fad-checker 2.4.5 → 2.4.6

package/README.md

@@ -25,7 +25,7 @@
 - **No build tools**; reads `pom.xml`, `build.gradle(.kts)`/`gradle.lockfile`/`libs.versions.toml`, `package-lock`/`yarn.lock`/`pnpm-lock`, `composer.lock`, `poetry`/`Pipfile`/`uv`/`pdm` locks, `packages.lock.json`/`*.csproj`, `go.mod`, `Gemfile.lock` directly. No `mvn`/`gradle`/`npm install`/`pip`/`dotnet restore`/`go build`/`bundle`, no `node_modules/`. → [how it stays build-free](docs/COMPARISON.md#how-its-autonomous-no-build-tools)
 - **CVE, merged & prioritised**; CVEProject + OSV.dev + NVD, CPE/version cross-checked to cut false positives, ranked **CISA KEV → EPSS → CVSS**.
 - **Per-module Maven version mediation**; recovers vulnerable transitive versions that a global `<dependencyManagement>` pin hides in another module, applying Maven's own nearest-wins semantics per module rather than resolving the whole reactor as one tree.
-- **Air-gapped**; **zero network under `--offline`** (regression-tested), offline Maven transitive resolution, and `--osv-db` for cache-independent offline OSV recall. Benchmarked on **Apache Dubbo 2.7.8** (105 modules) against OSV-Scanner, Snyk, Trivy and Grype+Syft: at **full capability** fad finds 790 of a 908-pair union (87%, the highest of the five, and it still misses 118 that Snyk finds); **under `unshare -rn` with no network interface** it recovers **657/657** of OSV-Scanner's *online* result, versus 45 / 40 / 37 for the others. → [Benchmark](docs/BENCHMARK.md) · [Air-gapped](#air-gapped-audits)
+- **Air-gapped**; **zero network under `--offline`** (regression-tested), offline Maven transitive resolution, and `--osv-db` for cache-independent offline OSV recall. Benchmarked against OSV-Scanner, Snyk, Trivy and Grype+Syft on **six public projects across six ecosystems**: identical finding sets on npm, RubyGems and Composer (parity is the correct outcome when the graph is in the lockfile), and on Maven — where it is not — fad recovers **657/657** of OSV-Scanner's *online* result with **no network interface at all**, versus 45 / 40 / 37 for the others. At full capability no tool finds everything, fad included: it leads at 87% of a 908-pair union and still misses 118 that Snyk finds. → [Benchmark](docs/BENCHMARK.md) · [Air-gapped](#air-gapped-audits)
 - **Supply-chain risk**; known-**malicious** advisories (`MAL-`, always block the CI gate) + suspected **typosquats** (`--typosquat`).
 - **Lifecycle**; EOL (endoflife.date), obsolete/deprecated, outdated; across every ecosystem.
 - **Licenses** *(opt-in `--licenses`)*; SPDX-normalised, copyleft/proprietary flagged.

package/lib/codecs/go/parse.js

@@ -91,10 +91,20 @@ function parseGoSum(text) {
 	for (const raw of String(text || "").split(/\r?\n/)) {
 		const m = raw.trim().match(/^(\S+)\s+(v\S+?)(\/go\.mod)?\s+h1:/);
 		if (!m) continue;
+		// go.sum records two kinds of line per module:
+		//   mod ver h1:…         the module ZIP was downloaded → it IS in the build
+		//   mod ver/go.mod h1:…  only its go.mod was read, during minimal version selection
+		// A module carrying only the second kind was weighed and rejected: it sits on no
+		// classpath, and scanning it invents a dependency. Measured on prometheus v2.30.0
+		// (go 1.14, so go.mod lists direct deps only and go.sum is our transitive source):
+		// 187 modules have a zip hash, 391 have a go.mod hash alone — and taking all of
+		// them put gin, echo AND go-restful in one report, three mutually exclusive web
+		// frameworks. 70% of that project's Go production findings came from modules that
+		// were never built.
+		if (m[3]) continue;
 		const name = m[1];
 		const ver = stripV(m[2]);
-		// go.sum lists every version in the module graph; keep the highest (the
-		// comment promised this but the code kept the first one encountered).
+		// Several versions can genuinely be downloaded in one graph; keep the highest.
 		const prev = byMod.get(name);
 		if (!prev || compareMavenVersions(ver, prev) > 0) byMod.set(name, ver);
 	}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fad-checker",
-  "version": "2.4.5",
+  "version": "2.4.6",
   "description": "Scan ALL Maven, Gradle, npm, Yarn, Composer, Python, C#/.NET, Go & Ruby dependencies — plus embedded JARs (fat-jars/war/ear) — in a source tree ONE SHOT without mvn/python/etc — CVE (EPSS/KEV-prioritised), EOL, obsolete, outdated & licenses, with SBOM/CSAF/SARIF/JSON exports, CI gating and fix recos",
   "keywords": [
     "sca",