still_active 1.6.0 → 3.0.0.rc1

data/lib/still_active/options.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "optparse"
+require_relative "../helpers/constraint_helper"
 require_relative "../helpers/cyclonedx_helper"
 require_relative "../helpers/vulnerability_helper"
 
@@ -15,6 +16,7 @@ module StillActive
         add_tail_options(opts)
         add_gemfile_option(opts)
         add_gems_option(opts)
+        add_sbom_option(opts)
         add_ignore_option(opts)
         add_output_options(opts)
         add_token_options(opts)
@@ -34,7 +36,11 @@ module StillActive
     private
 
     def validate_options
-      raise ArgumentError, "provide gemfile or gems, not both" if options[:provided_gemfile] && options[:provided_gems]
+      inputs = [options[:provided_gemfile], options[:provided_gems], options[:provided_sbom]].compact
+      raise ArgumentError, "provide only one of --gemfile, --gems, --sbom" if inputs.size > 1
+      if options[:provided_sbom] && !File.exist?(StillActive.config.sbom_path)
+        raise ArgumentError, "SBOM file not found: #{StillActive.config.sbom_path}"
+      end
       if options[:provided_baseline] && !File.exist?(StillActive.config.baseline_path)
         raise ArgumentError, "baseline file not found: #{StillActive.config.baseline_path}"
       end
@@ -50,7 +56,15 @@ module StillActive
     def add_gems_option(opts)
       opts.on("--gems=GEM,GEM2,...", Array, "Gem(s)") do |value|
         options[:provided_gems] = true
-        StillActive.config { |config| config.gems = value.map { |g| { name: g } } }
+        # Explicitly named gems are direct by definition (the user chose them).
+        StillActive.config { |config| config.gems = value.map { |g| { name: g, direct: true } } }
+      end
+    end
+
+    def add_sbom_option(opts)
+      opts.on("--sbom=PATH", String, "audit a CycloneDX SBOM cross-ecosystem (npm/pypi/cargo/go/maven/nuget) instead of a Gemfile; JSON output") do |value|
+        options[:provided_sbom] = true
+        StillActive.config { |config| config.sbom_path = value }
       end
     end
 
@@ -65,6 +79,8 @@ module StillActive
       opts.on("--markdown", "Markdown table output") { StillActive.config { |config| config.output_format = :markdown } }
       opts.on("--json", "JSON output (default when piped)") { StillActive.config { |config| config.output_format = :json } }
       opts.on("--alternatives", "Suggest maintained alternatives (Ruby Toolbox leads) for archived/critical gems") { StillActive.config { |config| config.alternatives = true } }
+      opts.on("--unreleased-commits", "Count commits on the default branch since the latest release (GitHub only; opt-in, one extra API call per gem)") { StillActive.config { |config| config.unreleased_commits = true } }
+      opts.on("--direct-only", "Audit only direct (declared) dependencies, not the full transitive lockfile graph") { StillActive.config { |config| config.direct_only = true } }
       opts.on("--sarif[=PATH]", "SARIF 2.1.0 output for GitHub Code Scanning (default path: still_active.sarif.json; '-' for stdout). Overrides --terminal/--markdown/--json.") do |value|
         StillActive.config { |config| config.sarif_path = value || "still_active.sarif.json" }
       end
@@ -91,6 +107,17 @@ module StillActive
       opts.on("--gitlab-token=TOKEN", String, "GitLab personal access token for API calls") do |value|
         StillActive.config { |config| config.gitlab_token = value }
       end
+      opts.on("--ecosystems-email=EMAIL", String, "Contact email for the ecosyste.ms polite pool (used only when falling back to ecosyste.ms without a GitHub token)") do |value|
+        email = value.strip
+        warn("warning: --ecosystems-email=#{value.inspect} doesn't look like an email (no @); ecosyste.ms will keep you in the anonymous pool") unless email.include?("@")
+        StillActive.config { |config| config.ecosystems_email = email }
+      end
+      opts.on("--artifactory-token=TOKEN", String, "Artifactory token for private gem registry API calls") do |value|
+        StillActive.config { |config| config.artifactory_token = value }
+      end
+      opts.on("--artifactory-host=HOST", String, "Artifactory host that may receive the global token (e.g. my-org.jfrog.io)") do |value|
+        StillActive.config { |config| config.artifactory_host = value }
+      end
     end
 
     def add_parallelism_options(opts)
@@ -102,15 +129,15 @@ module StillActive
     def add_range_options(opts)
       opts.on(
         "--safe-range-end=YEARS",
-        Integer,
-        "maximum years since last activity considered safe (no warning)",
+        Float,
+        "maximum years since last release considered safe, no warning (default 1.5; fractional allowed)",
       ) do |value|
         StillActive.config { |config| config.no_warning_range_end = value }
       end
       opts.on(
         "--warning-range-end=YEARS",
-        Integer,
-        "maximum years since last activity that triggers a warning (beyond this is critical)",
+        Float,
+        "maximum years since last release that triggers a warning, beyond this is critical (default 3)",
       ) do |value|
         StillActive.config { |config| config.warning_range_end = value }
       end
@@ -136,6 +163,31 @@ module StillActive
       opts.on("--fail-if-outdated=LIBYEARS", Float, "Exit 1 if any gem exceeds LIBYEARS behind latest") do |value|
         StillActive.config { |config| config.fail_if_outdated = value }
       end
+      opts.on("--fail-if-poison[=TIER]", "Exit 1 on a poison-pill at or above TIER (note|warning|critical; default warning)") do |value|
+        if value
+          valid = StillActive::ConstraintHelper::SEVERITY.map(&:to_s)
+          raise ArgumentError, "--fail-if-poison tier must be one of: #{valid.join(", ")} (got #{value})" unless valid.include?(value)
+
+          StillActive.config { |config| config.fail_if_poison = value.to_sym }
+        else
+          StillActive.config { |config| config.fail_if_poison = true }
+        end
+      end
+      opts.on("--fail-if-language-ceiling[=TIER]", "Exit 1 on a language-runtime ceiling (Ruby/Python; default: EOL-forced only; =note also gates latest-not-yet)") do |value|
+        if value
+          valid = StillActive::ConstraintHelper::SEVERITY.map(&:to_s)
+          raise ArgumentError, "--fail-if-language-ceiling tier must be one of: #{valid.join(", ")} (got #{value})" unless valid.include?(value)
+
+          # Ceiling findings are only ever :critical or :note, so =warning can't
+          # match anything the bare (=critical) default doesn't already catch.
+          if value == "warning"
+            $stderr.puts("warning: --fail-if-language-ceiling=warning has no effect (runtime ceilings are only critical or note); behaves as =critical")
+          end
+          StillActive.config { |config| config.fail_if_language_ceiling = value.to_sym }
+        else
+          StillActive.config { |config| config.fail_if_language_ceiling = true }
+        end
+      end
     end
 
     def add_emoji_options(opts)

data/lib/still_active/osv_client.rb

@@ -0,0 +1,147 @@
+# frozen_string_literal: true
+
+require_relative "../helpers/http_helper"
+require_relative "../helpers/cvss_helper"
+
+module StillActive
+  # OSV (api.osv.dev) enrichment for advisories deps.dev has already discovered.
+  # deps.dev is the discovery source -- it lists a package version's advisory ids --
+  # but it stores only CVSS 3.x (a CVSS-4-only advisory comes back with cvss3Score
+  # 0, which reads as unscored) and carries no fixed-version ranges at all. OSV
+  # supplies all three gaps: a GHSA severity LABEL (`database_specific.severity`)
+  # that reads correctly even for a v4-only advisory, the CVSS v4 VECTOR (turned into
+  # a real score, so the finding carries a security-severity number), and the
+  # per-package fixed versions the "capped below the fix" signal compares against a
+  # poison cap's ceiling.
+  #
+  # Enrichment is best-effort: any failure (missing record, transport error, odd
+  # shape) leaves the advisory exactly as deps.dev produced it. It must never drop
+  # an advisory the audit already found, so it only ever ADDS fields.
+  module OsvClient
+    extend self
+
+    BASE_URI = URI("https://api.osv.dev/")
+
+    # Every ecosystem SbomReader/deps.dev resolve, mapped to OSV's package-ecosystem
+    # casing (verified against live OSV records). One advisory can name the same
+    # package in several ecosystems, so `affected` is filtered to the one being
+    # audited; the native Bundler path carries no ecosystem and is always rubygems.
+    # Anything unmapped falls back to name-only fix filtering rather than dropping fixes.
+    ECOSYSTEM_NAMES = {
+      rubygems: "RubyGems",
+      pypi: "PyPI",
+      npm: "npm",
+      cargo: "crates.io",
+      maven: "Maven",
+      go: "Go",
+      nuget: "NuGet",
+    }.freeze
+
+    # Prefer the newest CVSS version a record carries (v4 is the whole point: it's the
+    # one deps.dev can't score). `severity[].score` is the vector STRING, oddly named.
+    CVSS_PRIORITY = { "CVSS_V4" => 3, "CVSS_V3" => 2, "CVSS_V2" => 1 }.freeze
+    # A v2 vector has no `CVSS:X.Y` prefix, so the version can't be read from the
+    # string; fall back to the entry type so the CycloneDX rating method labels it v2.
+    TYPE_VERSIONS = { "CVSS_V4" => "4.0", "CVSS_V3" => "3.1", "CVSS_V2" => "2.0" }.freeze
+
+    # Enrich each advisory in place with the OSV severity label and the fixed
+    # versions for the audited package. A missing/failed lookup is a no-op on that
+    # advisory (it keeps whatever deps.dev gave it), never a raise.
+    def enrich(advisories, ecosystem:, name:)
+      advisories.each do |advisory|
+        record = detail(advisory_id: advisory[:id])
+        next if record.nil?
+
+        advisory[:osv_severity] = record[:severity_label]
+        advisory[:osv_cvss_score] = record[:cvss_score]
+        advisory[:cvss_version] = record[:cvss_version]
+        advisory[:cvss_vector] = record[:cvss_vector]
+        advisory[:fixed_versions] = fixed_versions(record, ecosystem: ecosystem, name: name)
+      rescue StandardError => e
+        # Enrichment is additive and best-effort. An unexpected OSV shape must never
+        # raise out through the workflow's per-gem rescue, which would DROP the whole
+        # gem and read a known-vulnerable dependency as clean. Leave the advisory
+        # exactly as deps.dev produced it.
+        $stderr.puts("warning: OSV enrichment for #{advisory[:id]} failed: #{e.class} (#{e.message}); leaving advisory unchanged")
+      end
+    end
+
+    # Fetch and parse one OSV record by advisory id (GHSA/CVE). Returns
+    # { severity_label:, cvss_score:, cvss_version:, cvss_vector:, affected: [...] }
+    # or nil when the id is absent or OSV has no usable record for it. A non-object
+    # body (a CDN/error envelope that parses to an array or scalar) yields nil rather
+    # than raising on `dig`.
+    def detail(advisory_id:)
+      return if advisory_id.nil?
+
+      body = HttpHelper.get_json(BASE_URI, "/v1/vulns/#{encode(advisory_id)}")
+      return unless body.is_a?(Hash)
+
+      cvss = best_cvss(body)
+      {
+        severity_label: body.dig("database_specific", "severity"),
+        cvss_score: cvss[:score],
+        cvss_version: cvss[:version],
+        cvss_vector: cvss[:vector],
+        affected: Array(body["affected"]).filter_map { |entry| parse_affected(entry) },
+      }
+    end
+
+    private
+
+    # The highest-version CVSS vector the record carries, as { score:, version:,
+    # vector: } (a computed base score, the "3.1"/"4.0" version, and the raw string),
+    # or all-nil. deps.dev has no v4 score, so this is what gives a CVSS-4-only
+    # advisory a real number for the security-severity/rating.
+    def best_cvss(body)
+      entry = Array(body["severity"])
+        .select { |s| s.is_a?(Hash) && CVSS_PRIORITY.key?(s["type"]) }
+        .max_by { |s| CVSS_PRIORITY[s["type"]] }
+      return {} if entry.nil?
+
+      vector = entry["score"]
+      { score: CvssHelper.score(vector), version: cvss_version(vector) || TYPE_VERSIONS[entry["type"]], vector: vector }
+    end
+
+    # The X.Y version from a "CVSS:X.Y/..." vector prefix, or nil.
+    def cvss_version(vector)
+      vector.to_s[%r{\ACVSS:(\d+\.\d+)/}, 1]
+    end
+
+    # The fixed versions declared for `name` in `ecosystem` across the record's
+    # affected packages (a branch-structured advisory carries one fix per maintained
+    # line, so several can apply). Empty when the package is enumerated by
+    # `versions` with no fix boundary, or isn't present in this ecosystem. When the
+    # ecosystem symbol has no OSV mapping (an ecosystem we don't audit for fixes),
+    # match by name alone rather than silently dropping every fix.
+    def fixed_versions(record, ecosystem:, name:)
+      osv_ecosystem = ECOSYSTEM_NAMES.fetch(ecosystem || :rubygems, nil)
+      record[:affected]
+        .select { |a| a[:name] == name && (osv_ecosystem.nil? || a[:ecosystem] == osv_ecosystem) }
+        .flat_map { |a| a[:fixed] }
+        .uniq
+    end
+
+    # Shape guards throughout: a malformed entry (null/scalar where an object is
+    # expected, or an object where an array is) is skipped, not raised on, so one
+    # bad `affected`/`ranges`/`events` element can't discard the good fixed versions
+    # beside it in the same record.
+    def parse_affected(entry)
+      return unless entry.is_a?(Hash)
+
+      package = entry["package"]
+      return unless package.is_a?(Hash) && package["name"]
+
+      fixed = Array(entry["ranges"]).flat_map do |range|
+        next [] unless range.is_a?(Hash)
+
+        Array(range["events"]).filter_map { |event| event["fixed"] if event.is_a?(Hash) }
+      end
+      { ecosystem: package["ecosystem"], name: package["name"], fixed: fixed }
+    end
+
+    def encode(value)
+      URI.encode_www_form_component(value.to_s)
+    end
+  end
+end

data/lib/still_active/poison_security_correlator.rb

@@ -0,0 +1,232 @@
+# frozen_string_literal: true
+
+require_relative "../helpers/vulnerability_helper"
+require_relative "../helpers/constraint_helper"
+require_relative "../helpers/semver_satisfaction"
+
+module StillActive
+  # Whole-tree correlation, run once after the fan-out: a poison cap is far more
+  # urgent when the dependency it pins is ITSELF vulnerable in the same tree --
+  # "a dormant package is holding you on a known-vulnerable dependency, below the
+  # version that fixes it." Both facts are already assembled (the poison
+  # constraints and every dependency's vulnerability count), so this is one pass,
+  # no extra fetches. It marks the security-relevant caps so the report can lead
+  # with them and demote the FYI caps on healthy dependencies.
+  #
+  # The moat's strongest case (verified on real repos): several archived Google
+  # client libraries pin a vulnerable `protobuf` three majors below the fix.
+  module PoisonSecurityCorrelator
+    extend self
+
+    # Only a HIGH-or-above advisory on the capped dep makes the cap security-
+    # relevant. Most advisories are low-threat noise (research: ~95% of vulnerable
+    # deps are unreachable/low-impact), so a low/medium CVE on the pinned dep isn't
+    # the "you're stuck below the fix" story. Unscored advisories fail CLOSED (a
+    # confirmed advisory we can't score could be severe), matching --fail-if-
+    # vulnerable. Reachability/exploitability is beyond static, metadata-only sight
+    # and deliberately out of scope -- this gates on severity, not exploitability.
+    SECURITY_THRESHOLD = "high"
+
+    # The severity labels that let an advisory establish "below the fix". Only a
+    # confirmed HIGH+ advisory with a known fix can: an unscored advisory (which the
+    # capped_dep_vulnerable gate accepts fail-closed) has no reliable fix analysis.
+    BELOW_FIX_LABELS = ["high", "critical"].freeze
+
+    def correlate(result_object)
+      advisories = flat_advisories(result_object)
+      copies = copy_index(result_object)
+
+      result_object.each_value do |data|
+        # FLAT (rubygems/pypi): mark below-fix on the poison caps already attached.
+        mark_flat_constraints(data, advisories)
+        # NESTED (npm/cargo): promote a genuine below-fix candidate into :constraints.
+        promote_nested_below_fix(data, copies) if data[:capped_deps]
+
+        constraints = hashes(data[:constraints])
+        next if constraints.empty?
+
+        data[:poison_security_relevant] = true if constraints.any? { |c| c[:capped_dep_vulnerable] }
+        data[:poison_below_fix] = true if constraints.any? { |c| c[:capped_below_fix] }
+      end
+    end
+
+    private
+
+    # This runs OUTSIDE the per-gem rescue (a whole-tree pass after the barrier),
+    # so a malformed shape must degrade that one entry's enrichment, never raise and
+    # crash the audit after every fetch is paid for. The pipeline always assigns
+    # arrays of hashes here, so these guards are unreachable today, but they match the
+    # defensive Array()-wrapping the sibling consumers (markdown/sarif/terminal) apply.
+    def hashes(value)
+      Array(value).grep(Hash)
+    end
+
+    # Ecosystem-qualified map of each tree package's advisories AND the version it's
+    # pinned at, for the FLAT path (one resolved version per name). A capped dep
+    # resolves in its capper's ecosystem, so match "ecosystem/name" on both sides;
+    # native results carry no :ecosystem (nil on both) and still match. The used
+    # version is kept so "below the fix" ignores fixes that land BELOW it: an OSV
+    # advisory lists a fix per affected range, and a fix for an older line is a
+    # downgrade, not a patch for the version in hand.
+    def flat_advisories(result_object)
+      result_object.each_with_object({}) do |(key, data), map|
+        next unless data[:vulnerability_count].to_i.positive?
+
+        name = data[:name] || key
+        map["#{data[:ecosystem]}/#{name}"] = { vulns: hashes(data[:vulnerabilities]), used_version: data[:version_used] }
+      end
+    end
+
+    # Every RESOLVED copy of each package, keyed "ecosystem/name", for the NESTED
+    # path: npm nests versions and cargo coexists majors, so one name maps to several
+    # copies. The full set (vulnerable AND not) is what the condition-5 soundness
+    # guard needs -- "is there a SAFE copy within the cap" can't be answered from the
+    # vulnerable copies alone.
+    def copy_index(result_object)
+      result_object.each_with_object({}) do |(key, data), map|
+        name = data[:name] || key
+        (map["#{data[:ecosystem]}/#{name}"] ||= []) << { version: data[:version_used], vulns: hashes(data[:vulnerabilities]) }
+      end
+    end
+
+    def mark_flat_constraints(data, advisories)
+      constraints = hashes(data[:constraints])
+      return if constraints.empty?
+
+      eco = data[:ecosystem]
+      constraints.each do |constraint|
+        entry = advisories["#{eco}/#{constraint[:dependency]}"]
+        next if entry.nil?
+
+        vulns = entry[:vulns]
+        next unless VulnerabilityHelper.severity_at_or_above?(vulns, SECURITY_THRESHOLD)
+
+        constraint[:capped_dep_vulnerable] = true
+        mark_below_fix(constraint, vulns, entry[:used_version])
+      end
+    end
+
+    # NESTED below-the-fix (npm/cargo). The pure poison cap is suppressed for these
+    # ecosystems (caret default + nested copies over-claim), so a candidate is
+    # promoted ONLY when it genuinely holds a vulnerable copy below its fix, checked
+    # at PATCH precision. When one is, it takes the same shape the flat path renders,
+    # and :poison is set here (the only npm/cargo poison there is is a below-fix).
+    def promote_nested_below_fix(data, copies)
+      eco = data[:ecosystem]
+      # Consume the candidates: they are an internal work-list, never serialized.
+      promoted = hashes(data.delete(:capped_deps)).filter_map do |candidate|
+        dep_copies = copies["#{eco}/#{candidate[:dependency]}"] || []
+        nested_below_fix(eco, candidate[:dependency], candidate[:requirement], dep_copies)
+      end
+      return if promoted.empty?
+
+      data[:constraints] = promoted
+      data[:poison] = true
+      data[:poison_severity] = :critical
+    end
+
+    # A below-fix finding for one capped dep, or nil. The claim holds only when
+    # EVERY resolved copy the constraint governs is vulnerable to the same HIGH+
+    # advisory (condition 5: no safe in-constraint copy to resolve to), AND no fix
+    # of that advisory satisfies the constraint (the wall, at patch precision). A
+    # patched copy sitting OUTSIDE the constraint elsewhere in the tree is irrelevant
+    # -- it can't lift the copy this capper pins -- so it never enters this view.
+    def nested_below_fix(ecosystem, dependency, requirement, dep_copies)
+      in_constraint = dep_copies.select { |copy| satisfies?(requirement, copy[:version], ecosystem) }
+      return if in_constraint.empty?
+
+      oldest = in_constraint.map { |copy| copy[:version] }.min_by { |version| gem_version(version) }
+      stuck = candidate_advisories(in_constraint).select do |advisory|
+        walls?(requirement, advisory, ecosystem, oldest) && every_copy_affected?(in_constraint, advisory)
+      end
+      return if stuck.empty?
+
+      receipt = stuck.min_by { |advisory| gem_version(nearest_fix(advisory, oldest)) }
+      {
+        dependency: dependency,
+        requirement: requirement,
+        capped_dep_vulnerable: true,
+        capped_below_fix: true,
+        below_fix_advisory: receipt[:id],
+        below_fix_fixed_in: nearest_fix(receipt, oldest),
+      }
+    end
+
+    def satisfies?(requirement, version, ecosystem)
+      SemverSatisfaction.evaluate(requirement: requirement, version: version, ecosystem: ecosystem) == true
+    end
+
+    # HIGH+ advisories with a known fix, deduped by id, across the in-constraint copies.
+    def candidate_advisories(copies)
+      copies.flat_map { |copy| copy[:vulns] }
+        .select { |vuln| BELOW_FIX_LABELS.include?(VulnerabilityHelper.advisory_severity(vuln)) && Array(vuln[:fixed_versions]).any? }
+        .uniq { |vuln| vuln[:id] }
+    end
+
+    # The wall: NO applicable fix satisfies the constraint at patch precision. Every
+    # fix must be a DEFINITE non-match (evaluate == false); an undecidable fix (nil,
+    # unparseable) blocks the claim rather than counting as unreachable, so we never
+    # fabricate a wall from input we couldn't parse.
+    def walls?(requirement, advisory, ecosystem, oldest_affected)
+      fixes = applicable_fixes(advisory, oldest_affected)
+      fixes.any? && fixes.all? { |fix| SemverSatisfaction.evaluate(requirement: requirement, version: fix, ecosystem: ecosystem) == false }
+    end
+
+    # Condition 5: every governed copy is vulnerable to THIS advisory (none is a safe
+    # version you could resolve to within the cap).
+    def every_copy_affected?(copies, advisory)
+      copies.all? { |copy| copy[:vulns].any? { |vuln| vuln[:id] == advisory[:id] } }
+    end
+
+    # The sharper claim on a security-relevant cap: does it hold you BELOW THE FIX?
+    # A HIGH+ advisory with a known fix establishes it only when EVERY fixed version
+    # lands outside the cap (a major it forbids) -- you cannot patch the CVE without
+    # replacing the dormant capper. The receipt names the advisory and its nearest
+    # fix (the lowest fixed version, all of which are outside the cap).
+    def mark_below_fix(constraint, vulns, used_version)
+      stuck = vulns.select do |vuln|
+        fixes = applicable_fixes(vuln, used_version)
+        next false if fixes.empty?
+        next false unless BELOW_FIX_LABELS.include?(VulnerabilityHelper.advisory_severity(vuln))
+
+        fixes.none? { |fix| ConstraintHelper.reachable_within_cap?(constraint, fix) }
+      end
+      return if stuck.empty?
+
+      receipt = stuck.min_by { |vuln| gem_version(nearest_fix(vuln, used_version)) }
+      constraint[:capped_below_fix] = true
+      constraint[:below_fix_advisory] = receipt[:id]
+      constraint[:below_fix_fixed_in] = nearest_fix(receipt, used_version)
+    end
+
+    # An advisory lists a fixed version per affected range; only fixes ABOVE the
+    # version in hand are real remediation. A fix at or below it belongs to an older
+    # release line (a downgrade), so it neither patches this version nor counts as
+    # "reachable within the cap". With no known used version (older data), all fixes
+    # are kept -- the pre-existing behaviour, never fewer findings than before.
+    def applicable_fixes(vuln, used_version)
+      fixes = Array(vuln[:fixed_versions])
+      return fixes if used_version.nil? || !Gem::Version.correct?(used_version.to_s)
+
+      used = gem_version(used_version)
+      fixes.select { |fix| !Gem::Version.correct?(fix.to_s) || gem_version(fix) > used }
+    end
+
+    # The lowest applicable fixed version, for the "fixed in X" receipt. A parseable
+    # version always beats an unparseable one (PyPI epoch `1!2.3.4`, or garbage), so
+    # the receipt never names an odd string when a clean fix is present; only when
+    # EVERY fix is unparseable does it fall back to one of those.
+    def nearest_fix(vuln, used_version)
+      applicable_fixes(vuln, used_version).min_by { |fix| [Gem::Version.correct?(fix.to_s) ? 0 : 1, gem_version(fix)] }
+    end
+
+    # A version key that sorts fix strings without raising; an unparseable version
+    # collapses to 0 (only reached as a tiebreak among all-unparseable fixes, since
+    # nearest_fix prefers parseable ones).
+    def gem_version(version)
+      Gem::Version.new(version.to_s)
+    rescue ArgumentError
+      Gem::Version.new("0")
+    end
+  end
+end

data/lib/still_active/pypi_client.rb

@@ -0,0 +1,56 @@
+# frozen_string_literal: true
+
+require_relative "../helpers/http_helper"
+require_relative "version"
+
+module StillActive
+  # The authoritative source for a PyPI release's declared Python constraint,
+  # used by the cross-ecosystem language-runtime ceiling. `requires_python` is
+  # set once per release and enforced by pip as a hard install wall (a real
+  # resolver refuses an incompatible interpreter), so still_active reads it from
+  # PyPI's release-level `info.requires_python` rather than a per-file wheel value
+  # or deps.dev (which does not carry the field). pypi.org is a public source,
+  # queried with no credentials.
+  #
+  # Best-effort like every other network entry point: an unindexed version,
+  # schema drift, or a transport failure degrades to nil (no ceiling), never a
+  # raise that could abort the per-package audit.
+  module PypiClient
+    extend self
+
+    BASE_URI = URI("https://pypi.org/")
+    # Polite identification, matching EcosystemsClient's convention.
+    USER_AGENT = "still_active/#{StillActive::VERSION} (+https://github.com/SeanLF/still_active)"
+
+    # The PEP 440 `requires_python` specifier a release declares (e.g.
+    # ">=3.8,<3.13"), or nil when the version is unreadable or declares none.
+    # PyPI renders an unset constraint as an empty string; normalize it to nil so
+    # callers get a single "no constraint" signal.
+    def requires_python(name:, version:)
+      return if name.nil? || version.nil?
+
+      path = "/pypi/#{encode(name)}/#{encode(version)}/json"
+      body = HttpHelper.get_json(BASE_URI, path, headers: { "User-Agent" => USER_AGENT })
+      return unless body.is_a?(Hash)
+
+      # Guard the nested read: a non-Hash `info` (schema drift) would make
+      # Hash#dig raise TypeError, which -- since this is the LAST enrichment in
+      # EcosystemLens#assess -- would propagate to the per-package rescue and
+      # discard the package's already-computed vuln/poison/staleness findings.
+      # Best-effort must never demote the core audit; degrade to nil.
+      info = body["info"]
+      return unless info.is_a?(Hash)
+
+      value = info["requires_python"]
+      return unless value.is_a?(String) && !value.strip.empty?
+
+      value
+    end
+
+    private
+
+    def encode(segment)
+      URI.encode_www_form_component(segment)
+    end
+  end
+end

data/lib/still_active/repository.rb

@@ -2,7 +2,15 @@
 
 module StillActive
   module Repository
-    REPO_REGEX = %r{(https?://(?:www\.)?(github|gitlab)\.com/([\w.\-]+)/([\w.\-]+))}i
+    # codeberg.org is the one Forgejo/Gitea host wired up today; it speaks the
+    # same Gitea API as any self-hosted instance, so its source is :forgejo (the
+    # forge software, what ForgejoClient handles), not :codeberg (the host).
+    SOURCE_BY_HOST = {
+      "github.com" => :github,
+      "gitlab.com" => :gitlab,
+      "codeberg.org" => :forgejo,
+    }.freeze
+    REPO_REGEX = %r{(?<url>https?://(?:www\.)?(?<host>github\.com|gitlab\.com|codeberg\.org)/(?<owner>[\w.\-]+)/(?<name>[\w.\-]+))}i
 
     extend self
 
@@ -16,10 +24,10 @@ module StillActive
       match = url&.match(REPO_REGEX)
       return { source: :unhandled, owner: nil, name: nil } unless match
 
-      url = match[1].delete_suffix(".git")
-      name = match[4].delete_suffix(".git")
+      clean_url = match[:url].delete_suffix(".git")
+      name = match[:name].delete_suffix(".git")
 
-      { url: url, source: match[2].to_sym, owner: match[3], name: name }
+      { url: clean_url, source: SOURCE_BY_HOST.fetch(match[:host].downcase), owner: match[:owner], name: name }
     end
   end
 end

data/lib/still_active/sarif/rules.rb

@@ -2,7 +2,7 @@
 
 module StillActive
   module Sarif
-    # Catalog of SARIF rules emitted by still_active. Rule IDs (SA001-SA007)
+    # Catalog of SARIF rules emitted by still_active. Rule IDs (SA001-SA009)
     # are stable across versions; renames or removals are breaking changes.
     #
     # Each rule maps a still_active finding into a SARIF result. Security
@@ -17,14 +17,18 @@ module StillActive
         "#{DOCS_BASE}##{rule_id.downcase}"
       end
 
-      # CVSS 0-10 -> SARIF level. Per GitHub Code Scanning convention,
-      # scores >= 7.0 map to error, 4.0-6.9 to warning, below 4.0 to note.
-      def cvss_to_level(score)
-        return "note" if score.nil?
-        return "error" if score >= 7.0
-        return "warning" if score >= 4.0
-
-        "note"
+      def severity_to_level(label)
+        # Maps a resolved advisory severity label (VulnerabilityHelper.advisory_severity:
+        # a real CVSS score OR the OSV/GHSA label) to a SARIF level. A nil label is a
+        # confirmed-but-unscored advisory (no CVSS score and no OSV label, e.g. a fresh
+        # CVE) -- elevated to warning, not an informational note, so a gate can't read
+        # it as clean. This is the SARIF analogue of the CLI gate's fail-closed.
+        case label
+        when "critical", "high" then "error"
+        when "medium" then "warning"
+        when "low" then "note"
+        else "warning"
+        end
       end
 
       # SARIF security-severity must be a string with one decimal place.
@@ -48,8 +52,8 @@ module StillActive
         {
           id: "SA002",
           name: "AbandonedGem",
-          short: "Gem has had no commits for over 2 years",
-          full: "The gem's source repository shows no commit activity for over 2 years. Not formally archived, but a strong dormancy signal.",
+          short: "Gem has had no release for over 3 years",
+          full: "The gem's latest release is over 3 years old. Not formally archived, but a strong abandonment signal: a consumer cannot pull fixes that were never released. For a gem with no releases at all (e.g. git-sourced), the last commit date is used instead.",
           help_text: "Verify the gem still works on supported Ruby versions and consider a maintained alternative.",
           level: "warning",
           security_severity: nil,
@@ -105,6 +109,26 @@ module StillActive
           security_severity: "8.0",
           tags: ["security", "supply-chain", "external/cwe/cwe-1104"],
         },
+        {
+          id: "SA008",
+          name: "PoisonPill",
+          short: "Dormant gem caps a dependency below its latest major",
+          full: "A dormant (abandoned or archived) gem declares a runtime constraint that caps one of its dependencies below that dependency's current latest major. Because nobody is shipping the gem, the cap will never lift, and it grows more constraining as the capped dependency releases new majors: the tree is held below a ceiling no upstream release will raise.",
+          help_text: "Replace or fork the dormant gem, or vendor a version that relaxes the constraint. For a transitive pill, target the direct dependency that pulls it in.",
+          level: "warning",
+          security_severity: nil, # maintenance/resolvability, not a CVE (as SA002/SA004/SA005)
+          tags: ["maintenance", "supply-chain", "external/cwe/cwe-1104"],
+        },
+        {
+          id: "SA009",
+          name: "RuntimeCeiling",
+          short: "Resolved package version caps its language runtime",
+          full: "A resolved package version's declared runtime constraint (Ruby `ruby_version`, Python `requires_python`) caps the language runtime you can run: either below every still-supported release (stranding you on an end-of-life runtime with no security patches) or below the latest stable (a compatibility ceiling to plan around). The default level is note; an EOL-forcing cap is raised to error per result.",
+          help_text: "If a newer release of the package lifts the cap, upgrade it. Otherwise replace or fork the package, or contribute support for the newer runtime upstream.",
+          level: "note",
+          security_severity: nil, # maintenance/compatibility, not a CVE (as SA002/SA004/SA005/SA008)
+          tags: ["maintenance", "runtime", "external/cwe/cwe-1104"],
+        },
       ].freeze
 
       CATALOG = RAW_RULES.map do |r|