fad-checker 2.4.3 → 2.4.5

package/fad-checker.js

@@ -250,6 +250,7 @@ program
 	.option("--no-all-libs", "skip Maven Central queries (outdated check + missing-on-central check)")
 	.option("--no-osv", "skip OSV.dev (Google/GitHub aggregated Maven CVE feed)")
 	.option("--no-nvd", "skip NIST NVD enrichment of matched CVEs")
+	.option("--nvd-cpe-match", "ALSO match deps against NVD CPE version ranges (opt-in, LOW PRECISION: ~12% of the findings it adds were corroborated by another scanner — triage aid, not a default)")
 	.option("--no-epss", "skip EPSS (FIRST.org exploit-prediction) enrichment")
 	.option("--no-kev", "skip CISA KEV (known-exploited) enrichment")
 	// Output family: each --report-<type> takes an OPTIONAL path (omit → default name
@@ -1090,6 +1091,30 @@ async function runReportFlow(resolved, ecoFlags = {}) {
 			try {
 				const { enrichMatches } = require("./lib/nvd");
 				await enrichMatches(cveMatches, { verbose, offline, onProgress: (p, t) => st.tick(p, t) });
+
+				// 4c-bis. NVD CPE ranges as an ADDITIVE tier, curated coordinates only.
+				// OSV/GHSA declare affected ranges per release BRANCH; NVD declares them for
+				// every affected branch. For CVE-2020-9546, OSV covers 2.9.0–2.9.10.4 while
+				// NVD also covers 2.0.0–2.7.9.7, so jackson-databind 2.5.2 is affected and
+				// never got a fix. The data was already in the NVD cache and only ever used
+				// to FILTER. Bounded on purpose: `data/cpe-coord-map.json` coordinates only
+				// (no name heuristics — that is what makes CPE-driven scanners noisy), and
+				// only CVEs already enriched, so this adds no network path of its own.
+				let nvdAdded = 0;
+				if (options.nvdCpeMatch) try {
+					const { matchDepsAgainstNvdCpe } = require("./lib/cpe");
+					const records = {};
+					for (const m of cveMatches) {
+						const id = m.cve?.id;
+						if (id && m.cve.configurations?.length && !records[id]) records[id] = m.cve;
+					}
+					const extra = matchDepsAgainstNvdCpe(resolved, records);
+					if (extra.length) {
+						const before = cveMatches.length;
+						cveMatches = mergeBySource(cveMatches, extra);
+						nvdAdded = cveMatches.length - before;
+					}
+				} catch (err) { ui.warn(`NVD CPE matching skipped: ${err.message}`); }
 				// 4d. CPE refinement — use NVD's CPE configurations to upgrade match
 				// confidence and flag likely false positives (version outside CPE range).
 				let filtered = 0;
@@ -1099,7 +1124,7 @@ async function runReportFlow(resolved, ecoFlags = {}) {
 					filtered = cveMatches.filter(m => m.cpeFiltered).length;
 				} catch (err) { ui.warn(`CPE refinement skipped: ${err.message}`); }
 				const uniqueCves = new Set(cveMatches.map(m => m.cve?.id)).size;
-				st.done(`${uniqueCves} CVE${filtered ? ` · ${filtered} false-positive(s) filtered` : ""}${hasNvdKey ? "" : " · no key (slow)"}`);
+				st.done(`${uniqueCves} CVE${nvdAdded ? ` · +${nvdAdded} via CPE ranges` : ""}${filtered ? ` · ${filtered} false-positive(s) filtered` : ""}${hasNvdKey ? "" : " · no key (slow)"}`);
 			} catch (err) { st.fail(err.message); }
 		}
 	}
@@ -1203,6 +1228,18 @@ async function runReportFlow(resolved, ecoFlags = {}) {
 		}
 	}
 
+	// 6a-bis. Attribute every match to the manifest/module that actually resolves the
+	// version it matched on. A depRecord is coord-wide (versions[] and manifestPaths[]
+	// with no link between them); a match carries ONE version. Must run after ALL match
+	// sources are merged and before anything reads scope/paths (exec summary, charts,
+	// chapters, exports, gate) — otherwise, on a root spanning several independent
+	// projects, every version is reported against every manifest holding the coord.
+	{
+		const { attributeMatchOrigins } = require("./lib/attribution");
+		const reattributed = attributeMatchOrigins(cveMatches);
+		if (reattributed && verbose) console.log(`   re-attributed ${reattributed} match(es) to their resolving manifest/module`);
+	}
+
 	// 6b. Supply-chain risk lane (pure + offline): flag KNOWN-MALICIOUS advisories
 	// (OSV MAL-… already in the match set) always, and detect suspected TYPOSQUATS
 	// (opt-in --typosquat, heuristic — names one edit from a popular package).

package/lib/attribution.js

@@ -0,0 +1,116 @@
+/**
+ * lib/attribution.js — attribute each MATCH to the manifest/module that actually
+ * resolves the version it was matched on.
+ *
+ * A depRecord is COORD-WIDE: the collectors merge every occurrence of a g:a across the
+ * whole scan root into ONE record, so `versions[]` and `manifestPaths[]` are both
+ * coord-wide sets with no link between them, and `scope` is a single merged value. A
+ * MATCH, by contrast, carries exactly ONE version (matchOne clones the record per
+ * version). Left alone that clone inherits the coord-wide manifest list and the merged
+ * scope — so every version is reported against every manifest holding the coord.
+ *
+ * Invisible on a single reactor; wrong on the real-world shape fad is pointed at: an
+ * audit root holding SEVERAL INDEPENDENT projects (each pom with its own external
+ * parent, no shared reactor). Project A pins jackson-databind 2.15.3, project B pins
+ * 2.17.0 → both projects get reported as holding BOTH versions, and each version's CVEs
+ * land on both. Same class of error for a version the per-module overlay recovered: it
+ * is a TRANSITIVE of one module, not the direct declaration the record describes —
+ * unattributed it tops the exec summary's "direct production dependencies" pointing at
+ * the very pom that pins the fixed version.
+ *
+ * Two provenance sources, checked per match:
+ *   - `maskedVersions[]` (lib/version-overlay) — the version is a transitive of ONE
+ *     module: re-stamp scope/via/depth and file it under that module.
+ *   - `versionPaths{}` (lib/dep-record, maintained by the collectors) — the version is
+ *     DECLARED in a known subset of manifests: narrow the match to that subset.
+ * A version with neither (e.g. a global-pass transitive) is left untouched.
+ *
+ * Runs ONCE, after every match source is merged (CVE index, OSV, snyk) and before
+ * anything reads scope/paths (exec summary, charts, chapters, exports, gate).
+ * Pure w.r.t. the scan set: replaces `m.dep` with a clone, never mutating the shared
+ * record — other matches still reference it.
+ */
+
+/** manifestPaths and pomPaths must stay the SAME array (dep-record.js invariant). */
+function withPaths(dep, paths) {
+	const p = paths.slice();
+	return { ...dep, manifestPaths: p, pomPaths: p };
+}
+
+function sameList(a, b) {
+	const x = a || [], y = b || [];
+	return x.length === y.length && x.every((v, i) => v === y[i]);
+}
+
+/**
+ * @param matches the merged match set (mutated: each m.dep may be replaced by a clone)
+ * @returns number of matches re-attributed
+ */
+function attributeMatchOrigins(matches) {
+	let fixed = 0;
+	for (const m of matches || []) {
+		const dep = m && m.dep;
+		if (!dep || !dep.version) continue;
+		const ver = String(dep.version);
+
+		// A DECLARED version always wins over a transitive provenance for the same version.
+		// The overlay may legitimately also reach it as a transitive of some other module, but
+		// a manifest that writes `<version>` for a coord is the authority on that version.
+		// Without this precedence, xstream:1.4.10 — declared outright in
+		// dubbo-registry-eureka — was re-stamped from a test-scoped transitive provenance in
+		// dubbo-config-api and demoted out of production.
+		const declaredHere = dep.versionPaths && dep.versionPaths[ver];
+		const isDeclared = Array.isArray(declaredHere) && declaredHere.length > 0;
+
+		// 1. Recovered by the per-module overlay → a transitive of ONE module.
+		// ALL entries for this version, not the first: the same version is routinely masked in
+		// several modules, and they can disagree on scope. On Dubbo, jackson-databind:2.10.4 is
+		// test-scoped in dubbo-config-spring but COMPILE-scoped in dubbo-configcenter-nacos —
+		// taking whichever entry happened to be recorded first would call it dev and drop a
+		// genuine production finding out of the count and out of --fail-on.
+		const maskedAll = !isDeclared && Array.isArray(dep.maskedVersions)
+			? dep.maskedVersions.filter(x => String(x.version) === ver)
+			: [];
+		if (maskedAll.length) {
+			// Dev only when EVERY module resolving this version does so at test scope. Entries
+			// written before the overlay recorded scope have none — treat those as unknown and
+			// leave the coord-wide flag alone rather than guessing.
+			const scoped = maskedAll.filter(x => x.scope);
+			const isDev = scoped.length === maskedAll.length && scoped.every(x => x.scope === "test");
+			// Show the production path when there is one: it is the chain an auditor must act on.
+			const masked = maskedAll.find(x => x.scope && x.scope !== "test") || maskedAll[0];
+			const modules = [...new Set(maskedAll.map(x => x.module).filter(Boolean))];
+			m.dep = {
+				...withPaths(dep, modules),
+				scope: "transitive",
+				via: masked.via || [],
+				viaPaths: masked.viaPaths || (masked.via ? [masked.via] : []),
+				depth: masked.depth,
+				...(scoped.length ? { isDev } : {}),
+			};
+			fixed++;
+			continue;
+		}
+
+		// 2. Declared → narrow to the manifest(s) that declare THIS version, and take the
+		// scope from those declarations. `isDev` on the record is coord-wide, so a version
+		// declared only at test scope would otherwise inherit the coordinate's production
+		// flag. Dev only when EVERY declaration of this version is test/provided — the same
+		// widest-wins rule the masked branch uses.
+		const declared = dep.versionPaths && dep.versionPaths[ver];
+		if (Array.isArray(declared) && declared.length) {
+			const scopes = dep.versionScopes && dep.versionScopes[ver];
+			const isDev = Array.isArray(scopes) && scopes.length
+				? scopes.every(s => s === "test" || s === "provided")
+				: undefined;
+			const narrow = !sameList(declared, dep.manifestPaths);
+			if (narrow || (isDev !== undefined && isDev !== !!dep.isDev)) {
+				m.dep = { ...withPaths(dep, declared), ...(isDev !== undefined ? { isDev } : {}) };
+				fixed++;
+			}
+		}
+	}
+	return fixed;
+}
+
+module.exports = { attributeMatchOrigins };

package/lib/core.js

@@ -19,6 +19,47 @@ const SKIP_DIRS = new Set([
 
 const coord = v => (v == null ? null : String(v).trim() || null);
 
+/**
+ * Interpolate `${…}` in a single string against a POM property map. Values arrive from
+ * xml2js as arrays, hence the unwrap. Resolution is recursive (`${a}` → `${b}` → value),
+ * bounded, and stops when it stops making progress; an unknown reference is left verbatim
+ * so it still surfaces downstream as an unresolved version rather than a wrong one.
+ *
+ * Deliberately local to core.js: the equivalent in cve-match.js can't be reused without
+ * making core depend on it, and cve-match already depends on core.
+ */
+function interpolate(value, props) {
+	if (value == null) return value;
+	let out = String(value);
+	for (let i = 0; i < 10 && out.includes("${"); i++) {
+		const next = out.replace(/\$\{\s*([\w._-]+)\s*\}/g, (m, k) => {
+			const val = props?.[k];
+			if (Array.isArray(val)) return val[0];
+			return val != null ? val : m;
+		});
+		if (next === out) break;
+		out = next;
+	}
+	return out;
+}
+
+/**
+ * A dependencyManagement node with its coordinate resolved against `props`. Returns a NEW
+ * node — these xml2js structures are shared across POMs, so mutating one corrupts every
+ * other reader of the same parsed document.
+ */
+function resolveDepNodeProps(dep, props) {
+	if (!dep || !props) return dep;
+	const out = { ...dep };
+	for (const field of ["groupId", "artifactId", "version"]) {
+		const raw = dep[field]?.[0];
+		if (raw == null) continue;
+		const resolved = interpolate(raw, props);
+		if (resolved !== raw) out[field] = [resolved];
+	}
+	return out;
+}
+
 const defaultPomSkip = child => SKIP_DIRS.has(path.basename(child));
 
 function findPomFiles(dir, skipDir = defaultPomSkip) {
@@ -224,9 +265,24 @@ async function getAllInheritedProps(pomPath, allPomMetadata, cache) {
 
 	for (const pom of toImport) {
 		const imported = await getAllInheritedProps(pom.pomPath, allPomMetadata, cache);
-		merged.properties = { ...merged.properties, ...imported.properties };
+		// `<scope>import</scope>` imports a BOM's <dependencyManagement> and NOTHING else.
+		// The BOM resolves its managed versions in ITS OWN property context, then those
+		// resolved versions are what the importer receives — its <properties> never become
+		// the importer's. Merging them (and merging them so the BOM WINS, as this line used
+		// to) lets a BOM silently redefine the importing project's own property values.
+		//
+		// Real case, Apache Dubbo 2.7.8: the reactor root sets
+		// <hibernate_validator_version>5.2.4.Final</…>, dubbo-dependencies-bom redefines it
+		// to 5.4.1.Final, and dubbo-filter-validation's <version>${hibernate_validator_version}</version>
+		// resolved to the wrong one — a different version means a different CVE set.
+		// `mvn dependency:tree` reports 5.2.4.Final for that module.
+		//
+		// So: interpolate the BOM's managed entries against the BOM's properties here, at
+		// the import boundary, and drop the properties. (lib/transitive.js#effectivePom
+		// already does the equivalent for EXTERNAL import BOMs.)
 		merged.dependencies.push(...imported.dependencies);
-		merged.dependencyManagement.push(...imported.dependencyManagement);
+		merged.dependencyManagement.push(
+			...imported.dependencyManagement.map(d => resolveDepNodeProps(d, imported.properties)));
 	}
 
 	// Cache the (still-mutating) object BEFORE recursing into the parent so a

package/lib/cpe.js

@@ -127,21 +127,21 @@ function matchVersionRange(depVersion, cpeMatch) {
  *
  * Returns true if any vulnerable cpeMatch in the node matches the dep.
  */
-function nodeAffectsDep(node, dep, cpeCoordMap) {
+function nodeAffectsDep(node, dep, cpeCoordMap, opts = {}) {
 	if (!node) return false;
 	const matches = node.cpeMatch || node.cpe_match || [];
 	for (const m of matches) {
 		if (m.vulnerable === false) continue;
 		const parsed = parseCpe23Cached(m);
 		if (!parsed) continue;
-		if (!cpeMatchesDep(parsed, dep, cpeCoordMap)) continue;
+		if (!cpeMatchesDep(parsed, dep, cpeCoordMap, opts)) continue;
 		if (!matchVersionRange(dep.version, m)) continue;
 		return true;
 	}
 	// Recurse into children (NVD nests AND/OR nodes)
 	if (Array.isArray(node.children)) {
 		for (const child of node.children) {
-			if (nodeAffectsDep(child, dep, cpeCoordMap)) return true;
+			if (nodeAffectsDep(child, dep, cpeCoordMap, opts)) return true;
 		}
 	}
 	return false;
@@ -198,7 +198,7 @@ function nodeIsContextOnly(node) {
  *      equals/contains product. Same logic as cve-match.vendorMatchesGroup
  *      but kept local here so cpe.js is standalone.
  */
-function cpeMatchesDep(cpe, dep, cpeCoordMap) {
+function cpeMatchesDep(cpe, dep, cpeCoordMap, opts = {}) {
 	if (!cpe || !dep) return false;
 	if (cpe.part !== "a" && cpe.part !== "*") return false; // we only care about apps
 	const map = cpeCoordMap || loadCpeCoordMap();
@@ -214,6 +214,12 @@ function cpeMatchesDep(cpe, dep, cpeCoordMap) {
 	if (inList(map.byVendorProduct?.[vp])) return true;
 	if (inList(map.byProduct?.[cpe.product?.toLowerCase()])) return true;
 
+	// `curatedOnly` stops here. The heuristic below is safe when REFINING a match another
+	// source already made (worst case it declines to upgrade confidence), but it is not safe
+	// as a way to CREATE matches: name-similarity between a Maven coordinate and a CPE
+	// product is exactly what makes CPE-driven scanners noisy. matchDepsAgainstNvdCpe sets it.
+	if (opts.curatedOnly) return false;
+
 	// Heuristic fallback
 	if (dep.ecosystem === "npm") {
 		const name = (dep.artifactId || "").toLowerCase();
@@ -252,7 +258,7 @@ function altDepKey(dep) {
  * - "exact" when a curated mapping confirms vendor:product → dep
  * - "probable" when only heuristic matched
  */
-function evaluateCveForDep(cveRecord, dep, cpeCoordMap) {
+function evaluateCveForDep(cveRecord, dep, cpeCoordMap, opts = {}) {
 	const map = cpeCoordMap || loadCpeCoordMap();
 	const configs = cveRecord?.configurations || [];
 	let bestConfidence = null;
@@ -272,9 +278,9 @@ function evaluateCveForDep(cveRecord, dep, cpeCoordMap) {
 			// this, a "vulnerable:false" platform node makes .every() false and the real
 			// finding is wrongly dropped as a CPE false-positive.
 			const vulnNodes = nodes.filter(n => !nodeIsContextOnly(n));
-			passes = vulnNodes.length > 0 && vulnNodes.every(n => nodeAffectsDep(n, dep, map));
+			passes = vulnNodes.length > 0 && vulnNodes.every(n => nodeAffectsDep(n, dep, map, opts));
 		} else {
-			passes = nodes.some(n => nodeAffectsDep(n, dep, map));
+			passes = nodes.some(n => nodeAffectsDep(n, dep, map, opts));
 		}
 		if (passes) {
 			// Determine confidence: scan vulnerable cpeMatches that hit
@@ -283,7 +289,7 @@ function evaluateCveForDep(cveRecord, dep, cpeCoordMap) {
 					if (m.vulnerable === false) continue;
 					const parsed = parseCpe23Cached(m);
 					if (!parsed) continue;
-					if (!cpeMatchesDep(parsed, dep, map)) continue;
+					if (!cpeMatchesDep(parsed, dep, map, opts)) continue;
 					if (!matchVersionRange(dep.version, m)) continue;
 					const vp = `${parsed.vendor}:${parsed.product}`.toLowerCase();
 					const depKey = depToKey(dep).toLowerCase();
@@ -302,7 +308,7 @@ function evaluateCveForDep(cveRecord, dep, cpeCoordMap) {
 		for (const uri of cveRecord.cpes) {
 			const parsed = parseCpe23(uri);
 			if (!parsed) continue;
-			if (cpeMatchesDep(parsed, dep, map)) {
+			if (cpeMatchesDep(parsed, dep, map, opts)) {
 				note("probable");
 				break;
 			}
@@ -355,10 +361,96 @@ function refineMatchesWithCpe(matches, opts = {}) {
 	return matches;
 }
 
+/**
+ * ADDITIVE matching tier: NVD's CPE version ranges, for CURATED coordinates only.
+ *
+ * OSV/GHSA declare affected ranges per release *branch* — for CVE-2020-9546 only
+ * 2.9.0–2.9.10.4, the branch that got a fix. NVD declares three ranges for the same CVE
+ * (`2.0.0 ≤ v < 2.7.9.7`, `2.8.0 ≤ v < 2.8.11.6`, `2.9.0 ≤ v < 2.9.10.4`), so
+ * jackson-databind 2.5.2 is affected and simply never received a fix. fad already had that
+ * data — every enriched CVE's `configurations` sits in the NVD cache — but only ever used it
+ * SUBTRACTIVELY, to filter false positives. This uses it additively.
+ *
+ * MEASURED PRECISION IS POOR, which is why the orchestrator keeps this behind an opt-in flag
+ * (`--nvd-cpe-match`). On Dubbo 2.7.8 it adds 76 findings of which only 9 (12%) are
+ * corroborated by Snyk. The cause is structural and not fixable by better curation: CPE
+ * products are FRAMEWORK-level (`spring_framework`, `netty`, `log4j`) while Maven coordinates
+ * are ARTIFACT-level, so a framework CVE lands on every artifact of that framework —
+ * CVE-2016-1000027 is a spring-web flaw and CPE puts it on spring-core. This is the same
+ * limitation that makes CPE-driven scanners noisy. Useful as a triage aid ("what might I be
+ * missing?"), not as a default.
+ *
+ * Strictly bounded, because the cost of getting this wrong is a false-positive engine:
+ *   - `curatedOnly`: a coordinate must appear in `data/cpe-coord-map.json`. No name heuristics.
+ *   - Only CVEs already in the NVD cache are considered — no new fetch, no new network path.
+ *   - Every distinct concrete version is evaluated; unresolved or `${…}` versions never match,
+ *     mirroring the rule in cve-match.js that an unversioned dep is not assumed vulnerable.
+ *
+ * @param resolvedDeps Map<coordKey, depRecord>
+ * @param nvdRecordsById {[cveId]: nvdRecord}  records with `configurations`
+ * @returns match[] in the shape mergeBySource expects, tagged `source: "nvd"`
+ */
+function matchDepsAgainstNvdCpe(resolvedDeps, nvdRecordsById, opts = {}) {
+	const map = opts.cpeCoordMap || loadCpeCoordMap();
+	const out = [];
+	if (!resolvedDeps || !nvdRecordsById) return out;
+
+	// UNAMBIGUOUS entries only: a CPE product that maps to a SINGLE Maven coordinate.
+	// The curated map deliberately maps one CPE to several artifacts — its own comment says
+	// so ("one CPE may legitimately map to several Maven artifacts"). That is right for
+	// FILTERING, where any member matching means "don't call this a false positive", and
+	// catastrophic for MATCHING, where it would assert the CVE affects all of them.
+	// Measured on Dubbo: allowing 1:N entries produced 262 new findings of which only 8%
+	// were corroborated by any other scanner — CVE-2016-1000027 (a spring-web flaw) landed
+	// on spring-core/-beans/-context, CVE-2019-20444 (netty-codec-http) on
+	// netty-common/-codec/-handler. That is precisely the CPE noise this tier must not add.
+	const curated = new Set();
+	for (const list of [...Object.values(map.byVendorProduct || {}), ...Object.values(map.byProduct || {})]) {
+		if (!Array.isArray(list) || list.length !== 1) continue;
+		curated.add(String(list[0]).toLowerCase());
+	}
+	const candidates = [];
+	for (const dep of resolvedDeps.values()) {
+		if (!dep || dep.ecosystem !== "maven") continue;
+		if (dep.provenance === "binary") continue;          // no coordinate, identified by hash
+		const key = `${dep.groupId}:${dep.artifactId}`.toLowerCase();
+		if (!curated.has(key)) continue;
+		const versions = (Array.isArray(dep.versions) && dep.versions.length ? dep.versions : [dep.version])
+			.filter(v => v && !/\$\{/.test(String(v)));
+		if (versions.length) candidates.push([dep, versions]);
+	}
+	if (!candidates.length) return out;
+
+	for (const [cveId, record] of Object.entries(nvdRecordsById)) {
+		if (!record?.configurations?.length) continue;
+		for (const [dep, versions] of candidates) {
+			for (const version of versions) {
+				const probe = { ...dep, version };
+				if (!evaluateCveForDep(record, probe, map, { curatedOnly: true }).affected) continue;
+				out.push({
+					dep: probe,
+					cve: {
+						id: cveId,
+						severity: record.severity || "UNKNOWN",
+						score: record.score ?? null,
+						description: record.description || "",
+						cvssVector: record.cvssVector || null,
+						published: record.published || null,
+					},
+					source: "nvd",
+					confidence: "exact",   // curated coordinate + explicit NVD version range
+				});
+			}
+		}
+	}
+	return out;
+}
+
 module.exports = {
 	parseCpe23,
 	matchVersionRange,
 	cpeMatchesDep,
+	matchDepsAgainstNvdCpe,
 	nodeAffectsDep,
 	evaluateCveForDep,
 	cveCpeNamesDep,

package/lib/cve-match.js

@@ -6,7 +6,7 @@
  * @email: pp9ping@gmail.com
  */
 const { coord } = require("./core");
-const { compareMavenVersions, isVersionAffected } = require("./maven-version");
+const { compareMavenVersions, isVersionAffected, normalizeHardPin } = require("./maven-version");
 const { resolveTransitiveDeps } = require("./transitive");
 const { makeDepRecord } = require("./dep-record");
 
@@ -29,7 +29,13 @@ function resolveDepVersion(rawVersion, allProps) {
 		if (next === v) break;   // no progress → remaining refs are unresolvable
 		v = next;
 	}
-	return v;
+	// Maven hard pin: "[1.2.3]" means EXACTLY 1.2.3. It is a concrete version wearing range
+	// brackets, so unwrap it — keeping the brackets corrupts the coordinate for every consumer
+	// downstream (report, purl, SBOM/CSAF/SARIF/JSON) and makes the finding un-joinable with
+	// any other tool's output. A comma means a genuine range ("[1.0,2.0)", "(,1.5]") and is
+	// left verbatim: picking a version out of it is resolution, not interpolation, and it
+	// still surfaces as unresolved. Runs AFTER interpolation so "[${netty.version}]" works.
+	return normalizeHardPin(v);
 }
 
 /**
@@ -83,6 +89,24 @@ function collectResolvedDeps(allPomMetadata, allPropsByPom, opts = {}) {
 				// A dep is "dev" overall only if every occurrence is test/provided.
 				if (!isDev) existing.isDev = false;
 			}
+			// Remember WHICH pom declares THIS version. The record is coord-wide, so
+			// this is the only link back from a scanned version to its manifest —
+			// without it a match on one version is reported against every pom that
+			// declares the coord at any version (lib/attribution.js consumes this).
+			if (concrete) {
+				const rec = out.get(key);
+				if (!rec.versionPaths) rec.versionPaths = {};
+				const paths = rec.versionPaths[concrete] || (rec.versionPaths[concrete] = []);
+				if (!paths.includes(pomPath)) paths.push(pomPath);
+				// …and WHICH SCOPE that declaration uses. `isDev` on the record is coord-wide
+				// (false as soon as any occurrence is production), so without this a version
+				// declared only at test scope inherits the coordinate's production flag and
+				// inflates both the production count and the CI gate. Mirror of
+				// maskedVersions[].scope for overlay-recovered versions.
+				if (!rec.versionScopes) rec.versionScopes = {};
+				const scopes = rec.versionScopes[concrete] || (rec.versionScopes[concrete] = []);
+				if (!scopes.includes(scope)) scopes.push(scope);
+			}
 		}
 	};
 
@@ -164,8 +188,20 @@ async function expandWithTransitives(resolvedDeps, opts = {}) {
 	const rootEcoType = new Map();
 	for (const d of directs) rootEcoType.set(`${d.groupId}:${d.artifactId}`, d.ecosystemType || d.ecosystem || "maven");
 
+	// Maven's scope matrix: `test → compile = test`. The compile dependencies of a
+	// test-scoped dep ARE on the test classpath, recursively — only `test → test` is
+	// omitted (SCOPE_MATRIX handles that). So when test roots are in the scan set, "test"
+	// has to be an accepted propagated scope too, otherwise every child of a test root is
+	// discarded at the first hop and the dev chapter only ever shows DIRECTLY declared test
+	// deps. Measured on Apache Dubbo 2.7.8: this is what hid spring-boot:1.5.17.RELEASE,
+	// which `mvn dependency:tree` reports at scope=test via
+	// registry-test → registry-server-integration → spring-boot-starter.
+	const includedScopes = opts.includedScopes
+		|| (opts.includeTestDeps ? ["compile", "runtime", "provided", "test"] : undefined);
+
 	const transitives = await resolveTransitiveDeps(directs, {
 		...opts,
+		...(includedScopes ? { includedScopes } : {}),
 		rootDepMgmt,
 	});
 
@@ -178,6 +214,11 @@ async function expandWithTransitives(resolvedDeps, opts = {}) {
 			version: t.version,
 			versions: t.version && !/\$\{/.test(t.version) ? [t.version] : [],
 			scope: "transitive",
+			// A coord reachable ONLY through a test-scoped root lives on the test classpath.
+			// It must land in the dev chapter and stay out of the production count and the
+			// CI gate — reporting a test-only dependency as a production finding is a false
+			// positive that costs an auditor real time.
+			isDev: t.scope === "test",
 			pomPaths: [],
 			via: t.via,
 			viaPaths: t.viaPaths || [t.via],

package/lib/dep-record.js

@@ -55,6 +55,15 @@ function makeDepRecord(input) {
 		name,
 		version: version || null,
 		versions: concrete ? [concrete] : [],
+		// Per-version → the manifest(s) DECLARING that version. `versions[]` and
+		// `manifestPaths[]` are both coord-wide sets with no link between them, so
+		// neither says which manifest declared which version. A match carries ONE
+		// version, so without this link it renders against EVERY manifest holding the
+		// coord: on a scan root spanning several independent projects (A pins
+		// jackson-databind 2.15.3, B pins 2.17.0) both projects are reported as holding
+		// BOTH versions and each version's CVEs land on both. Maintained on merge by the
+		// collectors; consumed by lib/attribution.js.
+		versionPaths: concrete && manifestPath ? { [concrete]: [manifestPath] } : {},
 		coordKey,
 		provenance,
 		hashes,

package/lib/maven-version.js

@@ -164,10 +164,31 @@ function parseRange(rangeStr) {
 	};
 }
 
+/**
+ * Maven's hard-pin syntax: "[1.2.3]" means EXACTLY 1.2.3. It is a concrete version wearing
+ * range brackets, and upstream POMs on Maven Central do use it (e.g. netty declares
+ * "[4.1.35.Final]"). Unwrap it to the bare version.
+ *
+ * Keeping the brackets corrupts the coordinate for every consumer downstream — the report,
+ * the purl, and the SBOM/CSAF/SARIF/JSON exports — and makes the finding un-joinable with any
+ * other tool's output for the same dependency.
+ *
+ * A comma means a genuine range ("[1.0,2.0)", "(,1.5]") and is returned unchanged: choosing a
+ * version out of a range is resolution, not normalisation, and an unresolved range should keep
+ * surfacing as unresolved rather than silently becoming a concrete version.
+ */
+function normalizeHardPin(versionStr) {
+	if (versionStr == null) return versionStr;
+	const s = String(versionStr).trim();
+	const pin = /^\[\s*([^,\[\]]+?)\s*\]$/.exec(s);
+	return pin ? pin[1] : versionStr;
+}
+
 module.exports = {
 	parseMavenVersion,
 	compareMavenVersions,
 	isVersionAffected,
 	versionLikeBound,
 	parseRange,
+	normalizeHardPin,
 };

package/lib/retire.js

@@ -173,18 +173,33 @@ const DEFAULT_RETIRE_SKIP_DIRS = [
  *
  * retire walks with POSIX-style paths (its own matchers use `/`), so we emit `/`.
  */
-function buildRetireIgnorePatterns({ srcDir, excludePath = [], defaultExcludes = true } = {}) {
+function buildRetireIgnorePatterns({ srcDir, excludePath = [], defaultExcludes = true, sep = path.sep } = {}) {
 	const lines = [];
+	// retire compiles each line into a REGEX and tests it against the file path AND
+	// path.resolve(file) — both of which use BACKSLASHES on Windows. A forward-slash
+	// pattern therefore never matches there, and every exclusion (including the defaults
+	// that keep retire out of node_modules) is silently inert. A character class like
+	// [\\/] is not an option: retire escapes `[` and `]` before compiling. So emit the
+	// POSIX form plus, on Windows, the native-separator twin — retire's `.some()` means
+	// either one matching is enough, and on POSIX the twin is identical and deduped away.
+	const push = line => { if (!lines.includes(line)) lines.push(line); };
+	const emit = body => {
+		push(`@${body}`);
+		if (sep === "\\") push(`@${body.split("/").join("\\")}`);
+	};
+
 	if (defaultExcludes !== false) {
-		for (const d of DEFAULT_RETIRE_SKIP_DIRS) lines.push(`@/${d}/`);
+		for (const d of DEFAULT_RETIRE_SKIP_DIRS) emit(`/${d}/`);
 	}
-	const root = srcDir ? path.resolve(srcDir).split(path.sep).join("/").replace(/\/+$/, "") : "";
+	// Separator-agnostic on INPUT (path.resolve yields backslashes on Windows); `sep`
+	// only decides what we emit.
+	const root = srcDir ? path.resolve(srcDir).replace(/\\/g, "/").replace(/\/+$/, "") : "";
 	for (const g of excludePath || []) {
 		// Normalise like compileGlobs: strip a leading ./ or /, a trailing /, and a
 		// trailing /** (the dir's whole subtree is already covered by the segment).
 		const base = String(g || "").trim().replace(/^\.?\/+/, "").replace(/\/+$/, "").replace(/\/\*\*$/, "");
 		if (!base) continue;
-		lines.push(root ? `@${root}/${base}/` : `@/${base}/`);
+		emit(root ? `${root}/${base}/` : `/${base}/`);
 	}
 	return lines;
 }

package/lib/transitive.js

@@ -26,6 +26,7 @@ const fs = require("fs");
 const path = require("path");
 const os = require("os");
 const { parseStringPromise } = require("xml2js");
+const { normalizeHardPin } = require("./maven-version");
 
 const POM_CACHE_DIR = path.join(os.homedir(), ".fad-checker", "poms-cache");
 const MAVEN_CENTRAL = "https://repo1.maven.org/maven2";
@@ -140,7 +141,7 @@ async function parsePomXml(xml) {
 		return depsBlock.dependency.map(d => ({
 			groupId: coord(d.groupId?.[0]),
 			artifactId: coord(d.artifactId?.[0]),
-			version: coord(d.version?.[0]),
+			version: normalizeHardPin(coord(d.version?.[0])),
 			scope: coord(d.scope?.[0]) || "compile",
 			optional: d.optional?.[0] === "true",
 			type: coord(d.type?.[0]) || "jar",
@@ -242,7 +243,7 @@ async function effectivePom(g, a, v, opts = {}, seen = new Set()) {
 		...d,
 		groupId: resolveProps(d.groupId, effProps, builtins),
 		artifactId: resolveProps(d.artifactId, effProps, builtins),
-		version: resolveProps(d.version, effProps, builtins),
+		version: normalizeHardPin(resolveProps(d.version, effProps, builtins)),
 	});
 	merged.depMgmt = merged.depMgmt.map(resolveDep);
 	merged.deps = merged.deps.map(resolveDep);
@@ -392,6 +393,25 @@ async function resolveTransitiveDeps(directDeps, opts = {}) {
 						if (!existing.viaPaths.some(p => p.join("→") === sig)) {
 							existing.viaPaths.push(via);
 						}
+						// WIDEST scope wins across paths, and the version follows the scope.
+						// We dedupe by `g:a` and keep the first chain walked, but scope is a
+						// property of the coord, not of the chain: a coord reachable from both a
+						// test root and a compile root really is on the compile classpath.
+						// Without this, BFS order decides two things it has no business
+						// deciding. (1) The scope: a production dependency reached through a
+						// test path first gets stamped "test" and drops out of the production
+						// count and the --fail-on gate. (2) The VERSION: the test path's version
+						// would be reported as the production one, so a test-only version gets
+						// scanned as production while the version actually on the compile
+						// classpath is never scanned at all. So on widening we adopt the wider
+						// path's version and chain too. Never narrow, only widen; the version
+						// the test path holds is recovered per-module by lib/version-overlay.js.
+						if (existing.scope === "test" && propagated !== "test") {
+							existing.scope = propagated;
+							existing.version = resolvedVersion;
+							existing.via = via;
+							existing.depth = node.depth + 1;
+						}
 					}
 					continue;
 				}