penthera 1.8.0 → 1.9.0-rc.1

package/CHANGELOG.md

@@ -4,6 +4,278 @@ All notable changes to Penthera are documented here. Versioning follows [SemVer]
 
 ## [Unreleased]
 
+## [1.9.0-rc.1] - 2026-10-22
+
+Release candidate for 1.9.0, on npm's `next` dist-tag (`npm install penthera@next`).
+New: `penthera mcp` (an MCP server for coding agents, local and read-only by
+default), opt-in AI mode where a local model proposes and Penthera's rules
+verify, new detection rules, and default scans that send no attack payloads.
+
+### Added
+
+- **Coverage ledger** in every `--repo` report (terminal, Markdown, JSON
+  `coverage`): which files each check read, which it did not and why, and the
+  source files no code analysis looked at. It reads only file names and sizes,
+  and is the first step toward an opt-in AI mode.
+- **AI mode, opt-in and experimental: `penthera --repo . --ai`.** A model in
+  your local Ollama reads your code part by part and proposes problems no rule
+  describes; Penthera checks each proposal with its rules. Confirmed ones mark
+  the rule finding "also proposed by AI"; the rest are shown as
+  "model-proposed, unverified", apart from rule findings, and never change the
+  exit code. Every run asks first (default no), on stderr; runs that cannot ask
+  need `--ai-consent local` or `"ai": { "allow": ["local"] }` in
+  `penthera.policy.json`, or stop with exit 2 before scanning. Ollama cloud
+  models (`-cloud`) are recognised and need a second screen where you type
+  `ollama.com`. Secrets are masked before any code reaches the model; budgets
+  (`--ai-budget`) are hard stops; consents are logged locally
+  (`penthera ai consent`). `penthera ai models` lists models and where they
+  run. See [docs/ai-mode.md](docs/ai-mode.md).
+- **AI mode in the dashboard.** New scan has an AI mode switch, off; turning
+  it on opens the consent sheet on every scan (a picture of where the code
+  goes, the model picker, the terminal's exact consent lines, two equal
+  buttons; cloud models need `ollama.com` typed). The server checks the
+  model's route with Ollama itself and logs the consent. Runs show an
+  "AI · local" tag, unverified proposals are folded under their own heading,
+  and Settings lists the consent log.
+- **`penthera verify <findings.json>`** checks findings from an AI security
+  audit against Penthera's rules on your checkout. It reads Cloudflare's
+  security-audit skill `findings.json` (schema vendored from commit `c1c8a8c`,
+  MIT). A finding a rule agrees with is shown as Penthera's own finding, marked
+  "also proposed by" the model; the rest are labelled "model-proposed,
+  unverified" and never fail CI. Penthera runs no model and sends nothing
+  anywhere. See [docs/commands/verify.md](docs/commands/verify.md).
+- **`--audit-seeds <file>`** writes repo findings in the security-audit
+  skill's `findings.json` schema, as seeds for an AI audit: each entry is
+  `needs_validation`, names its class and the line the rule matched, and is
+  checked against the skill's schema before it is written.
+- Risky-pattern findings from `--repo` now carry the repo-relative `file` and
+  the `pattern` name.
+- **`penthera mcp`: Penthera as an MCP server for your coding agent.** Claude
+  Code, Cursor, Codex, VS Code and Windsurf can call it over stdio. Add it
+  with a pinned version: `claude mcp add penthera -- npx -y penthera@1.9.0 mcp`.
+  Six read-only tools: `scan_repo`, `scan_url` (passive only),
+  `check_dependencies`, `audit_ai_tooling`, `explain_finding` and
+  `runtime_advisories`. Results are structured JSON plus a summary, with
+  evidence at `file:line`, confidence labels and each tool's limits.
+  - Tools read only inside the workspace roots, and symlinks cannot lead
+    out. `scan_url` reaches loopback, or hosts you list with
+    `--allow-host`; active modes are not reachable over MCP.
+  - Text from scanned files has invisible characters removed and is marked
+    as data, so a file cannot steer the agent through the results.
+  - Speaks MCP 2026-07-28 and the earlier `initialize` versions. No new
+    dependency, no port, no telemetry.
+  - `server.json` and `mcpName` for the MCP Registry
+    (`io.github.danoszz/penthera`). See `docs/commands/mcp.md`.
+- **Secret findings carry the line number**, so reports and SARIF point at
+  the line.
+
+### Detection
+
+- Three exposure checks in the default URL scan, each a documented miss in
+  the E10 pilot (Juice Shop). All send plain `GET`s, no payloads:
+  - a public Prometheus `/metrics` endpoint (medium), matched on the
+    exposition format, so an SPA's index page at `/metrics` does not count;
+  - browsable directory listings (medium) in folders that `robots.txt`
+    disallows and in common upload and backup folders, matched on the
+    listing's page title;
+  - a stack trace in the error page for a path that does not exist (low),
+    matched on Node.js, Python, Java, PHP and .NET frame shapes.
+- The header audit reports an `X-Powered-By` header (low, `confirmed`), such
+  as Express's default `X-Powered-By: Express`. It was a documented miss in
+  the E10 pilot (DVNA). The finding names the value and how to turn the
+  header off.
+- The secret scan reads Terraform and HCL files (`.tf`, `.tfvars`, `.hcl`).
+  A private key inline in a Terraform file was a documented miss in the E10
+  pilot (Juice Shop).
+- New secret rule: a session signing secret written into
+  `session({ secret: '...' })` or `cookieSession(...)`, including a hardcoded
+  fallback after `process.env.X ||` (high). Express's documented example,
+  `'keyboard cat'`, was a documented miss in the E10 pilot (DVNA).
+- The repo scan looks for code-execution sinks in all server code, not just
+  route handlers: `eval`/`new Function` with a non-constant argument, `vm`
+  calls and `child_process` `exec` with request data in their arguments.
+  A taint-lite pass (assignments and destructuring within one file) sets the
+  confidence: `likely` when request data reaches the sink, `potential` for an
+  `eval` of a value it cannot trace. Before, a repo with an Express `routes/`
+  folder stopped before any code-pattern check; three E10 pilot misses (DVNA's
+  `exec` in `core/appHandler.js`, Juice Shop's B2B `vm` and profile `eval`)
+  came from this.
+- The advisories pack knows MongoDB: end-of-life lines from MongoDB's
+  lifecycle schedule (4.4 ended 2024-02-29, 5.0 on 2024-10-31, 6.0 on
+  2025-07-31, and the interim releases), matched against the official `mongo`
+  image in Dockerfiles and compose files and `mongodb` in `.tool-versions`.
+  `mongo:4.4.29` in Juice Shop's compose file was a documented miss in the
+  E10 pilot. **The pack is unsigned in this change**: the maintainer signs it
+  (`scripts/rules/sign-pack.sh`) before release.
+
+### Changed
+
+- **Faster merges for contributors.** Pull requests get a quicker install check
+  (Linux and macOS, Node 22), and docs-, site- or benchmark-only changes skip it.
+  The merge queue and `main` still run the full matrix (Linux, macOS and
+  Windows on Node 22 and 24, plus the upgrade test). Release notes are written
+  as fragments in `changelog.d/`, so parallel pull requests no longer conflict
+  on `CHANGELOG.md`.
+- **The default scan sends no attack payloads to your login.** A URL scan
+  used to POST nine logins and an `' OR '1'='1` string to `/api/login`,
+  which a CDN firewall (Vercel, Cloudflare) can read as an attack and start
+  challenging you. Now `quick` sends no login request, `standard` sends one
+  login with invalid credentials (to catch a login that accepts anything),
+  and the rate-limit burst and the SQL error check run only with `--deep`.
+  The MCP `scan_url` tool follows the same profiles.
+
+### Fixed
+
+- `penthera ui` listens for SIGINT and SIGTERM before it prints that it is
+  listening. A signal that arrived in between got the default action and
+  killed the process without "Stopped." (seen as a hung CI test; about one
+  run in a hundred locally). The test now fails within seconds with the
+  child's output instead of hanging for three minutes.
+- `--repo` scans of Express, Hono and Fastify apps with a `routes/`, `api/` or
+  `server/routes/` folder now get route discovery, trust-boundary and
+  risky-pattern checks. That folder was taken for a Next.js API root, no
+  `route.js` files were found there, and route analysis stopped. An explicit
+  `--api-root` is still used as given.
+- **TLS keys anyone can compute.** URL scans report, as critical, any
+  certificate in the served chain whose EC public key (P-256, P-384, P-521) is
+  k·G for a private scalar k below 1024. The private key then follows from
+  the certificate alone. This is the flaw in eMudhra's P-384 intermediates
+  ([Mozilla bug 2083449](https://bugzilla.mozilla.org/show_bug.cgi?id=2083449),
+  private keys below 256). The check is arithmetic, not a list, so it has no
+  false positives and no data to maintain. Research note:
+  [docs/research/emudhra-weak-keys-2026-10.md](docs/research/emudhra-weak-keys-2026-10.md).
+- **Node.js security release of 21 October 2026** in the `advisories` pack:
+  CVE-2026-111497 (Brotli decoder out-of-bounds write, remote code execution)
+  and the TLS certificate hostname bypasses CVE-2026-106069, CVE-2026-105483
+  and CVE-2026-106072, fixed in 22.23.4, 24.22.1 and 26.12.1, from
+  [nodejs.org](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases).
+  Node.js has no server banner, so repo scans find it (`.nvmrc`,
+  `.node-version`, `.tool-versions`, `node:` images); 20.x and 25.x are
+  reported as end-of-life lines. The pack's signature was removed with the
+  change; `npm run rules:check` fails until the maintainer re-signs it.
+- **Python start-up code in wheels.** `penthera deps` now finds `.pth` files
+  and a shipped `sitecustomize.py` / `usercustomize.py` wherever a wheel puts
+  them at the site-packages root, including `<name>-<version>.data/purelib/`
+  and `platlib/`, the layout the malicious litellm 1.107.0 used
+  ([OSV MAL-2026-2144](https://osv.dev/vulnerability/MAL-2026-2144)). Before,
+  only top-level `.pth` files were read, so that wheel's hook was missed until
+  it was installed. A `.pth` import of clean code is now medium (was low);
+  risky code behind it, or any shipped `sitecustomize.py`, is high. The
+  `penthera install` policy holds `startup-hook` for approval by default.
+- **PyPI indicators.** A new rule kind, `ioc-pypi-package` (PEP 503 names,
+  PEP 440 versions, kept apart from npm names), and a new bundled pack,
+  `ioc-pypi-2026`, with the litellm 1.82.7, 1.82.8 and 1.107.0 versions, the
+  1.107.0 payload files by SHA-256 and its endpoints. Python scans now run
+  `ioc-file` and `ioc-host` rules too. The pack is unsigned until the
+  maintainer signs it, so `npm run rules:check` fails until then.
+- **The pre-commit hook keeps working when the npx cache is cleaned.** A hook
+  installed through `npx penthera` pointed at a copy in npm's cache; once
+  that was gone, every commit skipped the check silently. It now falls back
+  to the same version through npx (`npx -y penthera@<version> hook run`,
+  pinned), and only skips, with a clear warning, when that cannot run either.
+
+### Site
+
+- The FAQ says how to scan your own site behind Vercel's or Cloudflare's
+  firewall: allow your IP first, or scan a preview URL.
+
+### Docs
+
+- README, ROADMAP and the research plan describe what is on main for 1.9
+  (`penthera mcp`, AI mode, new detection, no attack payloads by default) and
+  list the E10 benchmark.
+
+## [1.8.1] - 2026-10-22
+
+A fixes-only release. Runtime advisories are more careful: pre-release builds
+are never reported as having the fix, a banner without a distribution token is
+at most `potential`, release lines older than a flaw are not reported as
+affected, and two more banner formats are read. `penthera ui` now stops
+cleanly under `npx`.
+
+### Fixed
+
+- Runtime advisories no longer claim `likely` for a banner that may be a
+  patched distribution package. Debian 11 to 13, Ubuntu 24.04 and later, and
+  RHEL print plain upstream PHP versions, so a patched Ubuntu 24.04
+  `X-Powered-By: PHP/8.3.6` behind nginx or a CDN was reported as critical
+  and likely affected. For PHP, Apache httpd, nginx, Python and OpenSSL,
+  "affected" and "end of life" findings from a banner with no distribution
+  token are now `potential`, with a "check on server" note and the check
+  command. Severity is unchanged. Official images and version files are
+  upstream builds and stay `likely`. Found by the runtime-strings test set
+  (L1 in [#97](https://github.com/danoszz/penthera/pull/97)).
+
+- Runtime advisories resolve Node.js LTS codenames to their release line:
+  nvm's `lts/iron` in `.nvmrc` and the node image's `iron`, `jod-alpine`
+  and `hydrogen` tags. They read as no version before, so `lts/iron` (Node.js
+  20, end of life 30 April 2026) went unreported. Found by the
+  runtime-strings test set (B4 in
+  [#97](https://github.com/danoszz/penthera/pull/97)).
+- Runtime advisories read aiohttp's `Server: Python/3.9 aiohttp/3.8.6`.
+  aiohttp prints only the Python release line, and the banner pattern needed
+  x.y.z, so an end-of-life Python behind aiohttp went unreported. Found by
+  the runtime-strings test set (B3 in
+  [#97](https://github.com/danoszz/penthera/pull/97)).
+- Runtime advisories honour `introduced` on older release lines. CVE-2021-41773
+  and CVE-2021-42013 exist only in httpd 2.4.49 and 2.4.50. Yet
+  `Apache/2.2.34` and `httpd:2.2` were reported critical, "end of life, no
+  fix", and CentOS 6's `Apache/2.2.15 (CentOS)` was "check on server". A line
+  older than the one the flaw was introduced on now gets no verdict for it.
+  The end-of-life finding stays. Found by the runtime-strings test set (B1 in
+  [#97](https://github.com/danoszz/penthera/pull/97)).
+- Runtime advisories read pre-releases correctly. `PHP/8.4.27-dev`, a PHP-8.4
+  branch build from before 8.4.27, was taken for a distribution build of
+  8.4.27 and reported as having the 21 October fix. Now `-dev`, alpha, beta
+  and RC builds (`8.5.0RC1`, `3.15.0rc1`, `4.1.0-beta2`, `php:8.6.0RC4-fpm`)
+  sort below their release, so a pre-release of the fixed version is
+  affected. A pre-release of the version after the fix (`8.4.28-dev`) is
+  "check on server", never "has the fix". Found by the runtime-strings test set
+  (B2 in [#97](https://github.com/danoszz/penthera/pull/97)).
+- **`npx penthera ui` stops cleanly on Ctrl-C and SIGTERM.** npm forwards
+  the signal to penthera right after the terminal delivered it, and the
+  second copy could kill the dashboard before it printed "Stopped." and
+  closed its server. Repeated signals are now ignored while it stops. This
+  was the intermittent macOS failure in the install-matrix smoke check.
+
+### Site
+
+- penthera.org counts anonymous page views and load times with Vercel Web
+  Analytics and Speed Insights (cookieless, served from the same origin). The
+  CSP now allows connections only to those two paths on penthera.org; the
+  browser check still sends nothing, and the page says so. The CLI, the
+  dashboard and the npm package have no telemetry, unchanged.
+- A shared penthera.org link now plays a 14-second muted reel in iMessage
+  and other apps that support `og:video`: setup, an offline scan, the
+  verdict, the PHP advisory of 21 October 2026, and the share card.
+  `og.png` stays the poster and the fallback; X keeps the image card.
+  Rendered by `site/tools/reel.mjs`.
+
+### Research
+
+- Draft protocol for experiment E10: Penthera against six deliberately
+  vulnerable apps with public answer keys (Juice Shop, DVNA, NodeGoat, DVWA,
+  crAPI, WebGoat), each pinned by commit and image digest. Answer keys in
+  `bench/known-vuln/`, frozen before any scan; an opt-in runner
+  (`npm run bench:known`, not in `npm test` or the package) starts the apps
+  isolated in Docker on 127.0.0.1. A pilot on Juice Shop and DVNA is in
+  `bench/known-vuln/RESULTS.md`, marked as a pilot.
+- Each of the pilot's 13 standard-run misses is verified in
+  `bench/known-vuln/MISSES.md` (all real gaps; none a scoring artefact).
+  A re-run after the fixes that followed (#107, #108, #110, #111) is in
+  `bench/known-vuln/RESULTS-after-fixes.md`, next to the unchanged pilot:
+  pooled standard recall 1/14 to 10/14 at the same precision, flagged as not
+  independent, with WebGoat as a held-out app that did not change. The
+  runner gains `--out <file>`.
+
+### Docs
+
+- The PHP case study and `docs/runtime-advisories.md` cite OpenAI's
+  php2shell-checker as an independent cross-check. A test pins that Penthera
+  agrees with its table on all 14 PHP branches.
+- The website is live at [penthera.org](https://penthera.org): the README links
+  it, and the npm package's homepage points to it from the next release.
+
 ## [1.8.0] - 2026-10-21
 
 1.8.0 is 1.8.0-rc.1 plus the changes below; there was no separate rc.2

package/README.md

@@ -8,6 +8,8 @@
 
 The security review you never had time for. Offline, rule-based, and you can verify every finding yourself.
 
+**[penthera.org](https://penthera.org)**: try the check in your browser. Nothing you paste leaves the page.
+
 <br/>
 
 [![npm](https://img.shields.io/npm/v/penthera?color=0000ed)](https://www.npmjs.com/package/penthera)
@@ -85,6 +87,21 @@ npx skills add danoszz/penthera
 The skill tells your agent to refuse targets you do not own or are not
 authorized to test. Other install routes (the one-line installer, the Claude
 Code plugin, a per-project copy) are in [docs/commands/skill.md](docs/commands/skill.md).
+
+### Use it from your agent
+
+Penthera is also an MCP server, so Claude Code, Cursor, Codex, VS Code and
+Windsurf can call it as a tool. Pin the version:
+
+```bash
+claude mcp add penthera -- npx -y penthera@1.9.0 mcp
+```
+
+It offers six read-only tools: `scan_repo`, `check_dependencies`,
+`audit_ai_tooling`, `runtime_advisories`, `explain_finding`, and `scan_url`
+(passive, loopback or hosts you list). Tools read only inside your project,
+never apply fixes, and run no shell. Configs for the other clients and the
+safety rules are in [docs/commands/mcp.md](docs/commands/mcp.md).
 Penthera needs Node.js 22 or later. To run it in a container:
 `docker build -t penthera . && docker run --rm penthera https://your-app.example`.
 
@@ -265,10 +282,10 @@ What changed, what we are measuring, and what comes next, in one place.
 
 | | Where it stands | Read more |
 |---|---|---|
-| **Latest release** | 1.8.0 (2026-10-21): runtime advisories starting with PHP's critical release, fixes from a second security review, a fix loop that cannot edit its own tests, the redesigned dashboard | [CHANGELOG](CHANGELOG.md) |
-| **On main, unreleased** | Whatever lands after 1.8.0 | [Unreleased](CHANGELOG.md#unreleased) |
-| **Now** | Toward 1.9: accuracy on real code (E1) and an MCP server, so coding agents can call Penthera | [Roadmap](ROADMAP.md#next) |
-| **Research** | E1, accuracy on real code, is pre-registered; the benchmark tooling is in review. After the 2026 agent incidents: a checklist for running agents safely and a draft experiment (E8) | [E1 pre-registration](docs/research/prereg/E1-real-world-accuracy.md), [agents safely](docs/agents-safely.md), [what the incidents mean](docs/research/agent-incidents-2026.md) |
+| **Latest release** | 1.8.1 (2026-10-22): more careful runtime advisories (pre-releases, distribution builds, older lines) on top of 1.8.0's runtime advisories, security-review fixes and redesigned dashboard | [CHANGELOG](CHANGELOG.md) |
+| **On main, unreleased** | For 1.9: `penthera mcp` for coding agents, opt-in AI mode (a local model proposes, rules verify), new detection rules, no attack payloads in default scans | [Unreleased](CHANGELOG.md#unreleased) |
+| **Now** | 1.9.0-rc.1 on npm `next`, then accuracy on real code (E1) | [Roadmap](ROADMAP.md#on-main-for-19) |
+| **Research** | E10 pilot published: precision 0.88, recall 0.07 → 0.71 on two known-vulnerable apps after fixes (one labeller, not independent; a re-run is pending because default scans no longer send login checks). E1 on real code is pre-registered; E8 (agent guardrails) is a draft | [E10 results](bench/known-vuln/RESULTS.md), [E1 pre-registration](docs/research/prereg/E1-real-world-accuracy.md), [agents safely](docs/agents-safely.md) |
 | **Next** | Real-world precision and recall with intervals, published whatever the result | [Roadmap: next](ROADMAP.md#next), [research plan](docs/vision-2.0.md) |
 
 Releases are deliberately slow: a feature freeze, an independent review, the

package/lib/advisories/evidence.js

@@ -15,6 +15,8 @@
  *            "present" the product is in use, the version is not visible
  *   where    the header, cookie or file it came from
  *   raw      the text it was read from (a header value, a line), for the report
+ *   banner   true for black-box evidence (a header), which may come from a
+ *            distribution package even without a distribution token
  *
  * Nothing here decides whether anything is vulnerable; that is index.js.
  */
@@ -27,6 +29,7 @@ const clip = (s, n = 200) => (s.length > n ? `${s.slice(0, n)}…` : s);
 
 function kindOf(product, v, distro) {
   if (!v) return "present";
+  // A pre-release is an upstream build, not a distribution one.
   if (v.patch !== null) return distro || v.suffix ? "distro" : "exact";
   // "php:8" spans release lines; "php:8.3" and "node:20" name one.
   return PRODUCTS[product].branchOf(v) ? "branch" : "present";
@@ -55,7 +58,7 @@ export function evidenceFromResponse(fp = {}, more = {}) {
       if (m) {
         const v = parseVersion(m[1]);
         if (v) {
-          out.push({ product: id, version: v, kind: kindOf(id, v, distro), where: `${name} header`, raw: clip(`${name}: ${value}`) });
+          out.push({ product: id, version: v, kind: kindOf(id, v, distro), where: `${name} header`, raw: clip(`${name}: ${value}`), banner: true });
           found = true;
           continue;
         }
@@ -81,7 +84,7 @@ export function evidenceFromResponse(fp = {}, more = {}) {
 
 // ── White-box ─────────────────────────────────────────────────────────────
 
-const SKIP_DIRS = new Set([
+export const RUNTIME_PIN_SKIP_DIRS = new Set([
   "node_modules", ".git", "dist", "build", ".next", "coverage", "reports", "vendor",
   "venv", ".venv", "site-packages", "__pycache__", ".tox", ".nox", ".obsidian",
 ]);
@@ -93,7 +96,9 @@ const isCompose = (n) => /^(?:docker-)?compose(?:\.[\w-]+)?\.ya?ml$/i.test(n);
 const VERSION_FILES = new Set(Object.values(PRODUCTS).flatMap((p) => p.versionFiles));
 const ROOT_ONLY = new Set([".tool-versions", "runtime.txt", "composer.json"]);
 
-function wanted(name, depth) {
+/** Would the runtime-pin check read a file with this name at this folder depth (0 = repo root)? */
+export function isRuntimePinFile(name, depth) {
+  if (depth > MAX_DEPTH) return false;
   if (isDockerfile(name) || isCompose(name) || VERSION_FILES.has(name)) return true;
   return depth === 0 && ROOT_ONLY.has(name);
 }
@@ -119,10 +124,10 @@ function walk(dir, depth, files) {
   let entries;
   try { entries = readdirSync(dir, { withFileTypes: true }); } catch { return; }
   for (const e of entries) {
-    if (SKIP_DIRS.has(e.name)) continue;
+    if (RUNTIME_PIN_SKIP_DIRS.has(e.name)) continue;
     const full = join(dir, e.name);
     if (e.isFile()) {
-      if (wanted(e.name, depth)) files.push({ full, depth });
+      if (isRuntimePinFile(e.name, depth)) files.push({ full, depth });
       continue;
     }
     if (!e.isDirectory()) continue;
@@ -135,6 +140,12 @@ function walk(dir, depth, files) {
   }
 }
 
+/** The release line a codename stands for (`lts/iron`, `iron` → "20"), or null. */
+function aliasLine(product, value) {
+  const name = value.toLowerCase().replace(/^lts\//, "");
+  return Object.hasOwn(PRODUCTS[product].lineAliases || {}, name) ? PRODUCTS[product].lineAliases[name] : null;
+}
+
 const imageProduct = new Map(Object.entries(PRODUCTS).flatMap(([id, p]) => p.dockerImages.map((img) => [img, id])));
 
 /**
@@ -151,8 +162,11 @@ export function parseImageRef(ref) {
   const path = repo.toLowerCase().replace(/^(?:docker\.io\/)?(?:library\/)?/, "");
   const product = imageProduct.get(path);
   if (!product) return null;
-  const m = /^(\d+(?:\.\d+){0,2})(?:$|-)/.exec(tag);
-  const v = m ? parseVersion(m[1]) : null;
+  // `8.6.0RC4-fpm` and `3.15.0rc1-slim` are pre-release images; `iron` and
+  // `jod-alpine` are Node.js LTS codenames.
+  const m = /^(\d+(?:\.\d+){0,2}(?:(?:RC|rc|a|b)\d+)?)(?:$|-)/.exec(tag);
+  const alias = m ? null : aliasLine(product, tag.split("-")[0]);
+  const v = m ? parseVersion(m[1]) : alias ? parseVersion(alias) : null;
   return { product, version: v, kind: kindOf(product, v, false), tag: tag || "latest" };
 }
 
@@ -179,7 +193,7 @@ function fromCompose(text, where) {
 }
 
 function versionLine(product, value, where, raw) {
-  const v = parseVersion(value);
+  const v = parseVersion(aliasLine(product, value) ?? value);
   return { product, version: v, kind: kindOf(product, v, false), where, raw: clip(raw) };
 }
 

package/lib/advisories/index.js

@@ -17,14 +17,17 @@
  *
  * A distro build (8.1.2-1ubuntu2.19, or any version behind a Server header
  * that names a distribution) is never "affected": distributions backport fixes
- * without changing the upstream number. An advisory with a `condition` (an OS,
+ * without changing the upstream number. A banner with no distribution token
+ * for a product distributions backport (PHP/8.3.6 from Ubuntu 24.04 looks
+ * exactly like upstream 8.3.6) gives at most `potential`, with a note to check
+ * on the server; a pinned image or version file is upstream and stays `likely`. An advisory with a `condition` (an OS,
  * a SAPI, a module) gives at most `potential`, since neither a banner nor a pin
  * shows the condition. Matching uses only the pack's data and dates, never the
  * scan's clock, so the same input and packs give the same findings.
  */
 import { rulesOf } from "../rules/index.js";
 import { PRODUCTS } from "./products.js";
-import { compareVersions, compareBranches } from "./versions.js";
+import { parseVersion, compareVersions, compareBranches } from "./versions.js";
 import { evidenceFromResponse, evidenceFromRepo } from "./evidence.js";
 
 export { evidenceFromResponse, evidenceFromRepo };
@@ -76,9 +79,13 @@ export function verdictFor(adv, ev, eol) {
   const fix = branch ? adv.fixed.find((f) => f.branch === branch) : null;
   const newest = adv.fixed.map((f) => f.branch).sort(compareBranches).at(-1);
   const newerLine = branch && !fix && newest && compareBranches(branch, newest) > 0;
+  // The flaw came in on the oldest listed line (`introduced`), so a line older
+  // than that one never had it: httpd 2.2 and CVE-2021-41773 (2.4.49 only).
+  const oldest = adv.fixed.reduce((a, f) => (!a || compareBranches(f.branch, a.branch) < 0 ? f : a), null);
+  const olderLine = branch && !fix && oldest?.introduced && compareBranches(branch, oldest.branch) < 0;
 
   if (ev.kind === "present") return { verdict: "check", why: "the version is not visible" };
-  if (newerLine) return { verdict: "none" };
+  if (newerLine || olderLine) return { verdict: "none" };
 
   if (ev.kind === "branch") {
     if (!fix && eol) return { verdict: "unsupported", why: `release line ${branch} is end of life` };
@@ -88,6 +95,15 @@ export function verdictFor(adv, ev, eol) {
   // exact or distro: the upstream version is known.
   if (fix) {
     if (fix.introduced && compareVersions(ev.version, fix.introduced) < 0) return { verdict: "none" };
+    // A pre-release of the version after the fix may predate the fix: PHP-8.4
+    // says 8.4.28-dev from 8.4.27's RC until well after its release, while the
+    // fix is merged only at release. Two patches on, it is in. (A pre-release
+    // of the fixed version sorts below it and is affected.)
+    if (ev.version.pre && compareVersions(ev.version, fix.version) >= 0) {
+      const f = parseVersion(fix.version);
+      const safe = !f.letters && compareVersions(ev.version.upstream, `${f.major}.${f.minor}.${f.patch + 2}`) >= 0;
+      if (!safe) return { verdict: "check", fix, why: `it is a pre-release build (${ev.version.raw}), which may predate the fix` };
+    }
     if (compareVersions(ev.version, fix.version) >= 0) return { verdict: "patched", fix };
     if (ev.kind === "distro") return { verdict: "check", fix, why: "it is a distribution build, which may carry the fix as a backport under the same upstream version" };
     return { verdict: "affected", fix };
@@ -97,6 +113,14 @@ export function verdictFor(adv, ev, eol) {
   return { verdict: "check", why: `the advisory lists no fix for release line ${branch}` };
 }
 
+// An exact version from a banner with no distribution token, for a product
+// distributions backport: it may be a patched package under the same number.
+const unmarked = (ev, p) => ev.kind === "exact" && ev.banner === true && p.backports;
+
+function unmarkedNote(p, label) {
+  return `Check on server: your distribution may have patched this under the same version number. The banner names no distribution, and Debian 11 to 13, Ubuntu 24.04 and later, and RHEL print plain upstream version numbers, so ${label} may be a distribution package. Run \`${p.checkCommand}\` on the server and ask the package manager which package provides it (\`dpkg -S\` or \`rpm -qf\` on the binary). For a package, look the CVE up in your distribution's security tracker.`;
+}
+
 function evidenceText(ev) {
   return ev.raws.map((r) => `- ${r}`).join("\n");
 }
@@ -122,6 +146,7 @@ export function matchRuntimeAdvisories(evidence, opts = {}) {
     const checks = [];
     const patched = [];
     const start = findings.length;
+    const note = unmarked(ev, p) ? unmarkedNote(p, label) : "";
 
     for (const adv of advisories.filter((a) => a.product === ev.product).sort(bySeverity)) {
       const v = verdictFor(adv, ev, eol);
@@ -129,12 +154,13 @@ export function matchRuntimeAdvisories(evidence, opts = {}) {
         findings.push({
           ...base,
           severity: adv.severity,
-          confidence: adv.condition ? "potential" : "likely",
+          confidence: adv.condition || note ? "potential" : "likely",
           title: `${label} is affected by ${adv.title}`,
           description: [
             `${label} (seen in ${ev.wheres.join(", ")}) is below ${v.fix.version}, the first fixed version on the ${v.fix.branch} line, for ${advLine(adv)}.`,
             adv.kev ? `CISA lists it as exploited in the wild (Known Exploited Vulnerabilities catalog, added ${adv.kev}).` : "",
             adv.condition ? `It only applies when: ${adv.condition}. A version alone cannot show that, so confirm it on the server.` : "",
+            note,
             adv.description || "",
             `Evidence:\n${evidenceText(ev)}`,
           ].filter(Boolean).join("\n\n"),
@@ -150,8 +176,9 @@ export function matchRuntimeAdvisories(evidence, opts = {}) {
           title: `${label} is on an end-of-life line with no fix for ${adv.title}`,
           description: [
             `${label} (seen in ${ev.wheres.join(", ")}) is on release line ${branch}, which ${p.name} stopped supporting on ${eol.eol} (${eol.rule.source}). The advisory ${advLine(adv)} lists fixes only for ${adv.fixed.map((f) => f.branch).join(", ")}, so this line gets none. Whether the flaw exists on ${branch} is not stated; treat it as affected.`,
+            note,
             `Evidence:\n${evidenceText(ev)}`,
-          ].join("\n\n"),
+          ].filter(Boolean).join("\n\n"),
           remediation: `Move to a supported ${p.name} line (${adv.fixed.map((f) => `${f.branch}: ${f.version}+`).join(", ")}).`,
           cves: adv.cves,
           rule: adv.id,
@@ -186,13 +213,14 @@ export function matchRuntimeAdvisories(evidence, opts = {}) {
       findings.push({
         ...base,
         severity: distro ? "medium" : "high",
-        confidence: distro ? "needs-human-review" : "likely",
+        confidence: distro ? "needs-human-review" : note ? "potential" : "likely",
         title: distro
           ? `${label} is a distribution build of an end-of-life ${p.name} line`
           : `${label} is end of life: no more security fixes`,
         description: [
           `${p.name} ${branch} reached end of support on ${eol.eol} (${eol.rule.source}). Upstream publishes no security fixes for it, including for future advisories.`,
           distro ? "This is a distribution build, and some distributions keep patching a line after upstream stops. Check your distribution's support period for this package." : "",
+          note,
           `Evidence:\n${evidenceText(ev)}`,
         ].filter(Boolean).join("\n\n"),
         remediation: `Upgrade to a supported ${p.name} release line.`,
@@ -205,7 +233,7 @@ export function matchRuntimeAdvisories(evidence, opts = {}) {
       findings.push({
         ...base,
         severity: "info",
-        confidence: ev.kind === "exact" ? "likely" : "potential",
+        confidence: ev.kind === "exact" && !ev.version.pre ? "likely" : "potential",
         title: `${label} has the fix for ${patched.length === 1 ? patched[0].title : `${patched.length} known advisories`} (as advertised)`,
         description: [
           `The version ${ev.kind === "distro" ? "string" : "banner or pin"} is at or above the fixed version for: ${patched.map((a) => ids(a)).join(", ")}. This is what ${ev.wheres.join(", ")} says; a proxy or a stale banner can differ from what runs.`,

package/lib/advisories/products.js

@@ -1,6 +1,9 @@
 /**
  * The runtimes and servers runtime advisories can name, and how to recognize
- * each one. Detection is code; which versions are affected is data, in signed
+ * each one. `backports`: distributions commonly ship it with security fixes
+ * backported under the upstream number, so a banner with no distribution
+ * token may still be a patched package (Debian 11-13, Ubuntu 24.04+ and RHEL
+ * print plain PHP versions; Debian's and RHEL's nginx add no OS token). Detection is code; which versions are affected is data, in signed
  * rule packs (kind `runtime-advisory`, see lib/rules/pack.js).
  */
 
@@ -12,6 +15,7 @@ export const PRODUCTS = Object.freeze({
   php: {
     branchOf: minorLine,
     name: "PHP",
+    backports: true,
     // On the server itself, the version and any distro build string.
     checkCommand: "php -v",
     banner: /\bPHP\/(\d+\.\d+(?:\.\d+)?[^\s,;()]*)/i,
@@ -24,6 +28,7 @@ export const PRODUCTS = Object.freeze({
   "apache-httpd": {
     branchOf: minorLine,
     name: "Apache HTTP Server",
+    backports: true,
     checkCommand: "httpd -v (or apache2 -v)",
     banner: /\bApache\/(\d+\.\d+\.\d+[^\s,;()]*)/,
     // not Apache-Coyote (Tomcat) or Apache-HttpClient
@@ -35,6 +40,7 @@ export const PRODUCTS = Object.freeze({
   nginx: {
     branchOf: minorLine,
     name: "nginx",
+    backports: true,
     checkCommand: "nginx -v",
     banner: /\bnginx\/(\d+\.\d+\.\d+[^\s,;()]*)/i,
     present: /^nginx\b/i,
@@ -45,27 +51,48 @@ export const PRODUCTS = Object.freeze({
   nodejs: {
     branchOf: (v) => String(v.major),
     name: "Node.js",
+    // Node.js has no version banner, and official images and binaries are upstream.
+    backports: false,
     checkCommand: "node -v",
     banner: null,
     present: null,
     dockerImages: ["node"],
     toolVersions: ["nodejs", "node"],
     versionFiles: [".nvmrc", ".node-version"],
+    // LTS codenames, as in nvm's `lts/iron` and the node image's `iron` tag
+    // (the `lts` field of https://nodejs.org/dist/index.json).
+    lineAliases: { argon: "4", boron: "6", carbon: "8", dubnium: "10", erbium: "12", fermium: "14", gallium: "16", hydrogen: "18", iron: "20", jod: "22", krypton: "24" },
   },
   python: {
     branchOf: minorLine,
     name: "Python",
+    backports: true,
     checkCommand: "python3 --version",
-    // Werkzeug and http.server print "Python/3.12.1" in Server
-    banner: /\bPython\/(\d+\.\d+\.\d+[^\s,;()]*)/,
+    // Werkzeug and http.server print "Python/3.12.1" in Server; aiohttp only
+    // "Python/3.12 aiohttp/3.9.5", which still names the release line
+    banner: /\bPython\/(\d+\.\d+(?:\.\d+)?[^\s,;()]*)/,
     present: null,
     dockerImages: ["python"],
     toolVersions: ["python"],
     versionFiles: [".python-version"],
   },
+  mongodb: {
+    branchOf: minorLine,
+    name: "MongoDB",
+    // Read only from the official image and .tool-versions, which are upstream builds.
+    backports: false,
+    checkCommand: "mongod --version",
+    // A database: no HTTP banner. Seen only in what the repository pins.
+    banner: null,
+    present: null,
+    dockerImages: ["mongo"],
+    toolVersions: ["mongodb"],
+    versionFiles: [],
+  },
   openssl: {
     branchOf: (v) => (v.major >= 3 ? minorLine(v) : v.patch === null ? null : `${v.major}.${v.minor}.${v.patch}`),
     name: "OpenSSL",
+    backports: true,
     checkCommand: "openssl version",
     banner: /\bOpenSSL\/(\d+\.\d+\.\d+[a-z]{0,2}[^\s,;()]*)/,
     present: null,