feat(nodejs): detect Node.js runtime version from header

[jetersen]

Feature discussion

• Detect manually installed Node.js runtimes and report Node.js core vulnerabilities #10952

Description

Detect the installed Node.js runtime version from the standard include/node/node_version.h header. The analyzer reads NODE_MAJOR_VERSION, NODE_MINOR_VERSION, and NODE_PATCH_VERSION, then emits node@<version> alongside other Node.js packages.

This covers manually installed runtimes such as the official Node.js container image, where no apk, dpkg, or rpm package metadata identifies the runtime.

Runtime CVE advisories are added by the companion trivy-db PR:

• feat(node): ingest Node.js runtime advisories trivy-db#683

Both changes are required for runtime CVE reporting: this PR supplies the installed version; trivy-db supplies vulnerable and patched version ranges.

Verification

Official node:latest:

NODE_VERSION=26.5.0
/usr/local/include/node/node_version.h
node component: 26.5.0 pkg:npm/node@26.5.0

Testing

• GOEXPERIMENT=jsonv2 go test ./pkg/fanal/analyzer/language/nodejs/pkg
• End-to-end CycloneDX scan of node:latest
• git diff --check

Notes

Image NODE_VERSION environment-variable fallback is intentionally not included; the standard installed header is used as the authoritative source.

Maintainer decision requested

The companion trivy-db importer has intentionally skipped Node.js core advisories since 2019. trivy-db PR #683 is therefore a deliberate behavior change, not merely wiring previously unused data. Pending confirmation that runtime CVE reporting—and use of package node in the npm ecosystem—is the desired model.

[jetersen]

This has useful to have access after a trivy scan besides for vulns but the ability to tell which image is using what nodejs version is a good diagnostic tool.