still_active 1.6.0 → 3.0.0.rc1

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: still_active
 version: !ruby/object:Gem::Version
-  version: 1.6.0
+  version: 3.0.0.rc1
 platform: ruby
 authors:
 - Sean Floyd
@@ -191,14 +191,49 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
-description: 'Analyses your Gemfile for dependency health: checks if gems are actively
-  maintained (last commit dates via GitHub and GitLab, release dates), outdated versions,
-  archived repos, OpenSSF Scorecard security scores, known vulnerabilities via deps.dev,
-  and libyear drift. Ruby version freshness with EOL detection. Handles rubygems,
-  git, path, and GitHub Packages sources. Outputs coloured terminal tables, markdown,
-  or JSON. CI quality gates with --fail-if-critical, --fail-if-warning, --fail-if-vulnerable,
-  --fail-if-outdated, and --ignore. A comprehensive alternative to running bundle
-  outdated, bundler-audit, and libyear-bundler separately.'
+- !ruby/object:Gem::Dependency
+  name: packageurl-ruby
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.1.0
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.1.0
+- !ruby/object:Gem::Dependency
+  name: semantic_range
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '3.0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '3.0'
+description: 'Analyses your Gemfile.lock for dependency health across the full transitive
+  graph: whether each gem is actively maintained (last activity on GitHub, GitLab,
+  or Codeberg/Forgejo, plus release recency), outdated versions, archived repos, OpenSSF
+  Scorecard scores, known vulnerabilities (deps.dev and OSV, merged with ruby-advisory-db,
+  flagging advisories with no fix and pins that sit below the fix), poison-pill compatibility
+  ceilings, and libyear drift. Ruby version freshness with EOL detection. The same
+  maintenance lens travels cross-ecosystem: point --sbom at a CycloneDX SBOM to assess
+  npm, PyPI, Cargo, Go, Maven, and NuGet packages via deps.dev and ecosyste.ms. Handles
+  rubygems, git, path, GitHub Packages, and JFrog Artifactory sources. Outputs coloured
+  terminal tables, markdown, JSON (with a versioned, contract-tested schema), SARIF
+  for GitHub code scanning, and a CycloneDX SBOM. CI quality gates (--fail-if-critical
+  / -warning / -vulnerable / -outdated / -poison / -language-ceiling) with granular,
+  committed suppression via .still_active.yml. Complements bundle outdated, bundler-audit,
+  and libyear-bundler by adding the maintenance signal they don''t, and folds their
+  version, CVE, and libyear checks into one report.'
 email:
 - contact@seanfloyd.dev
 executables:
@@ -216,30 +251,54 @@ files:
 - lib/helpers/bot_context.rb
 - lib/helpers/bundler_helper.rb
 - lib/helpers/catalog_index.rb
+- lib/helpers/constraint_helper.rb
+- lib/helpers/cvss_helper.rb
 - lib/helpers/cyclonedx_helper.rb
 - lib/helpers/diff_markdown_helper.rb
 - lib/helpers/emoji_helper.rb
+- lib/helpers/endoflife_helper.rb
 - lib/helpers/http_helper.rb
 - lib/helpers/libyear_helper.rb
+- lib/helpers/lockfile_dependency_parser.rb
 - lib/helpers/lockfile_indexer.rb
+- lib/helpers/markdown_escape.rb
 - lib/helpers/markdown_helper.rb
+- lib/helpers/pep440_helper.rb
+- lib/helpers/python_helper.rb
 - lib/helpers/ruby_advisory_db.rb
 - lib/helpers/ruby_helper.rb
+- lib/helpers/runtime_ceiling_helper.rb
 - lib/helpers/sarif_helper.rb
+- lib/helpers/semver_satisfaction.rb
+- lib/helpers/status_helper.rb
+- lib/helpers/summary_helper.rb
 - lib/helpers/terminal_helper.rb
 - lib/helpers/version_helper.rb
 - lib/helpers/vulnerability_helper.rb
 - lib/still_active.rb
+- lib/still_active/artifactory_client.rb
+- lib/still_active/ceiling_reconciler.rb
 - lib/still_active/cli.rb
 - lib/still_active/config.rb
+- lib/still_active/config_file.rb
 - lib/still_active/core_ext.rb
 - lib/still_active/deps_dev_client.rb
 - lib/still_active/diff.rb
+- lib/still_active/ecosystem_lens.rb
+- lib/still_active/ecosystems_client.rb
 - lib/still_active/errors.rb
+- lib/still_active/forgejo_client.rb
+- lib/still_active/github_client.rb
 - lib/still_active/gitlab_client.rb
 - lib/still_active/options.rb
+- lib/still_active/osv_client.rb
+- lib/still_active/poison_security_correlator.rb
+- lib/still_active/pypi_client.rb
 - lib/still_active/repository.rb
 - lib/still_active/sarif/rules.rb
+- lib/still_active/sbom_reader.rb
+- lib/still_active/sbom_workflow.rb
+- lib/still_active/suppressions.rb
 - lib/still_active/version.rb
 - lib/still_active/workflow.rb
 - still_active.gemspec
@@ -250,6 +309,7 @@ metadata:
   homepage_uri: https://github.com/SeanLF/still_active
   source_code_uri: https://github.com/SeanLF/still_active
   changelog_uri: https://github.com/SeanLF/still_active/blob/main/CHANGELOG.md
+  documentation_uri: https://github.com/SeanLF/still_active#readme
   bug_tracker_uri: https://github.com/SeanLF/still_active/issues
   rubygems_mfa_required: 'true'
 rdoc_options: []
@@ -268,6 +328,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
 requirements: []
 rubygems_version: 4.0.10
 specification_version: 4
-summary: Audit your Ruby dependencies for maintenance health, outdated versions, vulnerabilities,
-  and abandoned gems.
+summary: Audit your dependencies for maintenance health, abandonment, and below-the-fix
+  vulnerabilities. Ruby gems natively; npm, PyPI, Cargo, Go, Maven, and NuGet via
+  a CycloneDX SBOM.
 test_files: []