still_active 2.0.0 → 3.0.0.rc1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1db517014109d081c46e71d63cf61d4446d60f7c7205793c520293f6cc03e329
-  data.tar.gz: 5239b26426cb8a8359c3efbafb1aaf3480150bf6a190a0912cc1f78d4ca0e226
+  metadata.gz: b3541d297e3d8059ffdaee4c1377ab7333fc5d2a54940219d7a4f2611f4c445e
+  data.tar.gz: d121da3f25a1db5bbcf5cc3e2351acbaef84076350bccc3074ed869d46881f75
 SHA512:
-  metadata.gz: 49f561e7ea5a5e0de227e5c861cd4b1ef2bcca57ad967712e5411fd25ea00cea49ee07801f3b4b6be7dc205259c8f2e3c36481ec5148fa52849a8246070beb62
-  data.tar.gz: 5552c0f3c9ba60c3e9046372923f4fa3aee2b2152e5eea6765f99f0c14fdf7785798df477605e04c11a7ac5f6bb2fec06dbc1f0ece3e46b1ee91aaa341cc2ae7
+  metadata.gz: e6f9391ed541b846f1c65cd0231e6894c69606cfbce1f6c9e636926607e99191c7029f7c79d5fe42257bbf33bb822f84b7772903c3444ce0b593ae8c57c875d6
+  data.tar.gz: 15b01401efb0f22e189c16cd5baf5f3086a2969686e3efd701c85c34ef7dc29eba1ede2eecb717f59e10b6d827d8ae729be07a6c42261583f8256dd7c060a7ab

data/CHANGELOG.md

@@ -2,6 +2,47 @@
 
 ## [Unreleased]
 
+### Upgrading to 3.0
+
+3.0 is a major bump because a handful of changes can flip a `--fail-if-*` outcome or an exit code on upgrade. The JSON `schema_version` stays `1` (every output change is additive, apart from `up_to_date` widening from `boolean` to `boolean | null`), and no CLI flag was removed or renamed, but review these before upgrading a pipeline:
+
+- **`--fail-if-vulnerable=<severity>` now fails CLOSED on an unscored advisory** (and bare `--fail-if-vulnerable` now fires on advisories a failed deps.dev fetch used to silently drop). A previously-green run can go red. Review the named advisory (a per-gem stderr note explains why), then fix it or accept it in `.still_active.yml`. Installing the optional `cvss-suite` gem lets a CVSS-4-only advisory get a real score and clear the gate when it's below threshold.
+- **Bad CLI input now exits 2** with a friendly `error:` line instead of a Ruby backtrace (previously exit 1). SBOM read/parse errors also exit 2. Wrapper scripts that branch on exit codes should treat 2 as "bad invocation".
+- **Two new REQUIRED runtime dependencies**: `semantic_range` (npm/cargo version matching for the below-the-fix signal) and `packageurl-ruby` (SBOM PURL parsing). Both resolve automatically on `gem install`; the Ruby floor is unchanged. `cvss-suite` is deliberately NOT a hard dependency (it exact-pins bundler and caps bigdecimal, the poison-pill pattern still_active itself flags), so install it yourself to light up CVSS-4 scoring.
+- **New SARIF rules SA008 (poison-pill) and SA009 (runtime ceiling)** appear automatically in the GitHub Security tab for `--sarif` users, and an unscored advisory now maps to `warning` (was `note`), so a code-scanning policy set to fail on `warning` can newly fire. Rule IDs SA001-SA007 are unchanged.
+- **Tokenless runs now resolve GitHub repo signals via ecosyste.ms** instead of hitting the 60/hour API wall and degrading to `unknown`. A tokenless user with `--fail-if-critical`/`--fail-if-warning` may see gems that were silently `unknown` now resolve to a real `stale`/`critical`/`archived` and trip the activity gate. Tokened runs are unaffected.
+- **New outbound hosts**: `api.osv.dev` (advisory enrichment) and `endoflife.date` (the runtime-ceiling support window) on the native path, plus `*.ecosyste.ms` for tokenless audits. Egress-restricted CI should allowlist these; each degrades to best-effort (no crash) if blocked.
+- **Re-capture your `--baseline` JSON** after upgrading: the new signals and fields show as changes on the first run.
+
+The new `--fail-if-poison[=TIER]` and `--fail-if-language-ceiling[=TIER]` gates default to **off**, so they never break an existing pipeline unless you opt in.
+
+### Added
+
+- **Poison-pill / compatibility-ceiling signal (SA008).** A dormant or archived package that caps one of its runtime dependencies below that dependency's current latest major holds the tree below a ceiling no upstream release will raise, and it grows more constraining over time as the capped dep ships new majors. still_active flags it with a receipt naming the capped dep, the cap, and how many majors behind it holds you, ranked by a severity tier (`note`/`warning`/`critical`, scaling with majors-behind) and enforceable in CI with `--fail-if-poison[=TIER]`. Rendered in terminal, markdown, and SARIF, and computed for `rubygems` (native) and the flat-resolution SBOM ecosystems. Scoped to flat resolution deliberately: npm nests versions and cargo coexists majors, so a below-latest cap there is subtree-local noise, not a tree-wide block, and is suppressed.
+- **Security "below the fix", the strongest poison case, now cross-ecosystem.** When a dormant/archived package pins a dependency that is *itself* known-vulnerable in the same tree, below the version that patches a HIGH-or-critical advisory, you cannot patch the CVE without replacing the dead capper. still_active leads with these findings (red in terminal/markdown, escalated to `error` in SARIF) and names the advisory and its nearest fix. This case travels to **npm and cargo** at patch precision (their fixes are mostly same-major patch bumps, invisible to a major-level check), via a real node-semver/Cargo matcher and a tree-copy soundness guard that only fires when every resolved copy the constraint governs is vulnerable (a safe copy elsewhere, or a patched copy the cap can reach, clears it). The correlation is whole-tree from data already assembled, no extra fetches.
+- **Language-runtime ceiling signal (SA009), poison's sibling.** A pinned dependency version can strand you on an end-of-life language runtime (its `required_ruby_version` / `requires_python` forbids a supported one). still_active flags it against the runtime's EOL schedule (from endoflife.date), enforceable with `--fail-if-language-ceiling[=TIER]`, and reconciled against poison so an "upgrade to lift the ceiling" can't contradict a cap that forbids that upgrade. Ruby on the native path; **Python on the `--sbom` path** (pypi).
+- **CVSS-4-only advisory scoring via an optional `cvss-suite`.** deps.dev stores only CVSS 3.x, so a CVSS-4-only advisory arrives unscored; still_active enriches every advisory with OSV's real severity label and fixed-version ranges, and, when the optional `cvss-suite` gem is installed, computes the CVSS-4 base score from the OSV vector. Without it, the OSV/GHSA label still gates and only the computed number is skipped, so the fail-closed logic never reads a real HIGH as clean. `cvss-suite` is opt-in (see Upgrading).
+- **Vulnerabilities with no fixed version available are flagged** (`no_fix_available`): a known advisory you cannot upgrade out of, the one you most need to see because upgrading isn't the answer.
+- **A schema canary for the deps.dev advisory field** (`api.deps.dev`'s alpha `advisoryKeys`): every cross-ecosystem vulnerability count flows through it, so a silent field rename would zero every count and read a vulnerable package as clean. A known-vulnerable canary (`django 3.0.0`) is checked each run; an empty result warns loudly rather than presenting a possibly-understated "all clear".
+- **The `--sbom` path now carries the same version signals as the native audit**: `libyear` drift, a prerelease/ahead-aware `up_to_date`, and (when the SBOM marks CycloneDX dev-vs-prod scope) a `production` boolean so a consumer can separate prod risk from test debt. A private/alternative registry named in a PURL's `repository_url` is refused a public-by-name lookup (the cross-ecosystem dependency-confusion guard), and a pinned version deps.dev can't resolve reads `unknown` rather than riding the fresh package date to a false `ok`.
+- **`--sbom=PATH` audits a CycloneDX SBOM cross-ecosystem**, so the maintenance lens travels beyond Ruby: point it at a Syft/Trivy-produced SBOM and still_active assesses every `npm`, `pypi`, `cargo`, `go`, `maven`, and `nuget` package the same way it does gems (latest release date, archived repo, advisories, OpenSSF Scorecard, lifecycle `status`), sourcing signals from deps.dev and ecosyste.ms instead of Bundler. Mutually exclusive with `--gemfile`/`--gems`; emits JSON only (its shape differs from the Ruby audit, so it deliberately omits the `$schema` contract). Results are keyed `ecosystem/name@version` so nothing collides and overwrites, not a same-named package across two ecosystems nor two versions of one package pinned by different subprojects of a monorepo (a lockfile resolves one version per name, a merged SBOM doesn't), and each dependency carries its `activity_level` and `status`. The SBOM is treated as **untrusted input**: the only things read from it are ecosystem/name/version, the repository is discovered from deps.dev (never a lockfile-supplied URL, so a hostile SBOM can't redirect a lookup), and anything deps.dev doesn't index degrades to `unknown` rather than a fabricated `ok`. Packages it can't assess (unsupported ecosystems, a component with no version or PURL, **and** a dependency whose lookup raised, e.g. a rate-limited or flaky deps.dev) are surfaced in an `unassessable` list and a stderr count, never silently dropped, so a transient upstream hiccup can't shrink the audit scope invisibly and let it read "all clear" while ignoring the deps it skipped. A present-but-unreadable SBOM (truncated, or not CycloneDX) errors rather than degrading to an empty clean report. OS packages land in `unassessable` too; the differentiated play is maintenance, not vuln scanning, so compose Trivy/Grype for CVEs.
+- **Tokenless GitHub repo signals via [ecosyste.ms](https://ecosyste.ms).** Without a GitHub token the live API caps at 60 requests/hour, unusable past a handful of gems; still_active now falls back to ecosyste.ms (5000 anonymous requests/hour) for GitHub repos' archived + last-commit signals, so a large Gemfile audits cleanly with no token. GitHub-only by design (ecosyste.ms doesn't track commit recency for GitLab/Codeberg, so those keep their own clients); a configured token still takes precedence (freshest data, and it carries `--unreleased-commits`). Requests identify still_active in the User-Agent, and an optional `--ecosystems-email` / `STILL_ACTIVE_ECOSYSTEMS_EMAIL` joins ecosyste.ms's "polite pool" (higher rate limit) as a courtesy to the free service. ecosyste.ms data is CC-BY-SA 4.0 and attributed in the README.
+
+- Each gem now carries the OpenSSF Scorecard **`Maintained` sub-check** (`scorecard_maintained`, 0.0-10.0) alongside the aggregate `scorecard_score`. The sub-check scores recent commit and issue activity directly, the question still_active exists to answer, and it was already present in the deps.dev response still_active fetches (previously discarded). `nil` when a project has no scorecard, deliberately distinct from `0.0` ("measured: unmaintained") so absent data never reads as healthy.
+- A single categorical **lifecycle `status`** per gem and a project-level `summary.status`, so a machine/LLM consumer or another tool reads one verdict instead of re-deriving it from `activity_level` + `archived` + `vulnerability_count`. Worst-first: `dead` (dormant/archived **and** carrying an unpatched advisory; no one is fixing it, migrate) > `vulnerable` (a fixable advisory on an actively-released gem) > `archived` > `stale` > `legacy` (long-dormant but **clean**: feature-complete, low risk, the "done gem" that recency alone wrongly flags) > `ok` > `unknown` (never silently `ok`). An EOL Ruby floors the project at `vulnerable`. **archived is not dead:** a repo archived while the gem still publishes recent releases (development moved to a monorepo) reads as `stale`, not dead; only a genuinely dormant archived repo is `archived`. This is a display/threshold convenience over the raw fields, not the numeric 0-100 composite removed earlier (which let missing data read as perfect health). Documented in `docs/schema.md`. Additive, so `schema_version` stays `1`.
+
+### Fixed
+
+- **`--baseline` now honours a committed `.still_active.yml`.** The PR-diff gate was the only gate that ignored the suppression list: a maintenance regression the audit and SARIF gates already accept still tripped `--baseline` the moment the dependency was added, with no way to accept it short of merging it to the baseline first. An accepted regression is now moved out of the CI-failable set and shown under an "Accepted (suppressed via `.still_active.yml`)" section with its reason, so the acceptance stays visible rather than silently vanishing. Only maintenance kinds a bare gem+signal entry can cover are accepted (archived/staleness map to `activity`/`libyear`); a newly introduced vulnerability still fails, since suppressing one needs an explicit advisory id the diff regression doesn't carry.
+- **The fail-open on the vulnerability gate is closed on both paths.** `--fail-if-vulnerable=<severity>` no longer passes a confirmed advisory that carries no CVSS score (an unscored advisory read as "below threshold" and cleared the gate, worst for a freshly disclosed CVE); it now fails closed with a per-gem stderr note (see Upgrading). And the native path no longer drops a confirmed advisory when its deps.dev detail fetch fails (429/timeout/5xx); it previously `filter_map`'d the failure away and zeroed `vulnerability_count`, it now keeps a minimal advisory so the finding survives and the fail-closed logic applies.
+- **deps.dev CVE aliases are surfaced correctly.** The v3alpha API returns aliases as bare id strings, not objects; the parser read `a["id"]` on a string and dropped every alias, so cross-referenced CVE/GHSA ids vanished. It now tolerates both shapes (and coerces a drifted non-string alias to a string, warning once, so it can't crash the advisory merge and read a vulnerable gem as clean).
+- **A multi-range advisory no longer hides a stuck cap or names a downgrade as the fix.** OSV lists a fixed version per affected range; the below-the-fix check used the global-minimum fix, so a downgrade to an older line could read as "patchable in place" (a false negative) or be named as the fix. It now considers only fixes above the version in hand.
+- **A pinned version the registry can't resolve reads `unknown`, not `ok`.** A nonexistent or yanked pinned version on the `--sbom` path rode the fresh package date to a false `ok`; it now reports `unknown`, with a single retry distinguishing a real 404 from a transient miss.
+- **Graceful degradation on real SBOM/CLI input.** A git-scheme or scp `SOURCE_REPO` URL from deps.dev now parses correctly (recovering repo signals and silencing a warning flood); a malformed PURL (`pkg:npm/@1.0.0`, bad `%`-encoding) degrades to `unassessable` instead of backtracing and dropping every other dependency's verdict; and bad CLI input exits 2 with a friendly error instead of a stack trace (see Upgrading).
+- **The published JSON Schema matches real output.** It had rejected any report containing a vulnerability, because OSV enrichment adds fields (`osv_severity`, `fixed_versions`, and more) the strict `additionalProperties: false` schema didn't list. The schema now covers them (and the poison/below-the-fix keys), and the contract test validates enriched output so it can't drift silently again.
+
+## [2.0.0] - 2026-06-14
+
 ### Upgrading to 2.0
 
 2.0 is a major bump because two changes can alter `--fail-if-*` outcomes on upgrade (the CLI flags and JSON `schema_version` are otherwise backward-compatible):

data/README.md

@@ -2,7 +2,9 @@
 
 **How do you know if your Ruby dependencies are still maintained?**
 
-`bundle outdated` tells you version drift. `bundler-audit` catches known CVEs. Neither tells you whether anyone is still working on the thing. `still_active` checks maintenance activity, version freshness, security scores, vulnerabilities, libyear drift, and archived repos for every gem in your dependency graph — direct and transitive by default (`--direct-only` to narrow), with granular, committed suppression via `.still_active.yml`.
+`bundle outdated` tells you version drift. `bundler-audit` catches known CVEs. Neither tells you whether anyone is still working on the thing. `still_active` checks maintenance activity, version freshness, security scores, vulnerabilities (flagging those with **no fixed version available**, the ones you can't upgrade out of), libyear drift, and archived repos for every gem in your dependency graph, direct and transitive by default (`--direct-only` to narrow), with granular, committed suppression via `.still_active.yml`.
+
+Ruby-first, but the maintenance lens isn't Ruby-only: point [`--sbom`](#cross-ecosystem-sbom-audit---sbom) at a CycloneDX SBOM and `still_active` audits your **npm, PyPI, Cargo, Go, Maven, and NuGet** dependencies the same way it does gems.
 
 Findings ship as **terminal / markdown / JSON / SARIF / CycloneDX** — SARIF lands in your GitHub Security tab and as inline PR annotations on `Gemfile.lock`; CycloneDX feeds Trivy / Dependency-Track / Snyk. PR mode (`--baseline=FILE`) reports only what got worse since main, so reviewers see one line ("`vcr` newly archived") instead of an absolute snapshot of every dep.
 
@@ -34,15 +36,16 @@ Ruby 4.0.1 (latest)
 |                              | `bundle outdated` | `bundler-audit`        | `libyear-bundler` | **`still_active`**       |
 | ---------------------------- | ----------------- | ---------------------- | ----------------- | ------------------------ |
 | Outdated versions            | Yes               | -                      | Yes               | Yes                      |
-| Known vulnerabilities (CVEs) | -                 | Yes (ruby-advisory-db) | -                 | Yes (deps.dev + ruby-advisory-db) |
+| Known vulnerabilities (CVEs) | -                 | Yes (ruby-advisory-db) | -                 | Yes (deps.dev + OSV + ruby-advisory-db) |
 | Libyear drift                | -                 | -                      | Yes               | Yes                      |
 | **Last commit activity**     | -                 | -                      | -                 | **Yes**                  |
 | **Archived repo detection**  | -                 | -                      | -                 | **Yes**                  |
 | **OpenSSF Scorecard**        | -                 | -                      | -                 | **Yes**                  |
 | **Yanked version detection** | -                 | -                      | -                 | **Yes**                  |
 | **Ruby version freshness**   | -                 | -                      | -                 | **Yes** (EOL + libyear)  |
+| **Cross-ecosystem** (npm/PyPI/Cargo/Go/Maven/NuGet) | - | -              | -                 | **Yes** (`--sbom`)       |
 | GitLab support               | -                 | -                      | -                 | Yes                      |
-| CI quality gates             | -                 | Exit code              | -                 | Yes (4 flags)            |
+| CI quality gates             | -                 | Exit code              | -                 | Yes (6 flags)            |
 | Output formats               | Text              | Text                   | Text              | Terminal, JSON, Markdown, SARIF, CycloneDX |
 
 The bolded rows are the gap `still_active` fills: nobody else answers "is the maintainer still around?" The CVE column is worth a closer look: `bundler-audit` reads `ruby-advisory-db` and `still_active` reads `deps.dev`, which sometimes diverge. **If `bundler-audit` is installed alongside `still_active`, we read its `ruby-advisory-db` checkout too and merge the results** (deduplicated, each advisory tagged with its `source`) — so running both no longer means reconciling two different vuln counts by hand.
@@ -85,7 +88,9 @@ still_active --markdown
 3. `GH_TOKEN` environment variable (`gh` CLI convention)
 4. `gh auth token` (if `gh` is installed and authenticated)
 
-Without a token, GitHub API calls are unauthenticated and rate-limited to 60 requests/hour — you will hit the limit on anything beyond a handful of gems. With a token the limit is 5000 requests/hour. When a rate-limit response comes back with a reset that's near (within 60 seconds, typically a secondary/burst limit that the concurrent fan-out can trip even with a token), still_active waits it out and retries rather than dropping that gem's signals; a far-off reset (you've exhausted the hourly limit) isn't waited out, so add a token or run less often.
+With a token, GitHub repo signals (archived, last commit) come from the GitHub API (limit 5000 requests/hour). When a rate-limit response comes back with a reset that's near (within 60 seconds, typically a secondary/burst limit that the concurrent fan-out can trip even with a token), still_active waits it out and retries rather than dropping that gem's signals; a far-off reset (you've exhausted the hourly limit) isn't waited out, so run less often.
+
+**Without a token**, the unauthenticated GitHub API is capped at 60 requests/hour — unusable past a handful of gems. So still_active falls back to [ecosyste.ms](https://ecosyste.ms) for GitHub repo signals (5000 anonymous requests/hour), which keeps a large Gemfile working with no token at all. The fallback is GitHub-only: ecosyste.ms doesn't track commit recency for GitLab/Codeberg, so those hosts still need their own token (or report `unknown`) when unauthenticated. A token still gives the freshest data and unlocks `--unreleased-commits`, so prefer one in CI. To be a good citizen of the free ecosyste.ms service, you can join its "polite pool" (a higher rate limit, and they can reach you) by passing a contact email via `--ecosystems-email=you@example.com` or `STILL_ACTIVE_ECOSYSTEMS_EMAIL` — optional, since the anonymous limit already covers a typical lockfile.
 
 GitLab cascade mirrors GitHub: `--gitlab-token` → `GITLAB_TOKEN` → `glab auth status --show-token`. Optional for public repos, required for private ones.
 
@@ -104,6 +109,7 @@ Usage: still_active [options]
 
         --gemfile=GEMFILE            path to gemfile
         --gems=GEM,GEM2,...          Gem(s)
+        --sbom=PATH                  audit a CycloneDX SBOM cross-ecosystem (npm/pypi/cargo/go/maven/nuget); JSON output
         --terminal                   Coloured terminal output (default in TTY)
         --markdown                   Markdown table output
         --json                       JSON output (default when piped)
@@ -118,6 +124,7 @@ Usage: still_active [options]
         --gitlab-token=TOKEN         GitLab personal access token for API calls
         --artifactory-token=TOKEN    Artifactory token for private gem registry API calls
         --artifactory-host=HOST      Artifactory host allowed to receive the global token (e.g. my-org.jfrog.io)
+        --ecosystems-email=EMAIL     Contact email to join the ecosyste.ms polite pool (higher rate limit)
         --simultaneous-requests=QTY  Number of simultaneous requests made
         --safe-range-end=YEARS       maximum years since last release considered safe, no warning (default 1.5)
         --warning-range-end=YEARS    maximum years since last release that triggers a warning, beyond this is critical (default 3)
@@ -126,6 +133,9 @@ Usage: still_active [options]
         --fail-if-vulnerable[=SEVERITY]
                                      Exit 1 if any gem has vulnerabilities (optionally at or above SEVERITY)
         --fail-if-outdated=LIBYEARS  Exit 1 if any gem exceeds LIBYEARS behind latest
+        --fail-if-poison[=TIER]      Exit 1 on a poison-pill at or above TIER (note|warning|critical; default warning)
+        --fail-if-language-ceiling[=TIER]
+                                     Exit 1 on a language-runtime ceiling (Ruby/Python; default: EOL-forced only; =note also gates latest-not-yet)
         --ignore=GEM,GEM2,...        Exclude gems from pass/fail checks (still shown in output)
         --critical-warning-emoji=EMOJI
         --futurist-emoji=EMOJI
@@ -211,11 +221,45 @@ still_active --cyclonedx --cyclonedx-version=1.7
 
 Emits **1.6 by default** — the version mainstream consumers ingest today (`cyclonedx-core-java`/Dependency-Track and `cyclonedx-go`/Trivy both cap at 1.6 as of 2026); `--cyclonedx-version=1.7` opts into the latest. Gem name/version/`purl`/licenses and vulnerabilities map to native CycloneDX fields; maintenance signals with no native home (archived, OpenSSF score, libyear, last commit, yanked) ride in `still_active:`-namespaced `properties`. The `serialNumber` is content-derived, so two SBOMs of the same lockfile differ only by their generation timestamp.
 
+### Cross-ecosystem SBOM audit (`--sbom`)
+
+still_active is Ruby-first, but the maintenance lens isn't Ruby-only. Point `--sbom` at a CycloneDX SBOM (from [Syft](https://github.com/anchore/syft), Trivy, or any producer) and it assesses `npm`, `pypi`, `cargo`, `go`, `maven`, and `nuget` packages the same way it does gems, sourcing signals from [deps.dev](https://deps.dev) and ecosyste.ms instead of Bundler:
+
+```bash
+syft dir:. -o cyclonedx-json > sbom.json
+still_active --sbom=sbom.json            # JSON report, keyed "ecosystem/name@version"
+```
+
+Each dependency carries the same `activity_level` and lifecycle `status` as the Ruby path, and the `summary` reports the worst status across the SBOM. When the SBOM marks dev-vs-prod scope (CycloneDX `scope`, or a `cyclonedx-npm`-style development property), each dependency also carries a `production` boolean so a consumer can separate prod risk from test debt; generators that don't mark it (Syft drops the label) leave the key absent, which reads as unknown rather than a false all-clear. `--sbom` is mutually exclusive with `--gemfile`/`--gems` and always emits JSON (its shape differs from the Ruby audit, so it omits the `$schema` contract).
+
+The SBOM is **untrusted input**: only ecosystem/name/version are read from it, the repository is resolved from deps.dev (never a URL the SBOM supplies, so a hostile SBOM can't redirect a lookup), and anything deps.dev doesn't index degrades to `unknown` rather than a fabricated `ok`. Packages it can't assess (unsupported ecosystems, a component with no version or PURL, or one whose lookup failed against a rate-limited/flaky deps.dev) are surfaced in an `unassessable` list plus a stderr count, never silently dropped, so an audit can't read "all clear" while ignoring what it skipped; a present-but-unreadable SBOM errors rather than reporting a clean empty audit. OS packages land in `unassessable` too: the differentiated play is **maintenance**, not vulnerability scanning, so compose Trivy/Grype for CVEs.
+
+The activity (`--fail-if-critical`/`--fail-if-warning`), vulnerability (`--fail-if-vulnerable`), and libyear (`--fail-if-outdated`) gates all apply to SBOM dependencies, which carry `libyear` and `up_to_date` the same as the Ruby path. **The full poison-pill signal is scoped to flat-resolution ecosystems** (rubygems, pypi): there a dormant gem's below-latest cap forces the whole tree onto the old version. npm nests multiple versions and cargo lets majors coexist (and their caret default makes "below latest major" the norm, not a hazard), so the plain below-latest cap there is subtree-local noise and stays suppressed.
+
+**The security "below the fix" case, though, does travel to npm and cargo.** When a *dormant or archived* package pins a dependency below the version that patches a HIGH-or-critical advisory, still_active flags it — at patch precision (npm/cargo fixes are mostly same-major patch bumps), and only when *every* resolved copy the constraint governs is vulnerable (a safe copy elsewhere in the tree, or a patched copy the constraint can reach, clears it), so it stays silent unless the tree is genuinely stuck. Example: an archived `request@2.88.2` pinning `form-data ~2.3.2` below the fix for a critical CVE — you can't patch it without replacing `request`. Other Ruby-shaped policy features still don't travel to the SBOM path: `.still_active.yml` suppressions and `--ignore` key on the gem name (SBOM results key on `ecosystem/name@version`).
+
+#### Which signal covers which path
+
+Most maintenance signals apply everywhere; a few are deliberately scoped (see [`docs/rules.md`](docs/rules.md) for the full rule reference).
+
+| Signal (rule) | Ruby (native) | `--sbom` (cross-ecosystem) |
+| ------------- | ------------- | -------------------------- |
+| Archived repo (SA001) | Yes | Yes (npm, PyPI, Cargo, Go, Maven, NuGet) |
+| Abandoned / no recent release (SA002) | Yes | Yes (all of the above) |
+| Low OpenSSF Scorecard (SA005) | Yes | Yes (all of the above) |
+| Libyear drift (SA004) | Yes | Yes (all of the above) |
+| Vulnerabilities (SA003) | Yes (deps.dev + OSV + ruby-advisory-db) | Yes (deps.dev + OSV) |
+|   ↳ "below the fix" (dead capper pins a vulnerable dep) | Yes | npm, Cargo, PyPI (patch precision) |
+| Poison-pill / compatibility ceiling (SA008) | Yes (rubygems) | PyPI only (flat resolution; npm/Cargo suppressed) |
+| Language-runtime ceiling (SA009) | Yes (`ruby_version`) | Python only (`requires_python`) |
+| Ruby EOL (SA006) | Yes | n/a (Ruby-runtime signal) |
+| Yanked version (SA007) | Yes | n/a |
+
 ### SARIF output (GitHub Code Scanning)
 
 Emit findings as SARIF 2.1.0 — they show up in the GitHub Security tab and as inline annotations on `Gemfile.lock` in pull requests.
 
-> **See it live:** this repo audits itself on every push. Browse the live findings in the [Code Scanning Security tab](https://github.com/SeanLF/still_active/security/code-scanning?query=tool%3Astill_active+is%3Aopen) — currently 2× `SA005` (low OpenSSF Scorecard).
+> **See it live:** this repo audits itself on every push. Browse the current open findings in the [Code Scanning Security tab](https://github.com/SeanLF/still_active/security/code-scanning?query=tool%3Astill_active+is%3Aopen).
 
 ```bash
 still_active --sarif                       # writes still_active.sarif.json
@@ -257,7 +301,7 @@ jobs:
         with: { sarif_file: still_active.sarif.json }
 ```
 
-Rule reference (SA001–SA007) and how to suppress: see [`docs/rules.md`](docs/rules.md).
+Rule reference (SA001–SA009) and how to suppress: see [`docs/rules.md`](docs/rules.md).
 
 ### Baseline diff (PR review)
 
@@ -353,6 +397,8 @@ still_active --fail-if-warning --fail-if-vulnerable --ignore=legacy_gem --json
 fail_if_critical: true
 fail_if_vulnerable: high       # true, or a minimum severity: low|medium|high|critical
 fail_if_outdated: 3            # libyears
+fail_if_poison: warning        # true (=warning), or a tier: note|warning|critical (severity scales with majors-behind)
+fail_if_language_ceiling: true # true = EOL-forced ceilings only; :note also gates latest-not-yet (fluctuates with the runtime's release calendar)
 unreleased_commits: true
 output: json                   # terminal | markdown | json
 direct_only: true              # audit only declared deps, not the full transitive graph (--direct-only)
@@ -370,7 +416,7 @@ ignore:
 
   # Accept staleness on a vendored gem, but still fail if it gets a CVE
   - gem: legacy_thing
-    signal: activity            # activity | vulnerability | libyear
+    signal: activity            # activity | vulnerability | libyear | poison | language_ceiling
     reason: "vendored, intentionally frozen"
 
   # A bare gem name keeps the old whole-gem behaviour (mutes every signal)
@@ -379,7 +425,7 @@ ignore:
 
 Design:
 
-- **Granularity.** Key by `advisory:` (one CVE) and/or `signal:` (`activity` / `vulnerability` / `libyear`), not the whole gem. A vulnerability suppression **must** name an advisory id, so a newly disclosed CVE on the same gem is never pre-silenced. `--ignore=GEM` (and a bare gem-name entry) still mute everything, by design.
+- **Granularity.** Key by `advisory:` (one CVE) and/or `signal:` (`activity` / `vulnerability` / `libyear` / `poison`), not the whole gem. A vulnerability suppression **must** name an advisory id, so a newly disclosed CVE on the same gem is never pre-silenced. `--ignore=GEM` (and a bare gem-name entry) still mute everything, by design.
 - **Precedence.** CLI flag > env var > config file > default. A CLI flag always wins; `--ignore` unions with the file's suppressions rather than replacing them. Secrets (tokens) and invocation-specific paths (`--gemfile`, `--gems`, `--baseline`, output paths) are intentionally **not** read from the file, so a committed config never carries a credential.
 - **Expiry.** An `expires:` date makes accepted risk visible: once it passes, the entry stops applying and the finding fails the gate again (Trivy-style), so a suppression can't rot silently. `reason:` is optional but recommended. A suppression naming a gem that isn't in your dependency graph (a typo, or a gem you've since removed) is also surfaced as a warning, so dead entries don't accumulate.
 - **bundler-audit, suggested not absorbed.** still_active never silently inherits another tool's ignore list: auto-importing `.bundler-audit.yml` would suppress vulnerabilities you only accepted in bundler-audit's context, with no reason or expiry here. Instead, when `--fail-if-vulnerable` is on and an un-imported `.bundler-audit.yml` is present, it prints a one-line hint suggesting the `import:` line, leaving the opt-in to you.
@@ -426,8 +472,9 @@ It is **opt-in and GitHub-only**: enabling it adds one extra API call per GitHub
 ### Data sources
 
 - **Versions, release dates, and licenses** from [RubyGems.org](https://rubygems.org), [GitHub Packages](https://docs.github.com/en/packages), or [JFrog Artifactory](https://jfrog.com/artifactory/) gem registries
-- **Last commit date and archived status** from the [GitHub](https://docs.github.com/en/rest), [GitLab](https://docs.gitlab.com/ee/api/), or [Forgejo/Gitea](https://forgejo.org/docs/latest/user/api-usage/) (Codeberg) API
-- **OpenSSF Scorecard**, **vulnerability counts**, and **CVSS severity** from Google's [deps.dev](https://deps.dev) API
+- **Last commit date and archived status** from the [GitHub](https://docs.github.com/en/rest), [GitLab](https://docs.gitlab.com/ee/api/), or [Forgejo/Gitea](https://forgejo.org/docs/latest/user/api-usage/) (Codeberg) API — or, for GitHub repos when no token is configured, from [ecosyste.ms](https://ecosyste.ms) ([repos API](https://repos.ecosyste.ms)). ecosyste.ms data is licensed [CC-BY-SA 4.0](https://creativecommons.org/licenses/by-sa/4.0/).
+- **OpenSSF Scorecard**, **vulnerability counts**, and **CVSS severity** from Google's [deps.dev](https://deps.dev) API (also the cross-ecosystem source on the `--sbom` path)
+- **Advisory severity labels and fixed-version ranges** from [OSV](https://osv.dev) (`api.osv.dev`), which drive the "below the fix" signal. An advisory that publishes only a CVSS **4.0** vector stays unscored unless you install the optional [`cvss-suite`](https://rubygems.org/gems/cvss-suite) gem (`gem install cvss-suite`), which computes its 4.0 base score; without it the gate still fires on the OSV/GHSA severity label, it just skips the number.
 - **Additional advisories** from [ruby-advisory-db](https://github.com/rubysec/ruby-advisory-db), merged in when `bundler-audit` is installed alongside (run `bundle audit update` to keep its checkout current)
 - **Ruby version freshness** from [endoflife.date](https://endoflife.date)
 - **Alternative gem leads** (with `--alternatives`) from the [rubytoolbox/catalog](https://github.com/rubytoolbox/catalog) category data

data/lib/helpers/activity_helper.rb

@@ -42,6 +42,14 @@ module StillActive
     def activity_level(gem_data)
       return :archived if gem_data[:archived]
 
+      release_recency_level(gem_data)
+    end
+
+    # Recency verdict from release/commit dates alone, ignoring the archived
+    # flag: :ok, :stale, :critical, or :unknown. Lets the lifecycle status tell
+    # an archived-but-still-publishing gem (development moved to a monorepo) from
+    # a genuinely dormant one.
+    def release_recency_level(gem_data)
       activity = last_activity(gem_data)
       return :unknown if activity.nil?
 

data/lib/helpers/constraint_helper.rb

@@ -0,0 +1,208 @@
+# frozen_string_literal: true
+
+module StillActive
+  # Reads a declared dependency constraint (the requirement string a package
+  # publishes for one of its runtime deps, e.g. "~> 4.2", "< 5.0", "= 1.2.3") and
+  # answers how much it caps you: is there an upper bound, and how many majors
+  # behind the dependency's current latest does it hold you?
+  #
+  # This is the constraint half of the poison-pill signal (constraint-tightness x
+  # maintenance-state): a dormant package that caps a still-evolving dep below its
+  # latest major holds your tree hostage with no hope of the cap lifting. A fixed
+  # cap gets more poisonous purely with time, as the capped dep ships new majors
+  # while the cap stays frozen.
+  #
+  # Grammar is coarse but cross-ecosystem: Ruby pessimistic (~>), pip compatible
+  # (~=), semver caret/tilde (^ ~), exact (= == ===), and plain </<=. Precision is
+  # at the MAJOR level, which is all the signal needs ("N majors behind").
+  module ConstraintHelper
+    extend self
+
+    # The constraint kinds that make a dep a poison-pill candidate: an upper bound
+    # that blocks upgrades, or an exact pin that freezes the whole tree. A
+    # `:permissive` constraint is neither. Shared with the workflow so the poison
+    # definition lives in one place.
+    POISON_KINDS = [:ceiling, :exact_pin].freeze
+
+    # An exact pin: = / == / === before a digit (NOT >= or <=).
+    EXACT_PIN = /\A={1,3}\s*v?\d/
+    # A bare version with no operator (npm/cargo exact form), e.g. "1.2.3", "v1".
+    BARE_VERSION = /\Av?\d+(?:\.\d+)*\z/
+    # Operator + version at the head of a clause.
+    CLAUSE = /\A(===?|=|<=|<|~>|~=|\^|~)?\s*v?(\d+(?:\.\d+)*)/
+    # Whitespace that separates npm AND clauses (">=1.2.0 <2.0.0"), i.e. a space
+    # before an operator. It won't split a Ruby clause like "~> 4.2" (the space
+    # there precedes a digit, not an operator). The quantifier is POSSESSIVE
+    # (`\s++`, not `\s+`): a lookahead after a greedy `\s+` backtracks once per
+    # trailing space, which is quadratic on a long run of spaces (ReDoS on the
+    # lockfile-derived requirement string). Possessive matching never backtracks.
+    AND_SEPARATOR = /\s++(?=[<>=~^])/
+    # A real declared requirement ("< 5.0, >= 4.0.1", "^1 || ^2 || ^3") is short.
+    # Anything past this is not a parseable constraint, so cap the input up front:
+    # it bounds every regex below to linear work and refuses to mint a pill from
+    # garbage (an over-long string reads as permissive, never a false ceiling).
+    MAX_REQUIREMENT_LENGTH = 256
+
+    # => { kind: :permissive|:ceiling|:exact_pin, majors_behind: Integer }
+    def analyze(requirement:, dep_latest:)
+      return { kind: :permissive, majors_behind: 0 } if requirement.to_s.length > MAX_REQUIREMENT_LENGTH
+
+      # `||` is an OR-range (npm): satisfied by ANY branch, so an unbounded branch
+      # lifts the cap entirely and the effective ceiling is the LOOSEST branch.
+      # Reading only the first branch would invent a false pill on the common
+      # `^2.0.0 || ^3.0.0` "supports several majors" form.
+      branches = requirement.to_s.split("||").map { |branch| clauses_of(branch) }
+      branches = [[]] if branches.empty?
+      ceilings = branches.map { |clauses| branch_ceiling(clauses) }
+      latest_major = major(dep_latest)
+
+      return { kind: :permissive, majors_behind: 0 } if ceilings.any?(&:nil?)
+
+      behind = latest_major ? [latest_major - ceilings.max, 0].max : 0
+      kind = branches.all? { |clauses| all_exact?(clauses) } ? :exact_pin : :ceiling
+      { kind: kind, majors_behind: behind }
+    end
+
+    # Severity tiers for a compatibility ceiling, worst-last (mirrors
+    # StatusHelper::SEVERITY -- an ordinal set compared by index, never a numeric
+    # composite). :note is FYI, :warning is review-and-plan, :critical is act-now.
+    SEVERITY = [:note, :warning, :critical].freeze
+
+    # Tier one ceiling finding. Magnitude-driven: the real-project dogfood showed
+    # Ruby findings are bimodal -- 1 major behind is trivial (a done gem pinning an
+    # old minor), 3+ is a genuine upgrade wall (e.g. capping actionmailer below
+    # Rails 6). Popularity was rejected as an input (it ranks the framework blocker
+    # below a utility) and a vulnerable-gem escalator was rejected (that is the
+    # vulnerability finding's job, not the cap's).
+    def constraint_severity(finding)
+      # A runtime ceiling that strands you on an end-of-life Ruby is act-now: no
+      # patched runtime is reachable. This short-circuit lets the language-ceiling
+      # signal (which carries no majors_behind) reuse the same tierer as poison.
+      return :critical if finding[:eol_forced]
+
+      case finding[:majors_behind]
+      when 2 then :warning
+      when 3.. then :critical
+      else :note
+      end
+    end
+
+    # The worst tier across a gem's CEILING findings (exact-pins are a milder
+    # hazard, not poison, and don't carry a tier), or nil when there are none.
+    def worst_severity(findings)
+      tiers = findings.filter_map { constraint_severity(_1) if _1[:kind] == :ceiling }
+      tiers.max_by { SEVERITY.index(_1) }
+    end
+
+    # For the --fail-if-poison[=TIER] gate: is `severity` at or above `threshold`?
+    def severity_at_or_above?(severity, threshold)
+      return false if severity.nil?
+
+      SEVERITY.index(severity) >= SEVERITY.index(threshold)
+    end
+
+    # True when `version` sits at or below the highest major the cap allows -- i.e.
+    # you could upgrade the capped dep to it WITHOUT breaking the cap. The ceiling
+    # major is recovered from the poison finding itself (dep_latest minus
+    # majors_behind), at the same major precision the poison signal already uses, so
+    # a fix that lands OUTSIDE the cap ("below the fix") is detected without
+    # re-parsing the raw requirement and its pre/dev-release quirks (`< 5.0.0dev`).
+    #
+    # Precision is MAJOR-level by design, and that errs deliberately toward reachable:
+    # a within-major cap (`~> 4.2.1`, `< 5.5`) reads a same-major fix (4.9.0, 5.29.6)
+    # as reachable even though the cap forbids it. So a genuinely-stuck within-major
+    # cap is UNDER-reported (downgraded to the still-visible "vulnerable" tier), never
+    # falsely promoted -- when this DOES return false for every fix, the below-the-fix
+    # claim is sound (every fix is in a strictly higher major than the cap allows).
+    # Unparseable/absent inputs read false (never claims reachable when we can't tell).
+    def reachable_within_cap?(finding, version)
+      fix_major = major(version)
+      latest_major = major(finding[:dep_latest])
+      behind = finding[:majors_behind]
+      return false if fix_major.nil? || latest_major.nil? || behind.nil?
+
+      fix_major <= latest_major - behind
+    end
+
+    # The poison condition: a below-latest ceiling or exact pin. A permissive
+    # constraint, or a cap at/above the dep's latest major, is not a pill.
+    def poison_ceiling?(requirement:, dep_latest:)
+      result = analyze(requirement: requirement, dep_latest: dep_latest)
+      POISON_KINDS.include?(result[:kind]) && result[:majors_behind].positive?
+    end
+
+    # Build the poison-pill receipts for a package's declared runtime deps. Each
+    # `dep` is { package_name:, requirements: }; the block resolves a dep name to
+    # its current latest version string (or nil when unresolvable, which drops the
+    # dep rather than guessing). Returns only the below-latest ceilings and exact
+    # pins, each as a self-contained receipt. Shared by the native Bundler path and
+    # the cross-ecosystem lens, which differ only in how they resolve dep_latest.
+    def poison_findings(deps)
+      deps.filter_map do |dep|
+        dep_latest = yield(dep[:package_name])
+        next if dep_latest.nil?
+
+        result = analyze(requirement: dep[:requirements], dep_latest: dep_latest)
+        next unless POISON_KINDS.include?(result[:kind]) && result[:majors_behind].positive?
+
+        {
+          dependency: dep[:package_name],
+          requirement: dep[:requirements],
+          dep_latest: dep_latest,
+          majors_behind: result[:majors_behind],
+          kind: result[:kind],
+        }
+      end
+    end
+
+    # Select the worst `limit` findings for a display receipt, plus the full count
+    # so a renderer can say "+N more" / "N total". Worst-first by majors_behind,
+    # ties broken by dependency name so the output is stable and diffable. Shared
+    # by the terminal and markdown renderers so the selection can't drift.
+    def top_findings(findings, limit: 3)
+      ranked = findings.sort_by { |f| [-f[:majors_behind], f[:dependency].to_s] }
+      { shown: ranked.first(limit), total: findings.length }
+    end
+
+    private
+
+    # Split one OR-branch into its AND clauses: comma-separated (Ruby/pip) or
+    # space-separated (npm ">=1.2.0 <2.0.0").
+    def clauses_of(branch)
+      branch.split(",").flat_map { |part| part.strip.split(AND_SEPARATOR) }.map(&:strip).reject(&:empty?)
+    end
+
+    # The tightest ceiling major within one AND-branch, or nil when the branch has
+    # no upper bound at all (a lone lower bound = permissive, lifts the OR cap).
+    def branch_ceiling(clauses)
+      clauses.filter_map { |clause| clause_ceiling_major(clause) }.min
+    end
+
+    def all_exact?(clauses)
+      !clauses.empty? && clauses.all? { |clause| clause.match?(EXACT_PIN) || clause.match?(BARE_VERSION) }
+    end
+
+    def clause_ceiling_major(clause)
+      match = clause.match(CLAUSE)
+      return unless match
+
+      operator = match[1]
+      major_of = major(match[2])
+      case operator
+      # `< X.0.0` excludes major X entirely (max usable major is X-1); `< X.Y`
+      # with a non-zero minor still allows major X.
+      when "<" then all_zero_after_major?(match[2]) ? major_of - 1 : major_of
+      when "<=", "~>", "~=", "^", "~", "=", "==", "===", nil then major_of
+      end # `>`/`>=` fall through to nil: a lower bound imposes no ceiling
+    end
+
+    def all_zero_after_major?(version)
+      version.split(".").drop(1).all? { |part| part.to_i.zero? }
+    end
+
+    def major(version)
+      digits = version.to_s[/\d+/]
+      digits&.to_i
+    end
+  end
+end

data/lib/helpers/cvss_helper.rb

@@ -0,0 +1,63 @@
+# frozen_string_literal: true
+
+module StillActive
+  # Computes a CVSS score from a vector string, across v2/v3/v4. deps.dev stores only
+  # CVSS 3.x, so a CVSS-4-only advisory (the flagship protobuf case) arrives with no
+  # numeric score; OSV carries the v4 vector, and this turns it into the number the
+  # SARIF security-severity and CycloneDX rating want.
+  #
+  # cvss-suite is an OPTIONAL, undeclared dependency: it over-constrains its own deps
+  # (an exact `bundler` pin, a `bigdecimal ~> 3.1` cap), the poison-pill pattern
+  # still_active itself flags, so hard-requiring it would force that liability on every
+  # user and trip our own audit. CvssHelper soft-requires it; install cvss-suite (or run
+  # the distribution that bundles it) to light it up.
+  #
+  # Returns cvss-suite's `overall_score`: for the base-only vectors OSV publishes that
+  # IS the base score, but a vector carrying threat/environmental metrics would fold
+  # those in -- which is why the severity band floors at the authoritative GHSA label
+  # (VulnerabilityHelper.advisory_severity) and this number never lowers it: the label
+  # drives gating and SARIF level, the number only sharpens display. Fails safe: an
+  # absent gem or an absent/unparseable vector yields nil, never a crash.
+  module CvssHelper
+    extend self
+
+    def score(vector)
+      return unless available?
+      return if vector.nil? || vector.to_s.empty?
+
+      cvss = CvssSuite.new(vector.to_s)
+      cvss.valid? ? cvss.overall_score : nil
+    rescue StandardError => e
+      # We only reach here with cvss-suite loaded (available?), so a raise is the
+      # installed gem failing this call site -- an incompatible version, a renamed
+      # `overall_score` -- not a bad vector, which cvss-suite reports via valid?.
+      # Fail safe to nil (the number is display-only, never gates), but don't
+      # swallow it: an opted-in-but-broken scorer that emitted nothing would read
+      # as "no advisories are scored". Warn once per run (not per advisory),
+      # matching OsvClient.enrich rather than staying silent.
+      warn_scorer_failed(e)
+      nil
+    end
+
+    # Memoized soft-require: true once cvss-suite loads, false when it isn't installed.
+    def available?
+      return @available unless @available.nil?
+
+      @available = begin
+        require "cvss_suite"
+        true
+      rescue LoadError
+        false
+      end
+    end
+
+    private
+
+    def warn_scorer_failed(error)
+      return if @warned
+
+      @warned = true
+      $stderr.puts("warning: cvss-suite scoring failed: #{error.class} (#{error.message}); CVSS numbers unavailable this run, check your cvss-suite version")
+    end
+  end
+end

data/lib/helpers/cyclonedx_helper.rb

@@ -142,15 +142,31 @@ module StillActive
     end
 
     def rating(advisory)
-      score = advisory[:cvss3_score] || advisory[:cvss2_score]
+      # effective_score drops deps.dev's cvss3=0 sentinel; an unscored advisory
+      # gets no numeric rating (honest) rather than a masquerading 0.0. A CVSS-4-only
+      # advisory now carries the OSV-computed v4 score, so it gets a real rating too.
+      score = VulnerabilityHelper.effective_score(advisory)
       return if score.nil?
 
-      method = advisory[:cvss3_score] ? "CVSSv3" : "CVSSv2"
-      rating = { "score" => score, "severity" => VulnerabilityHelper.highest_severity([advisory]) || "unknown", "method" => method }
-      rating["vector"] = advisory[:cvss3_vector] if advisory[:cvss3_vector]
+      rating = { "score" => score, "severity" => VulnerabilityHelper.highest_severity([advisory]) || "unknown", "method" => rating_method(advisory) }
+      vector = advisory[:cvss3_vector] || advisory[:cvss_vector]
+      rating["vector"] = vector if vector
       rating
     end
 
+    # Names the CVSS version behind the score so a v4-derived rating isn't mislabelled
+    # CVSSv2. deps.dev's v3/v2 win; otherwise the OSV-enriched vector's version.
+    def rating_method(advisory)
+      return "CVSSv3" if advisory[:cvss3_score]&.positive?
+      return "CVSSv2" if advisory[:cvss2_score]&.positive?
+
+      case advisory[:cvss_version]
+      when "4.0" then "CVSSv4"
+      when "2.0" then "CVSSv2"
+      else "CVSSv3"
+      end
+    end
+
     def boolean_property(value)
       return if value.nil?
 

data/lib/helpers/diff_markdown_helper.rb

@@ -19,13 +19,14 @@ module StillActive
       unknown: nil,
     }.freeze
 
-    def render(diff)
+    def render(diff, accepted: [])
       sections = [
         "## still_active diff",
         "",
-        summary_line(diff),
+        summary_line(diff, accepted),
         "",
         regressions_section(diff.regressions),
+        accepted_section(accepted),
         added_section(diff.added),
         removed_section(diff.removed),
         bumps_section(diff.bumped),
@@ -38,14 +39,16 @@ module StillActive
 
     private
 
-    def summary_line(diff)
-      [
+    def summary_line(diff, accepted)
+      parts = [
         ["regressions", diff.regressions.size],
         ["added", diff.added.size],
         ["removed", diff.removed.size],
         ["bumped", diff.bumped.size],
         ["signal-changes", diff.signal_changes.size],
-      ].map { |label, n| "#{n} #{label}" }.join(" · ")
+      ]
+      parts << ["accepted", accepted.size] unless accepted.empty?
+      parts.map { |label, n| "#{n} #{label}" }.join(" · ")
     end
 
     def regressions_section(regressions)
@@ -55,6 +58,19 @@ module StillActive
       section("Regressions (CI-failable)", lines)
     end
 
+    # Regressions a committed .still_active.yml knowingly accepts: shown so the
+    # acceptance is visible in the PR comment, but excluded from the CI-failable
+    # count above.
+    def accepted_section(accepted)
+      return "" if accepted.empty?
+
+      lines = accepted.map do |a|
+        reason = a.reason ? " — #{MarkdownEscape.inline(a.reason)}" : ""
+        "- **#{a.regression.kind}** #{MarkdownEscape.code_span(a.regression.gem)}#{reason}"
+      end
+      section("Accepted (suppressed via .still_active.yml)", lines)
+    end
+
     def added_section(added)
       return "" if added.empty?