apisec-code-bolt 0.1.0__py3-none-any.whl

apisec_code_bolt/analysis/dependency_extractor.py

@@ -0,0 +1,959 @@
+"""
+Dependency extraction from project dependency files.
+
+Parses requirements.txt, Pipfile, pyproject.toml, setup.cfg, setup.py,
+package.json, go.mod, Cargo.toml, *.csproj, pom.xml, and build.gradle(.kts)
+to produce a unified dependency model.
+"""
+
+from __future__ import annotations
+
+import configparser
+import json
+import logging
+import re
+from pathlib import Path
+
+from ..core.manifest import (
+    DependenciesModel,
+    ImportModel,
+    LocationModel,
+    PackageDependencyModel,
+)
+from ..parsing.base import ParsedFile
+
+logger = logging.getLogger(__name__)
+
+
+class DependencyExtractor:
+    """Extracts package dependencies and internal imports from a project."""
+
+    _DEP_FILE_PARSERS: dict[str, str] = {
+        "requirements.txt": "_parse_requirements_txt",
+        "Pipfile": "_parse_pipfile",
+        "pyproject.toml": "_parse_pyproject_toml",
+        "setup.cfg": "_parse_setup_cfg",
+        "setup.py": "_parse_setup_py",
+        "package.json": "_parse_package_json",
+        "go.mod": "_parse_go_mod",
+        "Cargo.toml": "_parse_cargo_toml",
+    }
+
+    # Each parser handles exactly one ecosystem; tag packages authoritatively at
+    # the source so the reasoning engine never has to guess from source_file. (F-6)
+    # Values match OSV ecosystem names (reasoning engine's Ecosystem enum).
+    _ECOSYSTEM_BY_PARSER: dict[str, str] = {
+        "_parse_requirements_txt": "PyPI",
+        "_parse_pipfile": "PyPI",
+        "_parse_pyproject_toml": "PyPI",
+        "_parse_setup_cfg": "PyPI",
+        "_parse_setup_py": "PyPI",
+        "_parse_package_json": "npm",
+        "_parse_go_mod": "Go",
+        "_parse_cargo_toml": "crates.io",
+        "_parse_csproj": "NuGet",
+        "_parse_pom": "Maven",
+        "_parse_gradle": "Maven",
+    }
+
+    _SKIP_DIRS = frozenset(
+        {
+            ".venv",
+            "venv",
+            "node_modules",
+            ".git",
+            "__pycache__",
+            ".tox",
+            ".nox",
+            ".mypy_cache",
+            ".pytest_cache",
+            "dist",
+            "build",
+            "test",
+            "tests",
+            "example",
+            "examples",
+            "docs",
+        }
+    )
+
+    _REQ_VERSION_RE = re.compile(
+        r"^([A-Za-z0-9][\w.*-]*(?:\[[^\]]*\])?)\s*(.*)",
+    )
+
+    # Exact npm/semver pin: 1.2.3, 1.2.3-rc.1, 1.2.3+build, 1.2.3-rc.1+build —
+    # NOT ^1.2.3, ~1.2.3, 1.2.x, 1.x, or hyphen/OR ranges (which also start
+    # with a digit). Pre-release and build metadata are each optional.
+    _EXACT_SEMVER_RE = re.compile(r"^\d+\.\d+\.\d+(?:-[0-9A-Za-z.\-]+)?(?:\+[0-9A-Za-z.\-]+)?$")
+
+    _SETUP_PY_INSTALL_REQUIRES = re.compile(
+        r"install_requires\s*=\s*\[([^\]]*)\]",
+        re.DOTALL,
+    )
+    _SETUP_PY_TESTS_REQUIRE = re.compile(
+        r"tests_require\s*=\s*\[([^\]]*)\]",
+        re.DOTALL,
+    )
+
+    _GO_MOD_REQUIRE_BLOCK = re.compile(
+        r"require\s*\((.*?)\)",
+        re.DOTALL,
+    )
+    _GO_MOD_SINGLE = re.compile(
+        r"require\s+([\w./\-]+)\s+(v[\w.\-+]+)",
+    )
+
+    # Gradle dependency configurations we recognise (Groovy + Kotlin DSL).
+    _GRADLE_CONFIGS = (
+        r"implementation|api|compileOnly|compileOnlyApi|runtimeOnly|"
+        r"testImplementation|testCompileOnly|testRuntimeOnly|"
+        r"androidTestImplementation|annotationProcessor|kapt|ksp|"
+        r"developmentOnly|providedCompile|providedRuntime|classpath"
+    )
+    # String notation: implementation 'g:a:v'  /  implementation("g:a:v")  (version optional)
+    _GRADLE_STRING_DEP = re.compile(
+        r"\b(" + _GRADLE_CONFIGS + r")\s*\(?\s*['\"]"
+        r"([\w.\-]+):([\w.\-]+)(?::([^'\"]+))?['\"]"
+    )
+    # Map notation: implementation group: 'g', name: 'a', version: 'v'  (version optional)
+    _GRADLE_MAP_DEP = re.compile(
+        r"\b(" + _GRADLE_CONFIGS + r")\s*\(?\s*"
+        r"group:\s*['\"]([\w.\-]+)['\"]\s*,\s*name:\s*['\"]([\w.\-]+)['\"]"
+        r"(?:\s*,\s*version:\s*['\"]([^'\"]+)['\"])?"
+    )
+    # A literal, exact Gradle/Maven version: starts with a digit, no dynamic
+    # (+), range ([](),), or variable ($) markers.
+    _EXACT_JVM_VERSION_RE = re.compile(r"^\d[\w.\-]*$")
+
+    def __init__(
+        self,
+        project_root: Path,
+        parsed_files: dict[Path, ParsedFile],
+    ) -> None:
+        self._project_root = project_root
+        self._parsed_files = parsed_files
+
+    def extract(self) -> DependenciesModel:
+        """Extract package dependencies from all recognised dependency files."""
+        packages: list[PackageDependencyModel] = []
+        root = self._project_root
+
+        # 1. Check each known dep file at project root
+        for filename, method_name in self._DEP_FILE_PARSERS.items():
+            dep_file = root / filename
+            if dep_file.exists():
+                parser_fn = getattr(self, method_name)
+                packages.extend(self._tag(parser_fn(dep_file), method_name))
+
+        # 2. Glob for requirements-*.txt / requirements_*.txt variants
+        for pattern in ("requirements-*.txt", "requirements_*.txt"):
+            for req_variant in sorted(root.glob(pattern)):
+                if req_variant.name == "requirements.txt":
+                    continue  # already handled above
+                packages.extend(
+                    self._tag(self._parse_requirements_txt(req_variant), "_parse_requirements_txt")
+                )
+
+        # 3. Scan requirements/ subdirectory (*.txt and *.in files)
+        req_dir = root / "requirements"
+        if req_dir.is_dir():
+            for req_file in sorted(req_dir.glob("*")):
+                if req_file.suffix in (".txt", ".in") and req_file.is_file():
+                    packages.extend(
+                        self._tag(self._parse_requirements_txt(req_file), "_parse_requirements_txt")
+                    )
+
+        # 3b. Workspace member / shallow subdirectory dep files
+        member_dirs = self._find_workspace_members(root)
+        for member_dir in member_dirs:
+            for filename, method_name in self._DEP_FILE_PARSERS.items():
+                dep_file = member_dir / filename
+                if dep_file.exists():
+                    parser_fn = getattr(self, method_name)
+                    packages.extend(self._tag(parser_fn(dep_file), method_name))
+            for pattern in ("requirements-*.txt", "requirements_*.txt"):
+                for req_variant in sorted(member_dir.glob(pattern)):
+                    packages.extend(
+                        self._tag(
+                            self._parse_requirements_txt(req_variant), "_parse_requirements_txt"
+                        )
+                    )
+
+        # 3c. .csproj files (NuGet / .NET) — glob recursively from root
+        for csproj in sorted(root.rglob("*.csproj")):
+            packages.extend(self._tag(self._parse_csproj(csproj), "_parse_csproj"))
+
+        # 3d. Maven pom.xml + Gradle build files (JVM) — recursive, skipping
+        # build-output and vendored dirs. Catches multi-module / subproject
+        # layouts common in Spring Boot, Micronaut, and Quarkus apps.
+        for pom in sorted(root.rglob("pom.xml")):
+            if self._under_skip_dir(pom, root):
+                continue
+            packages.extend(self._tag(self._parse_pom(pom), "_parse_pom"))
+        for pattern in ("build.gradle", "build.gradle.kts"):
+            for gradle in sorted(root.rglob(pattern)):
+                if self._under_skip_dir(gradle, root):
+                    continue
+                packages.extend(self._tag(self._parse_gradle(gradle), "_parse_gradle"))
+
+        # 4. Deduplicate by (name, source_file)
+        seen: set[tuple[str, str]] = set()
+        deduped: list[PackageDependencyModel] = []
+        for pkg in packages:
+            key = (pkg.name.lower(), pkg.source_file)
+            if key not in seen:
+                seen.add(key)
+                deduped.append(pkg)
+        packages = deduped
+
+        # 5. Collect imports
+        imports: list[ImportModel] = []
+        for parsed_file in self._parsed_files.values():
+            if not parsed_file.success:
+                continue
+
+            for imp in parsed_file.imports:
+                imports.append(
+                    ImportModel(
+                        module=imp.module,
+                        names=imp.names,
+                        alias=imp.alias,
+                        is_relative=imp.is_relative,
+                        location=LocationModel(
+                            file=str(parsed_file.path),
+                            line=imp.location.line if imp.location else 0,
+                        )
+                        if imp.location
+                        else LocationModel(file=str(parsed_file.path), line=0),
+                    )
+                )
+
+        return DependenciesModel(packages=packages, internal_imports=imports)
+
+    def _tag(
+        self, packages: list[PackageDependencyModel], method_name: str
+    ) -> list[PackageDependencyModel]:
+        """Stamp the ecosystem of the parser that produced these packages. (F-6)"""
+        ecosystem = self._ECOSYSTEM_BY_PARSER.get(method_name)
+        for pkg in packages:
+            pkg.ecosystem = ecosystem
+        return packages
+
+    def _under_skip_dir(self, path: Path, root: Path) -> bool:
+        """True if *path* sits under a build-output or vendored directory."""
+        try:
+            parts = path.relative_to(root).parts[:-1]  # exclude the filename
+        except ValueError:
+            parts = path.parts[:-1]
+        return any(part in self._SKIP_DIRS or part == "target" for part in parts)
+
+    # -- workspace member discovery --------------------------------------------
+
+    def _find_workspace_members(self, root: Path) -> list[Path]:
+        """Return directories that may contain their own dependency files.
+
+        Checks for uv workspace (``[tool.uv.workspace.members]``), Poetry
+        workspaces (``[tool.poetry.packages]``), and falls back to a shallow
+        depth-1 glob for any immediate subdirectory containing a recognised
+        dep file.
+        """
+
+        root_pyproject = root / "pyproject.toml"
+        member_dirs: list[Path] = []
+
+        if root_pyproject.exists():
+            try:
+                import tomllib
+
+                data = tomllib.loads(root_pyproject.read_text(errors="replace"))
+            except Exception:
+                data = {}
+
+            member_globs: list[str] = []
+
+            uv_members = data.get("tool", {}).get("uv", {}).get("workspace", {}).get("members", [])
+            if uv_members:
+                member_globs.extend(uv_members)
+
+            poetry_packages = data.get("tool", {}).get("poetry", {}).get("packages", [])
+            for pkg in poetry_packages:
+                if isinstance(pkg, dict) and "include" in pkg:
+                    member_globs.append(pkg["include"])
+
+            for pattern in member_globs:
+                clean = pattern.rstrip("/").rstrip("*").rstrip("/")
+                if not clean:
+                    continue
+                for candidate in sorted(root.glob(clean)):
+                    if candidate.is_dir() and candidate.name not in self._SKIP_DIRS:
+                        member_dirs.append(candidate)
+
+        if not member_dirs:
+            for child in sorted(root.iterdir()):
+                if not child.is_dir() or child.name.startswith("."):
+                    continue
+                if child.name in self._SKIP_DIRS:
+                    continue
+                has_dep_file = any((child / fname).exists() for fname in self._DEP_FILE_PARSERS)
+                if has_dep_file:
+                    member_dirs.append(child)
+
+        return member_dirs
+
+    # -- requirements.txt / requirements-*.txt ---------------------------------
+
+    def _parse_requirements_txt(self, path: Path) -> list[PackageDependencyModel]:
+        """Parse requirements.txt (or any requirements-*.txt variant)."""
+        source_name = path.name
+        is_dev = "dev" in source_name.lower() or "test" in source_name.lower()
+        packages: list[PackageDependencyModel] = []
+
+        try:
+            for line in path.read_text(errors="replace").splitlines():
+                line = line.split("#", 1)[0].strip()
+                if not line:
+                    continue
+                # Skip flags (-r, --hash, --index-url, etc.) and URLs
+                if (
+                    line.startswith("-")
+                    or line.startswith("http://")
+                    or line.startswith("https://")
+                ):
+                    continue
+
+                m = self._REQ_VERSION_RE.match(line)
+                if not m:
+                    continue
+                raw_name, constraint = m.group(1), m.group(2).strip()
+                # Strip extras bracket from the name for the canonical name
+                name = raw_name.split("[")[0].strip()
+                if not name:
+                    continue
+
+                # Only "==" (and PEP 440 arbitrary-equality "===") is an exact
+                # pin. Floors/ranges (~=, >=, >, <) leave version=None so the
+                # matcher never confirms a CVE against a version the resolver
+                # may not have installed. (F-1)
+                version: str | None = None
+                if constraint.startswith("==="):
+                    version = constraint[3:].strip().split(",")[0].strip()
+                elif constraint.startswith("=="):
+                    version = constraint[2:].strip().split(",")[0].strip()
+
+                packages.append(
+                    PackageDependencyModel(
+                        name=name,
+                        version=version,
+                        version_constraint=constraint or None,
+                        is_dev=is_dev,
+                        source_file=source_name,
+                    )
+                )
+        except Exception as e:
+            logger.warning("Failed to parse %s: %s", path.name, e)
+
+        return packages
+
+    # -- Pipfile ---------------------------------------------------------------
+
+    def _parse_pipfile(self, path: Path) -> list[PackageDependencyModel]:
+        """Parse a Pipfile (TOML format) — [packages] and [dev-packages]."""
+        packages: list[PackageDependencyModel] = []
+        try:
+            import tomllib
+        except ImportError:
+            logger.debug("tomllib unavailable, skipping Pipfile")
+            return packages
+
+        try:
+            data = tomllib.loads(path.read_text(errors="replace"))
+        except Exception as e:
+            logger.warning("Failed to parse Pipfile: %s", e)
+            return packages
+
+        for section, is_dev in (("packages", False), ("dev-packages", True)):
+            for name, spec in data.get(section, {}).items():
+                version: str | None = None
+                constraint: str | None = None
+                if isinstance(spec, str):
+                    constraint = spec if spec != "*" else None
+                    if spec.startswith("=="):
+                        version = spec[2:]
+                elif isinstance(spec, dict):
+                    ver = spec.get("version", "*")
+                    constraint = ver if ver != "*" else None
+                    if isinstance(ver, str) and ver.startswith("=="):
+                        version = ver[2:]
+
+                packages.append(
+                    PackageDependencyModel(
+                        name=name,
+                        version=version,
+                        version_constraint=constraint,
+                        is_dev=is_dev,
+                        source_file="Pipfile",
+                    )
+                )
+
+        return packages
+
+    # -- pyproject.toml --------------------------------------------------------
+
+    def _parse_pyproject_toml(self, path: Path) -> list[PackageDependencyModel]:
+        """Parse pyproject.toml — PEP 621 and Poetry formats."""
+        packages: list[PackageDependencyModel] = []
+        try:
+            import tomllib
+        except ImportError:
+            logger.debug("tomllib unavailable, skipping pyproject.toml")
+            return packages
+
+        try:
+            data = tomllib.loads(path.read_text(errors="replace"))
+        except Exception as e:
+            logger.warning("Failed to parse pyproject.toml: %s", e)
+            return packages
+
+        # PEP 621 — [project] dependencies
+        for dep in data.get("project", {}).get("dependencies", []):
+            name = re.split(r"[\[><=!~;]", dep, maxsplit=1)[0].strip()
+            if name:
+                packages.append(
+                    PackageDependencyModel(
+                        name=name,
+                        version_constraint=dep.strip(),
+                        source_file="pyproject.toml",
+                    )
+                )
+
+        # PEP 621 — [project.optional-dependencies]
+        for group, deps in data.get("project", {}).get("optional-dependencies", {}).items():
+            is_dev = group.lower() in {"dev", "test", "testing", "tests", "lint", "docs"}
+            for dep in deps:
+                name = re.split(r"[\[><=!~;]", dep, maxsplit=1)[0].strip()
+                if name:
+                    packages.append(
+                        PackageDependencyModel(
+                            name=name,
+                            version_constraint=dep.strip(),
+                            is_dev=is_dev,
+                            source_file="pyproject.toml",
+                        )
+                    )
+
+        # Poetry — [tool.poetry.dependencies]
+        poetry = data.get("tool", {}).get("poetry", {})
+        for name, spec in poetry.get("dependencies", {}).items():
+            if name.lower() == "python":
+                continue
+            constraint = self._poetry_constraint(spec)
+            packages.append(
+                PackageDependencyModel(
+                    name=name,
+                    version=constraint if constraint and constraint.startswith("==") else None,
+                    version_constraint=constraint,
+                    source_file="pyproject.toml",
+                )
+            )
+
+        # Poetry — [tool.poetry.group.*.dependencies]
+        for group_name, group_data in poetry.get("group", {}).items():
+            is_dev = group_name.lower() in {"dev", "test", "testing", "tests", "lint", "docs"}
+            for name, spec in group_data.get("dependencies", {}).items():
+                if name.lower() == "python":
+                    continue
+                constraint = self._poetry_constraint(spec)
+                packages.append(
+                    PackageDependencyModel(
+                        name=name,
+                        version=constraint if constraint and constraint.startswith("==") else None,
+                        version_constraint=constraint,
+                        is_dev=is_dev,
+                        source_file="pyproject.toml",
+                    )
+                )
+
+        # Poetry — legacy [tool.poetry.dev-dependencies]
+        for name, spec in poetry.get("dev-dependencies", {}).items():
+            if name.lower() == "python":
+                continue
+            constraint = self._poetry_constraint(spec)
+            packages.append(
+                PackageDependencyModel(
+                    name=name,
+                    version=constraint if constraint and constraint.startswith("==") else None,
+                    version_constraint=constraint,
+                    is_dev=True,
+                    source_file="pyproject.toml",
+                )
+            )
+
+        return packages
+
+    @staticmethod
+    def _poetry_constraint(spec: str | dict) -> str | None:
+        """Normalise a Poetry version spec to a constraint string."""
+        if isinstance(spec, str):
+            return spec if spec != "*" else None
+        if isinstance(spec, dict):
+            v = spec.get("version", "*")
+            return v if v != "*" else None
+        return None
+
+    # -- setup.cfg -------------------------------------------------------------
+
+    def _parse_setup_cfg(self, path: Path) -> list[PackageDependencyModel]:
+        """Parse setup.cfg [options] install_requires and extras_require."""
+        packages: list[PackageDependencyModel] = []
+        cfg = configparser.ConfigParser()
+
+        try:
+            cfg.read(str(path), encoding="utf-8")
+        except Exception as e:
+            logger.warning("Failed to parse setup.cfg: %s", e)
+            return packages
+
+        for dep_str in self._cfg_multiline(cfg, "options", "install_requires"):
+            name = re.split(r"[\[><=!~;]", dep_str, maxsplit=1)[0].strip()
+            if name:
+                packages.append(
+                    PackageDependencyModel(
+                        name=name,
+                        version_constraint=dep_str.strip(),
+                        source_file="setup.cfg",
+                    )
+                )
+
+        # extras_require sections (e.g. [options.extras_require] dev = ...)
+        if cfg.has_section("options.extras_require"):
+            for group in cfg.options("options.extras_require"):
+                is_dev = group.lower() in {"dev", "test", "testing", "tests", "lint", "docs"}
+                raw = cfg.get("options.extras_require", group, fallback="")
+                for dep_str in self._split_cfg_list(raw):
+                    name = re.split(r"[\[><=!~;]", dep_str, maxsplit=1)[0].strip()
+                    if name:
+                        packages.append(
+                            PackageDependencyModel(
+                                name=name,
+                                version_constraint=dep_str.strip(),
+                                is_dev=is_dev,
+                                source_file="setup.cfg",
+                            )
+                        )
+
+        return packages
+
+    @staticmethod
+    def _cfg_multiline(cfg: configparser.ConfigParser, section: str, key: str) -> list[str]:
+        """Read a setup.cfg multiline value as a list of non-empty strings."""
+        raw = cfg.get(section, key, fallback="")
+        return [line.strip() for line in raw.splitlines() if line.strip()]
+
+    @staticmethod
+    def _split_cfg_list(raw: str) -> list[str]:
+        """Split a comma-or-newline-separated setup.cfg value."""
+        items: list[str] = []
+        for part in raw.replace("\n", ",").split(","):
+            part = part.strip()
+            if part:
+                items.append(part)
+        return items
+
+    # -- setup.py (regex) ------------------------------------------------------
+
+    def _parse_setup_py(self, path: Path) -> list[PackageDependencyModel]:
+        """Best-effort regex extraction of install_requires from setup.py."""
+        packages: list[PackageDependencyModel] = []
+        try:
+            content = path.read_text(errors="replace")
+        except Exception as e:
+            logger.warning("Failed to read setup.py: %s", e)
+            return packages
+
+        for pattern, is_dev in (
+            (self._SETUP_PY_INSTALL_REQUIRES, False),
+            (self._SETUP_PY_TESTS_REQUIRE, True),
+        ):
+            m = pattern.search(content)
+            if not m:
+                continue
+            for item in self._extract_string_literals(m.group(1)):
+                name = re.split(r"[\[><=!~;]", item, maxsplit=1)[0].strip()
+                if name:
+                    packages.append(
+                        PackageDependencyModel(
+                            name=name,
+                            version_constraint=item.strip(),
+                            is_dev=is_dev,
+                            source_file="setup.py",
+                        )
+                    )
+
+        return packages
+
+    @staticmethod
+    def _extract_string_literals(text: str) -> list[str]:
+        """Pull quoted strings out of a Python list literal fragment."""
+        return re.findall(r"""['"]([^'"]+)['"]""", text)
+
+    # -- package.json (Node / JS / TS) -----------------------------------------
+
+    def _parse_package_json(self, path: Path) -> list[PackageDependencyModel]:
+        """Parse package.json dependencies and devDependencies."""
+        packages: list[PackageDependencyModel] = []
+        try:
+            data = json.loads(path.read_text(errors="replace"))
+        except Exception as e:
+            logger.warning("Failed to parse package.json: %s", e)
+            return packages
+
+        for section, is_dev in (("dependencies", False), ("devDependencies", True)):
+            for name, ver in data.get(section, {}).items():
+                # Bare "1.2.3" is an exact pin in npm, but "1.2.x", "1.x", and
+                # hyphen/OR ranges also start with a digit — accept only strict
+                # exact semver so ranges aren't treated as installed. (F-2)
+                version: str | None = None
+                if isinstance(ver, str) and self._EXACT_SEMVER_RE.match(ver.strip()):
+                    version = ver.strip()
+                packages.append(
+                    PackageDependencyModel(
+                        name=name,
+                        version=version,
+                        version_constraint=ver if isinstance(ver, str) else None,
+                        is_dev=is_dev,
+                        source_file="package.json",
+                    )
+                )
+
+        return packages
+
+    # -- go.mod ----------------------------------------------------------------
+
+    def _parse_go_mod(self, path: Path) -> list[PackageDependencyModel]:
+        """Parse go.mod require blocks."""
+        packages: list[PackageDependencyModel] = []
+        try:
+            content = path.read_text(errors="replace")
+        except Exception as e:
+            logger.warning("Failed to read go.mod: %s", e)
+            return packages
+
+        # Multi-line require ( ... ) blocks
+        for block in self._GO_MOD_REQUIRE_BLOCK.findall(content):
+            for line in block.splitlines():
+                line = line.split("//")[0].strip()
+                if not line:
+                    continue
+                parts = line.split()
+                if len(parts) >= 2:
+                    packages.append(
+                        PackageDependencyModel(
+                            name=parts[0],
+                            version=parts[1],
+                            version_constraint=parts[1],
+                            source_file="go.mod",
+                        )
+                    )
+
+        # Single-line require statements
+        for m in self._GO_MOD_SINGLE.finditer(content):
+            pkg_name, ver = m.group(1), m.group(2)
+            if not any(p.name == pkg_name for p in packages):
+                packages.append(
+                    PackageDependencyModel(
+                        name=pkg_name,
+                        version=ver,
+                        version_constraint=ver,
+                        source_file="go.mod",
+                    )
+                )
+
+        return packages
+
+    # -- Cargo.toml (Rust) -----------------------------------------------------
+
+    def _parse_cargo_toml(self, path: Path) -> list[PackageDependencyModel]:
+        """Parse Cargo.toml [dependencies] and [dev-dependencies]."""
+        packages: list[PackageDependencyModel] = []
+        try:
+            import tomllib
+        except ImportError:
+            logger.debug("tomllib unavailable, skipping Cargo.toml")
+            return packages
+
+        try:
+            data = tomllib.loads(path.read_text(errors="replace"))
+        except Exception as e:
+            logger.warning("Failed to parse Cargo.toml: %s", e)
+            return packages
+
+        for section, is_dev in (("dependencies", False), ("dev-dependencies", True)):
+            for name, spec in data.get(section, {}).items():
+                version: str | None = None
+                constraint: str | None = None
+                if isinstance(spec, str):
+                    constraint = spec
+                elif isinstance(spec, dict):
+                    constraint = spec.get("version")
+                # Cargo defaults a bare "1.2.3" to "^1.2.3" (caret). Only a
+                # leading single "=" is an exact pin. (F-1)
+                if (
+                    constraint
+                    and constraint.lstrip().startswith("=")
+                    and not constraint.lstrip().startswith("==")
+                ):
+                    version = constraint.lstrip()[1:].strip()
+
+                packages.append(
+                    PackageDependencyModel(
+                        name=name,
+                        version=version,
+                        version_constraint=constraint,
+                        is_dev=is_dev,
+                        source_file="Cargo.toml",
+                    )
+                )
+
+        return packages
+
+    def _parse_csproj(self, path: Path) -> list[PackageDependencyModel]:
+        """Parse a .csproj file and extract NuGet <PackageReference> entries.
+
+        Handles both versioned and version-less references (the latter are
+        common in Directory.Packages.props / central-package-management
+        scenarios where the version is inherited from a parent props file).
+
+        Example XML:
+            <PackageReference Include="Newtonsoft.Json" Version="13.0.3" />
+            <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" />
+        """
+        import xml.etree.ElementTree as ET
+
+        packages: list[PackageDependencyModel] = []
+        source_name = path.name
+
+        try:
+            tree = ET.parse(path)
+        except ET.ParseError as exc:
+            logger.warning("Failed to parse %s: %s", path, exc)
+            return packages
+
+        root_el = tree.getroot()
+        # Strip XML namespace if present (MSBuild files sometimes have one)
+        ns_prefix = ""
+        if root_el.tag.startswith("{"):
+            ns_prefix = root_el.tag[: root_el.tag.index("}") + 1]
+
+        # Classify dev/test references by common SDK item group labels
+        _dev_groups: frozenset[str] = frozenset(
+            {
+                "test",
+                "tests",
+                "testing",
+            }
+        )
+
+        for item_group in root_el.iter(f"{ns_prefix}ItemGroup"):
+            label = (item_group.get("Label") or "").lower()
+            is_dev = any(d in label for d in _dev_groups)
+
+            for ref in item_group.iter(f"{ns_prefix}PackageReference"):
+                name = ref.get("Include") or ref.get("Update") or ""
+                if not name:
+                    continue
+                name = name.strip()
+
+                version_str: str | None = ref.get("Version") or ref.get("VersionOverride") or None
+                # Version may also be a child element: <Version>1.0</Version>
+                if version_str is None:
+                    ver_el = ref.find(f"{ns_prefix}Version")
+                    if ver_el is not None and ver_el.text:
+                        version_str = ver_el.text.strip()
+
+                # Classify dev packages by common naming conventions when
+                # no explicit group label is present
+                if not is_dev:
+                    lower = name.lower()
+                    is_dev = any(
+                        lower.startswith(prefix)
+                        for prefix in (
+                            "microsoft.net.test",
+                            "xunit",
+                            "nunit",
+                            "mstest",
+                            "moq",
+                            "fluentassertions",
+                            "coverlet",
+                            "bogus",
+                        )
+                    )
+
+                # Detect Private/Tool-only assets (not a runtime dep)
+                private_assets = ref.get("PrivateAssets") or ""
+                if private_assets.lower() == "all":
+                    is_dev = True
+
+                packages.append(
+                    PackageDependencyModel(
+                        name=name,
+                        version=version_str,
+                        version_constraint=version_str,
+                        is_dev=is_dev,
+                        source_file=source_name,
+                    )
+                )
+
+        return packages
+
+    # -- pom.xml (Maven / JVM) -------------------------------------------------
+
+    def _parse_pom(self, path: Path) -> list[PackageDependencyModel]:
+        """Parse a Maven pom.xml.
+
+        Reads ``<dependencies>``, resolving each version through ``<properties>``
+        (``${prop}`` interpolation, incl. ``project.version``) and the local
+        ``<dependencyManagement>`` block. Coordinates are stored as
+        ``groupId:artifactId`` to match NVD/OSV. Only a literal version is a pin;
+        ranges (``[1,2)``), dynamic versions, and unresolved property refs
+        (e.g. versions inherited from an imported BOM) leave version=None with
+        the raw value preserved in version_constraint. (F-1/F-4)
+        """
+        import xml.etree.ElementTree as ET
+
+        packages: list[PackageDependencyModel] = []
+        try:
+            root_el = ET.parse(path).getroot()
+        except ET.ParseError as exc:
+            logger.warning("Failed to parse %s: %s", path, exc)
+            return packages
+
+        ns = root_el.tag[: root_el.tag.index("}") + 1] if root_el.tag.startswith("{") else ""
+
+        def q(tag: str) -> str:
+            return f"{ns}{tag}"
+
+        # Build the property table used for ${...} interpolation.
+        props: dict[str, str] = {}
+        for builtin, tag in (("project.version", "version"), ("project.groupId", "groupId")):
+            el = root_el.find(q(tag))
+            if el is not None and el.text:
+                props[builtin] = el.text.strip()
+        props_el = root_el.find(q("properties"))
+        if props_el is not None:
+            for child in props_el:
+                key = child.tag[len(ns) :] if ns else child.tag
+                if child.text:
+                    props[key] = child.text.strip()
+
+        def resolve(value: str | None) -> str | None:
+            """Resolve ${prop} references; None if any part can't be resolved."""
+            if value is None:
+                return None
+            value = value.strip()
+            seen: set[str] = set()
+            m = re.fullmatch(r"\$\{([^}]+)\}", value)
+            while m and m.group(1) not in seen:
+                seen.add(m.group(1))
+                repl = props.get(m.group(1))
+                if repl is None:
+                    return None
+                value = repl.strip()
+                m = re.fullmatch(r"\$\{([^}]+)\}", value)
+            return None if "${" in value else value
+
+        # dependencyManagement gives versions for deps that omit one.
+        managed: dict[str, str] = {}
+        dm = root_el.find(q("dependencyManagement"))
+        dm_deps = dm.find(q("dependencies")) if dm is not None else None
+        if dm_deps is not None:
+            for dep in dm_deps.findall(q("dependency")):
+                g = (
+                    resolve(dep.findtext(q("groupId")))
+                    or (dep.findtext(q("groupId")) or "").strip()
+                )
+                a = (dep.findtext(q("artifactId")) or "").strip()
+                v = resolve(dep.findtext(q("version")))
+                if g and a and v:
+                    managed[f"{g}:{a}"] = v
+
+        deps_el = root_el.find(q("dependencies"))
+        if deps_el is None:
+            return packages
+
+        for dep in deps_el.findall(q("dependency")):
+            group = (dep.findtext(q("groupId")) or "").strip()
+            artifact = (dep.findtext(q("artifactId")) or "").strip()
+            if not group or not artifact:
+                continue
+            group = resolve(group) or group
+            name = f"{group}:{artifact}"
+
+            raw_version = dep.findtext(q("version"))
+            constraint = raw_version.strip() if raw_version and raw_version.strip() else None
+            resolved = resolve(raw_version)
+            if resolved is None:
+                resolved = managed.get(name)
+                if resolved and constraint is None:
+                    constraint = resolved
+
+            version = resolved if resolved and self._EXACT_JVM_VERSION_RE.match(resolved) else None
+
+            scope = (dep.findtext(q("scope")) or "").strip().lower()
+            packages.append(
+                PackageDependencyModel(
+                    name=name,
+                    version=version,
+                    version_constraint=constraint,
+                    is_dev=(scope == "test"),
+                    source_file=path.name,
+                )
+            )
+
+        return packages
+
+    # -- build.gradle / build.gradle.kts (Gradle / JVM) ------------------------
+
+    def _parse_gradle(self, path: Path) -> list[PackageDependencyModel]:
+        """Best-effort regex extraction of Gradle dependencies (Groovy + Kotlin).
+
+        Handles string notation (``implementation 'g:a:v'`` /
+        ``implementation("g:a:v")``) and map notation (``group:`` / ``name:`` /
+        ``version:``). Coordinates are stored as ``groupId:artifactId``. Only a
+        literal version is a pin; dynamic versions (``1.+``), ranges, and
+        interpolated variables (``$ver``) leave version=None. (F-1/F-4)
+        """
+        packages: list[PackageDependencyModel] = []
+        try:
+            content = path.read_text(errors="replace")
+        except Exception as e:
+            logger.warning("Failed to read %s: %s", path.name, e)
+            return packages
+
+        seen: set[tuple[str, str]] = set()
+
+        def add(config: str, group: str, artifact: str, raw_version: str | None) -> None:
+            name = f"{group}:{artifact}"
+            key = (config, name)
+            if key in seen:
+                return
+            seen.add(key)
+            constraint = raw_version.strip() if raw_version and raw_version.strip() else None
+            version = (
+                constraint if constraint and self._EXACT_JVM_VERSION_RE.match(constraint) else None
+            )
+            packages.append(
+                PackageDependencyModel(
+                    name=name,
+                    version=version,
+                    version_constraint=constraint,
+                    is_dev=config.lower().startswith("test") or "androidtest" in config.lower(),
+                    source_file=path.name,
+                )
+            )
+
+        for m in self._GRADLE_STRING_DEP.finditer(content):
+            add(m.group(1), m.group(2), m.group(3), m.group(4))
+        for m in self._GRADLE_MAP_DEP.finditer(content):
+            add(m.group(1), m.group(2), m.group(3), m.group(4))
+
+        return packages