPaths: masked.viaPaths || (masked.via ? [masked.via] : []),
+				depth: masked.depth,
+			};
+			fixed++;
+			continue;
+		}
+
+		// 2. Declared → narrow to the manifest(s) that declare THIS version.
+		const declared = dep.versionPaths && dep.versionPaths[ver];
+		if (Array.isArray(declared) && declared.length && !sameList(declared, dep.manifestPaths)) {
+			m.dep = withPaths(dep, declared);
+			fixed++;
+		}
+	}
+	return fixed;
+}
+
+module.exports = { attributeMatchOrigins };

package/lib/cve-match.js

@@ -83,6 +83,16 @@ function collectResolvedDeps(allPomMetadata, allPropsByPom, opts = {}) {
 				// A dep is "dev" overall only if every occurrence is test/provided.
 				if (!isDev) existing.isDev = false;
 			}
+			// Remember WHICH pom declares THIS version. The record is coord-wide, so
+			// this is the only link back from a scanned version to its manifest —
+			// without it a match on one version is reported against every pom that
+			// declares the coord at any version (lib/attribution.js consumes this).
+			if (concrete) {
+				const rec = out.get(key);
+				if (!rec.versionPaths) rec.versionPaths = {};
+				const paths = rec.versionPaths[concrete] || (rec.versionPaths[concrete] = []);
+				if (!paths.includes(pomPath)) paths.push(pomPath);
+			}
 		}
 	};
 

package/lib/cve-report.js

@@ -411,10 +411,12 @@ function renderDefinedIn(dep, srcRoot) {
 		definedLine = `<div class="defined-in"><span class="defined-label">defined in:</span> ${shown}${more}</div>`;
 	}
 	// A versionless declared dep (typical Spring Boot / Gradle) gets its version from an import
-	// BOM, not the manifest it's declared in. Disclose that so 6.0.3 doesn't read as fabricated.
+	// BOM or an external <parent> chain, not the manifest it's declared in. Disclose that so
+	// e.g. spring-boot-starter-actuator:2.7.18 doesn't read as fabricated.
 	const vs = dep.versionSource;
-	const versionLine = (vs && vs.via === "bom" && vs.bom)
-		? `<div class="defined-in"><span class="defined-label">version managed by:</span> <code>${esc(vs.bom)}</code> (BOM)</div>`
+	const vsKind = vs && vs.via === "parent" ? "parent POM" : "BOM";
+	const versionLine = (vs && (vs.via === "bom" || vs.via === "parent") && vs.bom)
+		? `<div class="defined-in"><span class="defined-label">version managed by:</span> <code>${esc(vs.bom)}</code> (${vsKind})</div>`
 		: "";
 	return definedLine + versionLine;
 }

package/lib/dep-record.js

@@ -55,6 +55,15 @@ function makeDepRecord(input) {
 		name,
 		version: version || null,
 		versions: concrete ? [concrete] : [],
+		// Per-version → the manifest(s) DECLARING that version. `versions[]` and
+		// `manifestPaths[]` are both coord-wide sets with no link between them, so
+		// neither says which manifest declared which version. A match carries ONE
+		// version, so without this link it renders against EVERY manifest holding the
+		// coord: on a scan root spanning several independent projects (A pins
+		// jackson-databind 2.15.3, B pins 2.17.0) both projects are reported as holding
+		// BOTH versions and each version's CVEs land on both. Maintained on merge by the
+		// collectors; consumed by lib/attribution.js.
+		versionPaths: concrete && manifestPath ? { [concrete]: [manifestPath] } : {},
 		coordKey,
 		provenance,
 		hashes,

package/lib/deps-descriptor.js

@@ -35,6 +35,13 @@ const ANON_NOTE = "Anonymized: public coordinates only — no paths, URLs, or ho
  *   generatedAt  — ISO timestamp (override for deterministic tests)
  *   note         — human-readable banner (defaults to the anonymization notice)
  */
+// Sanitize a parent/BOM coordinate to the three public fields only (never carry paths,
+// registry URLs or other record cruft into the descriptor).
+function cleanCoord(c) {
+	return (c && c.groupId && c.artifactId && c.version)
+		? { groupId: String(c.groupId), artifactId: String(c.artifactId), version: String(c.version) } : null;
+}
+
 function serializeDeps(resolvedMap, opts = {}) {
 	const { generator = "fad-checker", generatedAt = new Date().toISOString(), note = ANON_NOTE } = opts;
 	const deps = [];
@@ -59,12 +66,22 @@ function serializeDeps(resolvedMap, opts = {}) {
 	// Stable order so two runs over the same tree produce identical files (easier
 	// to diff/review and to detect tampering during transfer).
 	deps.sort((a, b) => (a.ecosystem + "\0" + a.namespace + "\0" + a.name).localeCompare(b.ecosystem + "\0" + b.namespace + "\0" + b.name));
+	// Maven resolution hints: the EXTERNAL parent + import-BOM coords that manage the
+	// versionless deps, plus the project's version-property overrides. These let a Phase-2
+	// online run (no source tree) resolve `spring-boot-starter-actuator`'s version and warm
+	// its CVE cache in ONE round-trip — the alternative is two exchanges (see docs/USAGE.md).
+	// Public coords + version strings only; the auditor reviews before transfer like the rest.
+	const externalParents = (opts.externalParents || []).map(cleanCoord).filter(Boolean);
+	const importBoms = (opts.importBoms || []).map(cleanCoord).filter(Boolean);
+	const propertyOverrides = (opts.propertyOverrides && typeof opts.propertyOverrides === "object") ? { ...opts.propertyOverrides } : {};
+	const hasMavenHints = externalParents.length || importBoms.length || Object.keys(propertyOverrides).length;
 	return {
 		schema: SCHEMA,
 		generator,
 		generatedAt,
 		note,
 		summary: { total: deps.length, byEcosystem },
+		...(hasMavenHints ? { maven: { externalParents, importBoms, propertyOverrides } } : {}),
 		deps,
 	};
 }
@@ -102,11 +119,18 @@ function deserializeDeps(descriptor) {
 		ecosystems.add(e.ecosystem);
 	}
 	const activeIds = [...ecosystems];
+	// Maven resolution hints (absent on legacy descriptors → empty). The import flow replays
+	// the external-parent / import-BOM backfill from these so a no-source-tree online warm run
+	// resolves the versionless deps' versions.
+	const mvn = (descriptor.maven && typeof descriptor.maven === "object") ? descriptor.maven : {};
 	return {
 		resolved,
 		activeIds,
 		runMaven: ecosystems.has("maven"),
 		runNpm: ecosystems.has("npm") || ecosystems.has("yarn"),
+		externalParents: Array.isArray(mvn.externalParents) ? mvn.externalParents : [],
+		importBoms: Array.isArray(mvn.importBoms) ? mvn.importBoms : [],
+		propertyOverrides: (mvn.propertyOverrides && typeof mvn.propertyOverrides === "object") ? mvn.propertyOverrides : {},
 	};
 }
 

package/lib/maven-bom.js

@@ -15,6 +15,76 @@
  * skips it offline). Pure except for the injected/real effectivePom fetch.
  */
 const transitive = require("./transitive");
+const core = require("./core");
+
+/**
+ * Walk each parsed pom's LOCAL parent chain and collect the distinct EXTERNAL parent
+ * coordinates — the parent POMs referenced by a `<parent>` element but NOT present in
+ * the source tree (e.g. `spring-boot-starter-parent`, whose own parent
+ * `spring-boot-dependencies` holds the managed-version table). Maven inherits their
+ * `<dependencyManagement>` into the child, which is how a versionless
+ * `spring-boot-starter-actuator` gets its version — but core.js only follows LOCAL
+ * parents, so without this those versions stay unresolved and drop out of the scan.
+ *
+ * Deduped by g:a:v; unresolved (`${…}`) or incomplete coords are skipped. The result
+ * is fed to resolveBomManagedVersions/backfillVersions exactly like an import BOM.
+ * @param store the metadata store (byPath[pom].parentInfo + byId), as built by core.js
+ * @returns [{ groupId, artifactId, version }]
+ */
+function collectExternalParents(store) {
+	if (!store || !store.byPath) return [];
+	const seen = new Set();
+	const out = [];
+	for (const pomPath of Object.keys(store.byPath)) {
+		let cur = pomPath;
+		const localSeen = new Set();
+		while (cur && !localSeen.has(cur)) {
+			localSeen.add(cur);
+			const meta = store.byPath[cur];
+			if (!meta) break;
+			const parentPath = core.resolveParentPath(cur, meta.parentInfo, store);
+			if (parentPath) { cur = parentPath; continue; }   // local parent → keep climbing
+			// No local parent POM: if a <parent> is declared, it's EXTERNAL.
+			const p = meta.parentInfo;
+			if (p && p.groupId && p.artifactId && p.version && !/\$\{/.test(String(p.version))) {
+				const k = `${p.groupId}:${p.artifactId}:${p.version}`;
+				if (!seen.has(k)) { seen.add(k); out.push({ groupId: p.groupId, artifactId: p.artifactId, version: p.version }); }
+			}
+			break;
+		}
+	}
+	return out;
+}
+
+/**
+ * Collect the version-property OVERRIDES a project declares in its own `<properties>`
+ * blocks — the Maven mechanism for patching a coord managed by an external parent
+ * (e.g. `<log4j2.version>2.17.1</log4j2.version>` overrides spring-boot-dependencies'
+ * default). Fed to effectivePom as `propertyOverrides` so the parent's managed table
+ * resolves to the version actually on the classpath, not the framework default.
+ *
+ * Source is each pom's OWN declared props (store.byPath[pom].properties, raw xml2js
+ * `{name:[value]}`) — NOT the merged/inherited map — so we never mistake an inherited
+ * builtin for an override. `project.*`/`pom.*` model expressions and unresolved `${…}`
+ * values are excluded. Merged across modules (last wins); real-world overrides live in
+ * the root and are consistent, so the common case is exact.
+ * @returns { [propName]: value }
+ */
+function collectPropertyOverrides(store) {
+	const out = {};
+	if (!store || !store.byPath) return out;
+	for (const meta of Object.values(store.byPath)) {
+		const raw = meta && meta.properties;
+		if (!raw || typeof raw !== "object") continue;
+		for (const [k, val] of Object.entries(raw)) {
+			if (k.startsWith("project.") || k.startsWith("pom.")) continue;
+			const v = Array.isArray(val) ? val[0] : val;
+			if (typeof v !== "string" || /\$\{/.test(v)) continue;
+			out[k] = v;
+		}
+	}
+	return out;
+}
 
 /**
  * Extract the distinct external import-BOM coordinates from the parsed poms' merged
@@ -57,6 +127,10 @@ function collectImportBoms(propsByPom) {
  */
 async function resolveBomManagedVersions(boms, opts = {}) {
 	const effectivePom = opts.effectivePom || transitive.effectivePom;
+	// `via` labels where the managed version came from: "bom" (import BOM, the default)
+	// or "parent" (an external <parent> chain). Only stamped when non-default so the
+	// import-BOM entry shape stays byte-identical to before.
+	const via = opts.via && opts.via !== "bom" ? opts.via : null;
 	const map = new Map();
 	for (const bom of boms) {
 		let eff = null;
@@ -68,7 +142,7 @@ async function resolveBomManagedVersions(boms, opts = {}) {
 			if (!d.groupId || !d.artifactId) continue;
 			const k = `${d.groupId}:${d.artifactId}`;
 			if (map.has(k)) continue;
-			if (d.version && !/\$\{/.test(String(d.version))) map.set(k, { version: String(d.version), bom: bomCoord });
+			if (d.version && !/\$\{/.test(String(d.version))) map.set(k, { version: String(d.version), bom: bomCoord, ...(via ? { via } : {}) });
 		}
 	}
 	return map;
@@ -94,7 +168,7 @@ function backfillVersions(resolvedDeps, mgmtMap) {
 		dep.version = v;
 		if (!Array.isArray(dep.versions)) dep.versions = [];
 		if (!dep.versions.includes(v)) dep.versions.push(v);
-		dep.versionSource = { via: "bom", bom: entry.bom };
+		dep.versionSource = { via: entry.via || "bom", bom: entry.bom };
 		filled++;
 	}
 	return filled;
@@ -113,4 +187,4 @@ async function resolveAndBackfill(propsByPom, resolvedDeps, opts = {}) {
 	return { boms: boms.length, filled, mgmtSize: map.size };
 }
 
-module.exports = { collectImportBoms, resolveBomManagedVersions, backfillVersions, resolveAndBackfill };
+module.exports = { collectExternalParents, collectPropertyOverrides, collectImportBoms, resolveBomManagedVersions, backfillVersions, resolveAndBackfill };

package/lib/transitive.js

@@ -181,7 +181,14 @@ function resolveProps(value, props, builtins, depth = 0) {
  * BOM imports inside depMgmt are recursively expanded.
  */
 async function effectivePom(g, a, v, opts = {}, seen = new Set()) {
-	const key = `${g}:${a}:${v}`;
+	// A downstream project inheriting this POM as its <parent> can override a version
+	// property in its own <properties> (the Spring Boot way to patch a managed coord).
+	// opts.propertyOverrides models that: they win over this chain's own property values
+	// when resolving depMgmt. They're part of the cache key so an override-free resolution
+	// (import-BOM path) and an overridden one (parent path) don't collide in effCache.
+	const ovKeys = opts.propertyOverrides ? Object.keys(opts.propertyOverrides) : [];
+	const ovSuffix = ovKeys.length ? "|ov:" + ovKeys.sort().map(k => `${k}=${opts.propertyOverrides[k]}`).join(",") : "";
+	const key = `${g}:${a}:${v}${ovSuffix}`;
 	if (seen.has(key)) return null;
 	// Opt-in cross-call memo (used by the per-module overlay, which resolves the
 	// same shared parents/BOMs once per module). Immutable POMs → the effective
@@ -227,21 +234,28 @@ async function effectivePom(g, a, v, opts = {}, seen = new Set()) {
 		"pom.artifactId": merged.artifactId,
 		"pom.version": merged.version,
 	};
+	// Child overrides win over this chain's own property values (Maven: a child's
+	// <properties> override an inherited parent's). Applies to the PARENT chain only —
+	// import-BOM managed versions resolve in the BOM's own context (stripped below).
+	const effProps = ovKeys.length ? { ...merged.properties, ...opts.propertyOverrides } : merged.properties;
 	const resolveDep = d => ({
 		...d,
-		groupId: resolveProps(d.groupId, merged.properties, builtins),
-		artifactId: resolveProps(d.artifactId, merged.properties, builtins),
-		version: resolveProps(d.version, merged.properties, builtins),
+		groupId: resolveProps(d.groupId, effProps, builtins),
+		artifactId: resolveProps(d.artifactId, effProps, builtins),
+		version: resolveProps(d.version, effProps, builtins),
 	});
 	merged.depMgmt = merged.depMgmt.map(resolveDep);
 	merged.deps = merged.deps.map(resolveDep);
 
 	// Expand BOM imports inside depMgmt: any entry with scope=import + type=pom
-	// is replaced by the depMgmt entries from that imported POM.
+	// is replaced by the depMgmt entries from that imported POM. A <scope>import</scope>
+	// BOM resolves its managed versions in ITS OWN property context — the importing
+	// project's overrides do NOT reach it — so drop propertyOverrides across this boundary.
+	const importOpts = ovKeys.length ? { ...opts, propertyOverrides: undefined } : opts;
 	const expanded = [];
 	for (const dm of merged.depMgmt) {
 		if (dm.scope === "import") {
-			const imported = await effectivePom(dm.groupId, dm.artifactId, dm.version, opts, new Set(seen));
+			const imported = await effectivePom(dm.groupId, dm.artifactId, dm.version, importOpts, new Set(seen));
 			if (imported) expanded.push(...imported.depMgmt);
 		} else {
 			expanded.push(dm);

package/lib/version-overlay.js

@@ -121,27 +121,48 @@ async function buildModuleManagement(pomPath, store, propsByPom, opts = {}) {
 }
 
 /**
- * The direct dependencies declared by ONE module, with concrete versions resolved
- * (own ${properties} → module's managed map → the global resolved version). These
- * seed the per-module transitive walk.
+ * The direct dependencies of ONE module, with concrete versions resolved (own
+ * ${properties} → module's managed map → the global resolved version). These seed
+ * the per-module transitive walk.
+ *
+ * Includes the <dependencies> INHERITED from the local parent chain. Maven inherits
+ * them into the child, where they stay DIRECT (depth-0) deps and therefore beat any
+ * transitive of the same coord — but core.js#getAllInheritedProps deliberately does
+ * NOT merge parent <dependencies> into propsByPom[child] (collectResolvedDeps merges
+ * them globally by g:a instead). Reading only the module's own <dependencies> would
+ * hide a parent-declared remediation (e.g. commons-compress:1.27.1 overriding the
+ * vulnerable 1.24.0 that minio pulls in) and let the overlay "recover" the very
+ * version that declaration overrides — fabricating CVEs against a version no
+ * classpath holds.
+ *
+ * Chain is child-first, so the closest declaration of a g:a wins, like Maven. `props`
+ * is the child's merged map (parent props as base, child overrides on top), which is
+ * the right context for a parent-declared dep too.
  */
-function buildModuleDirects(pomPath, propsByPom, moduleMgmt, resolvedDeps, opts = {}) {
+function buildModuleDirects(pomPath, store, propsByPom, moduleMgmt, resolvedDeps, opts = {}) {
 	const entry = propsByPom[pomPath];
 	if (!entry) return [];
 	const props = entry.properties || {};
 	const out = [];
-	for (const node of entry.dependencies || []) {
-		const d = flattenSafe(node);
-		if (!d || !d.groupId || !d.artifactId || d.optional || d.isImport) continue;
-		if (d.scope === "test" && !opts.includeTestDeps) continue;
-		if (d.scope === "system" || d.scope === "import") continue;
-		// Interpolate ${…} in the coordinate (e.g. ${project.groupId}) like the version.
-		const gid = resolveDepVersion(d.groupId, props);
-		const aid = resolveDepVersion(d.artifactId, props);
-		let v = resolveDepVersion(d.rawVersion, props);
-		if (!isConcrete(v)) v = moduleMgmt.get(`${gid}:${aid}`) || resolvedDeps.get(`${gid}:${aid}`)?.version || null;
-		if (!isConcrete(v)) continue;
-		out.push({ groupId: gid, artifactId: aid, version: String(v), scope: d.scope, exclusions: d.exclusions });
+	const seen = new Set();
+	const chain = store ? localChain(pomPath, store).chain : [pomPath];
+	for (const pom of chain) {
+		for (const node of (propsByPom[pom] || {}).dependencies || []) {
+			const d = flattenSafe(node);
+			if (!d || !d.groupId || !d.artifactId || d.optional || d.isImport) continue;
+			if (d.scope === "test" && !opts.includeTestDeps) continue;
+			if (d.scope === "system" || d.scope === "import") continue;
+			// Interpolate ${…} in the coordinate (e.g. ${project.groupId}) like the version.
+			const gid = resolveDepVersion(d.groupId, props);
+			const aid = resolveDepVersion(d.artifactId, props);
+			const key = `${gid}:${aid}`;
+			if (seen.has(key)) continue;
+			let v = resolveDepVersion(d.rawVersion, props);
+			if (!isConcrete(v)) v = moduleMgmt.get(key) || resolvedDeps.get(key)?.version || null;
+			if (!isConcrete(v)) continue;
+			seen.add(key);
+			out.push({ groupId: gid, artifactId: aid, version: String(v), scope: d.scope, exclusions: d.exclusions });
+		}
 	}
 	return out;
 }
@@ -163,7 +184,7 @@ async function expandPerModuleOverlay(resolvedDeps, store, propsByPom, opts = {}
 
 	for (const pomPath of Object.keys(propsByPom)) {
 		const moduleMgmt = await buildModuleManagement(pomPath, store, propsByPom, tOpts);
-		const directs = buildModuleDirects(pomPath, propsByPom, moduleMgmt, resolvedDeps, tOpts);
+		const directs = buildModuleDirects(pomPath, store, propsByPom, moduleMgmt, resolvedDeps, tOpts);
 		if (!directs.length) continue;
 		modules++;
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fad-checker",
-  "version": "2.4.2",
+  "version": "2.4.4",
   "description": "Scan ALL Maven, Gradle, npm, Yarn, Composer, Python, C#/.NET, Go & Ruby dependencies — plus embedded JARs (fat-jars/war/ear) — in a source tree ONE SHOT without mvn/python/etc — CVE (EPSS/KEV-prioritised), EOL, obsolete, outdated & licenses, with SBOM/CSAF/SARIF/JSON exports, CI gating and fix recos",
   "keywords": [
     "sca",

package/REVIEW-2026-07-02.md

@@ -1,190 +0,0 @@
-# Revue de fiabilité — fad-checker v2.4.1 — 2026-07-02
-
-> Revue approfondie axée **bugs de correction** (faux négatifs/positifs) et **mises à jour à faire**,
-> avec focus demandé sur **Go, Python (PyPI) et C# (NuGet)**. Chaque bug listé ci-dessous a été
-> **confirmé par reproduction** (test ou exécution réelle), pas seulement par lecture de code.
-> Les correctifs ont été appliqués dans la foulée (commits séparés par sujet) avec un test de
-> régression chacun. Suite de tests : **569 → 587, toutes vertes**.
-
----
-
-## 1. Verdict global
-
-L'architecture est saine (codecs isolés, matching multi-sources avec dédup, gate pure, caches
-offline-aware) et la couverture de test est réelle. **Mais la revue a trouvé un défaut critique
-en production** : l'index CVE local ne contenait pas Log4Shell — un audit air-gapped d'un projet
-Java livrait un rapport propre sur `log4j-core:2.14.0`. Ce défaut était détectable : le test
-`cli-safety` échouait déjà (568/569) au début de cette revue. Les trois écosystèmes sur lesquels
-tu avais des doutes (Go/PyPI/NuGet) avaient chacun **au moins un trou de collecte réel** en
-configuration entreprise courante (CPM .NET, pip-compile hashé, `replace` Go). Tous corrigés.
-
-**Après correctifs : l'outil est fiable pour un usage d'audit professionnel**, avec les limites
-résiduelles documentées en §4 (aucune n'est silencieuse : elles sur-rapportent ou sont hors
-périmètre annoncé).
-
----
-
-## 2. Bugs confirmés et corrigés
-
-| # | Gravité | Composant | Bug | Effet en audit |
-|---|---------|-----------|-----|----------------|
-| B1 | **CRITIQUE** | `lib/cve-download.js` | Index CVE : les enregistrements pré-2023 sans métadonnées Maven machine-réadables étaient exclus — **Log4Shell absent de l'index** | Faux négatif majeur en mode offline/air-gapped (l'argument de vente n°1 de l'outil) |
-| B2 | **HAUTE** | `lib/osv.js` | Cache OSV : TTL 12 h appliqué **même en `--offline`** | Machine air-gapped scannée >12 h après warm → « 0 vulns OSV » silencieux, tous écosystèmes |
-| B3 | **HAUTE** | `lib/codecs/nuget.codec.js` | `Directory.Packages.props` cherché uniquement dans le dossier du `.csproj` (jamais en remontant) | Solution .NET en Central Package Management (le standard moderne) → **0 dep collectée** |
-| B4 | **HAUTE** | `lib/codecs/pypi/parse.js` | `pkg==1.0 \` (continuation `pip-compile --generate-hashes`) et ` --hash=…` inline rejetés par `isPinned()` | Fichier requirements hash-pinné (pratique des shops sécurisés…) → **0 dep collectée** |
-| B5 | MOYENNE+ | `lib/codecs/go/parse.js` | Directives `replace` ignorées | Un `replace` qui downgrade/redirige un module → version effective non scannée (FN) ; version remplacée scannée à tort (FP) |
-| B6 | MOYENNE | `lib/codecs/go.codec.js` | `go.sum` jamais consulté dès que `go.mod` a des `require` | Module `go < 1.17` (liste seulement les directs) → **transitifs invisibles** |
-| B7 | MOYENNE | `lib/codecs/nuget/registry.js` | Index de registration **paginé** (paquets populaires : Newtonsoft.Json, Serilog…) : pages `@id` jamais fetchées | Deprecation + outdated silencieusement vides pour les paquets les plus courants |
-| B8 | MOYENNE | `pypi.codec.js` / `nuget.codec.js` | Même paquet pinné à des versions différentes dans 2 fichiers/projets → seule une version scannée (`out.set` écrase) | FN si la version la plus vieille est la vulnérable — violait la convention Maven « every distinct version is scanned » |
-| B9 | MOYENNE | `lib/maven-version.js` | Bornes placeholder (`lessThan:"log4j-core*"`, `"*"`, `"unspecified"`) comparées comme des versions Maven | Comparaison garbage → ranges jamais matchés (FN) ; fail-open possible sur `{version:"*", lessThan:"*"}` |
-| B10 | BASSE+ | `lib/codecs/nuget/parse.js` | Pin exact NuGet `[1.2.3]` rejeté comme « range » ; `VersionOverride` (CPM) ignoré | Deps skippées ou scannées à la mauvaise version |
-| B11 | BASSE | `lib/cve-download.js` | `fixVersion` = **premier** `lessThan` rencontré | Advisory multi-branche (struts 2.3.32 / 2.5.10.1) → suggestion de « fix » plus vieille que la version courante |
-| B12 | BASSE | `lib/codecs/pypi/parse.js` | `uv.lock` : le paquet racine du projet (`source.virtual`/`editable`) inventorié comme dep | Bruit ; collision possible avec un paquet PyPI homonyme |
-| B13 | BASSE | registres go/pypi/nuget | Run offline ré-écrivait `meta.fetchedAt` du cache | Cache périmé considéré frais au run online suivant → refresh sauté |
-
-### B1 en détail (le plus important)
-
-Le vrai enregistrement cvelistV5 de **CVE-2021-44228** n'a **ni** `packageName`, **ni**
-`collectionURL`, **ni** `versionType:"maven"` ; son vendor est `"Apache Software Foundation"`
-(entité légale, pas le token `apache` attendu en match exact), son produit `"Apache Log4j2"`
-(le heuristique produit était ancré `^log4j`), sa borne `lessThan` est le placeholder
-`"log4j-core*"` et ses fenêtres affectées sont encodées en `versions[].changes[]` (timeline
-CVE 5.x) — quatre caractéristiques que le pipeline ignorait toutes. La fixture de test
-existante (`cve-with-packagename.json`) était une version **synthétique idéalisée** du même CVE
-avec un `packageName` propre : le test passait, le réel échouait.
-
-**Correctif** (4 volets) :
-1. `isMavenRelevant()` tokenise le vendor (`"apache software foundation"` → `apache` ✓) et
-   teste le produit aussi après suppression du mot vendor (`"apache log4j2"` → `log4j2`) ;
-2. la map curée `data/cpe-coord-map.json` est consultée au build de l'index et **backfille
-   `packageName`** sur les enregistrements product-only → match **tier-1 exact** (entrée
-   `apache:log4j2` ajoutée) ;
-3. `changes[]` est expansé en fenêtres affected simples — `[2.0-beta9,2.3.1) ∪ [2.4,2.12.2) ∪
-   [2.13.0,2.15.0)` — donc **2.14.0 matche et les backports corrigés 2.12.2/2.3.1 ne matchent
-   pas** ;
-4. `isVersionAffected()` ignore les bornes non-versions (fail-closed préservé : un spec fait
-   uniquement de placeholders ne matche jamais).
-
-**Mesure** : index reconstruit **6 589 → 15 236 CVE (+131 %)** ; `log4j-core` passe de 4 entrées
-(toutes 2025-2026) à 12 (dont 44228/45046/44832/45105, 2019-17571…). Le scan de la fixture
-polyglot remonte désormais 3 CRITICAL au lieu de 0, et `--fail-on high` sort en exit 1.
-Test de régression sur **l'enregistrement réel** committé en fixture.
-
-> ⚠️ **Action requise sur tes machines d'audit** : l'index en cache (`~/.fad-checker/cve-data/`)
-> reste amputé tant qu'il n'est pas reconstruit avec le code corrigé (fait sur cette machine :
-> rebuild du 2026-07-02). **Re-exporte aussi les archives `--export-cache`** utilisées pour les
-> audits air-gapped — celles générées avant ce fix embarquent l'index défectueux.
-
----
-
-## 3. Fiabilité par écosystème (état après correctifs)
-
-| Écosystème | Verdict | Notes |
-|---|---|---|
-| **Maven / Gradle** | ✅ Solide | Résolution transitive offline + overlay par module : différenciant réel. Rappel CVE-index legacy dépend désormais de la map curée (§4.9) — OSV reste le filet principal online |
-| **Go** | ✅ Bon | `replace` appliqués, go.sum mergé pré-1.17, encodage casse proxy correct. Reste : stdlib non scannée (§4.1) |
-| **PyPI** | ✅ Bon | PEP 503 propre partout, hash-pins parsés, multi-versions scannées. Matching de versions délégué à OSV côté serveur (PEP 440 correct par construction) |
-| **NuGet** | ✅ Bon | CPM walk-up, `VersionOverride`, pins exacts, registrations paginées. Reste : `Directory.Build.props` (§4.5) |
-| **npm/yarn/pnpm** | ✅ (non ré-audité en profondeur cette passe) | Lane la plus mature (retire.js + registry + OSV) |
-| **Composer / Ruby** | ⚠️ Non ré-audités en profondeur cette passe | Même architecture que pypi/nuget — les patterns corrigés (multi-versions, fetchedAt offline) méritent une passe de vérification |
-
----
-
-## 4. Limites restantes (non corrigées — connues et assumées)
-
-Aucune n'est un faux négatif *silencieux* ; elles sur-rapportent, dégradent une lane secondaire,
-ou sont hors périmètre annoncé. Par priorité décroissante :
-
-1. **Go stdlib non scannée** : la directive `go 1.x`/`toolchain` n'émet pas de dep `stdlib`
-   (OSV la couvre, ecosystem `Go`, package `stdlib`). Un CVE net/http Go n'apparaîtra pas.
-   *Complément recommandé : `govulncheck` sur les projets Go, ou émettre un record `stdlib`.*
-2. **OSV NuGet et la casse** : OSV matche les noms de paquets de façon sensible à la casse ;
-   un lockfile écrivant `newtonsoft.json` (rare — la casse canonique est la norme) pourrait
-   rater l'advisory. Canonicalisation via le registry envisageable.
-3. **uv.lock : pas de classification dev** — tout est marqué prod (sur-rapporte, direction
-   sûre pour un audit). Poetry : les groupes custom non-dev sont classés dev (sous-gate
-   potentiel pour `--fail-on` sur ces groupes).
-4. **PEP 735 `[dependency-groups]`** (pyproject) non parsé (fallback best-effort uniquement).
-5. **NuGet** : `Directory.Build.props` (items partagés), `GlobalPackageReference`, attribut
-   `Update`, et `developmentDependency` de packages.config non pris en compte.
-6. **CVSS v4** : score non calculé depuis le vecteur (v3.0/3.1 seulement) ; la sévérité retombe
-   sur `database_specific.severity` (GHSA la fournit presque toujours) — impact faible.
-7. **Comparateurs `cmp()` naïfs** dans les registries go/pypi/nuget (lane « outdated »
-   uniquement — jamais utilisés pour le matching de vulnérabilités) : pré-releases mal
-   ordonnées possibles dans la colonne outdated.
-8. **Tier-2 `byProduct`** : la clé reste le produit brut du CNA (`"apache log4j2"`), donc ce
-   tier ne matche que si produit == artifactId. Le vrai chemin pour les CVE legacy est le
-   backfill par map curée (B1) : **la qualité du rappel legacy est proportionnelle à la
-   curation de `data/cpe-coord-map.json`** — l'enrichir en continu (candidats : jenkins,
-   elasticsearch, kafka, activemq, camel, cxf, solr, weblogic/websphere…).
-9. **Test `cli-safety` dépendant du cache HOME** : il scanne avec le vrai `~/.fad-checker` —
-   c'est CE test qui a détecté l'index amputé (précieux), mais il échouera sur une machine au
-   cache froid. Assumé ou à isoler (fixture d'index dédiée) — au choix.
-10. **`known-obsolete.json` / `popular-packages.json`** : listes curées à la main — prévoir un
-    rafraîchissement périodique (les cibles typosquat vieillissent vite).
-
----
-
-## 5. Mises à jour à faire (état au 2026-07-02)
-
-### Dépendances de l'outil (`npm outdated`)
-| Paquet | Actuel | Dispo | Action |
-|---|---|---|---|
-| retire | 5.4.2 | **5.4.3** | patch sûr, à prendre (scanner JS vendored) |
-| commander | 14.0.1 | 14.0.3 / 15.0.0 | prendre 14.0.3 ; major 15 à évaluer |
-| js-yaml | 4.1.1 | 4.3.0 / 5.2.1 | prendre 4.3.0 ; major 5 à évaluer |
-| smol-toml | 1.6.1 | 1.7.0 | mineur sûr |
-| rimraf | 6.0.1 | 6.1.3 | mineur sûr |
-| chalk / p-limit | 4.1.2 / 3.1.0 | 5.x / 7.x | **ESM-only** → rester en 4.x/3.x tant que le build CJS+bun est la cible (choix actuel correct) |
-
-Aucune CVE connue sur les versions pinnées (vérifié via la lane npm du repo lui-même).
-
-### APIs externes
-- **endoflife.date** : l'ancien endpoint `/api/<slug>.json` répond encore (HTTP 200, vérifié
-  aujourd'hui) mais la v1 (`/api/v1/products/<slug>`) est la cible long-terme → prévoir la
-  migration du fetch dans `lib/outdated.js` (champ de réponse différent).
-- NVD 2.0, OSV v1, EPSS, KEV, deps.dev v3, CIRCL, proxys de registries : inchangés, rien à faire.
-- **CVEProject cvelistV5** : le format `.zip.zip` imbriqué est toujours servi (vérifié via le
-  rebuild d'aujourd'hui — 362 782 fichiers scannés).
-
-### Caches d'audit
-- **Reconstruire l'index CVE** sur chaque machine (`--force` du download, ou attendre
-  l'expiration 24 h online). Fait sur cette machine.
-- **Régénérer les archives `--export-cache`** destinées aux postes air-gapped (elles
-  contiennent l'index pré-fix).
-
----
-
-## 6. Avis sur la pertinence de l'outil
-
-**L'outil a une vraie raison d'être.** Sa niche — audit multi-écosystème **entièrement
-offline/air-gapped** avec résolution transitive Maven réelle, exports normalisés
-(SBOM/VEX/SARIF), gate CI et rapport livrable client — n'est couverte par aucun outil unique du
-marché : OSV-Scanner et Trivy dégradent fortement hors-ligne (64/202 findings vs 181/202 mesurés
-sur le projet de référence), Dependency-Check est Java-centrique et lent, Snyk exige le cloud.
-Pour des audits chez des clients à contraintes réseau (banque, défense, industriel), c'est un
-différenciant réel. Les plus : provenance/checksums des rapports (reproductibilité d'audit),
-chapitre méthodologie, triage VEX/ignore, priorisation KEV/EPSS — c'est le bon jeu de features
-pour du livrable d'audit professionnel.
-
-**Deux réserves à garder en tête** :
-1. **La fiabilité repose sur des données warmées** — cette revue le prouve : un index mal
-   construit a produit des rapports faussement propres pendant ~2 semaines sans aucun signal
-   visible en ligne (OSV masquait le trou). Recommandation structurelle : ajouter un
-   **canari d'auto-validation** au build de l'index (ex. vérifier que CVE-2021-44228,
-   CVE-2017-5638 et 2-3 autres sentinelles sont présentes et matchables, sinon échec bruyant
-   du build). C'est le correctif systémique qui manque encore.
-2. **Le coût de maintenance est réel** : 10 codecs, ~15 sources de données, des formats de
-   lockfiles qui évoluent (uv, pnpm v9, PEP 735…). L'outil est bien architecturé pour ça
-   (ajouter un codec = un dossier), mais il faut budgéter une passe de vérification
-   trimestrielle du type de celle-ci.
-
-En l'état, après cette passe : **adapté à un usage d'audit professionnel**, à condition de
-reconstruire les caches (cf. §5) et d'ajouter le canari de l'index en prochaine itération.
-
----
-
-*Revue et correctifs : session Claude (Fable 5) du 2026-07-02. 13 bugs corrigés, 18 tests de
-régression ajoutés, suite 587/587 verte. Le scanner de certificats (chapitre 2.4) présent en
-non-commité dans l'arbre de travail n'a pas été audité en profondeur dans cette passe (ses 19
-tests passent) et reste non-commité.*