still_active 2.0.0 → 3.0.0.rc2

data/lib/still_active/suppressions.rb

@@ -5,8 +5,9 @@ require "date"
 module StillActive
   # Granular, auditable suppression of individual findings, loaded from the
   # `ignore:` block of a committed .still_active.yml. Each entry silences one
-  # signal (activity / libyear) or one advisory for one gem, optionally until an
-  # expiry date, replacing the all-or-nothing whole-gem --ignore. A bare gem
+  # signal (activity / vulnerability / libyear / poison) or one advisory for one
+  # gem, optionally until an expiry date, replacing the all-or-nothing whole-gem
+  # --ignore. A bare gem
   # name (or a gem-only mapping) keeps the old whole-gem behaviour so --ignore
   # can union into the same list.
   #
@@ -15,7 +16,7 @@ module StillActive
   # name an explicit advisory id, so a newly disclosed CVE on the same gem is
   # never pre-silenced.
   class Suppressions
-    GATEABLE_SIGNALS = [:activity, :vulnerability, :libyear].freeze
+    GATEABLE_SIGNALS = [:activity, :vulnerability, :libyear, :poison, :language_ceiling].freeze
 
     Entry = Struct.new(:gem, :advisory, :signal, :reason, :expires, keyword_init: true) do
       def whole_gem?
@@ -75,14 +76,14 @@ module StillActive
           return false
         end
         if signal && !GATEABLE_SIGNALS.include?(signal)
-          warnings << "ignoring suppression for #{label}: unknown signal #{signal.inspect} (expected activity, vulnerability, or libyear)"
+          warnings << "ignoring suppression for #{label}: unknown signal #{signal.inspect} (expected activity, vulnerability, libyear, or poison)"
           return false
         end
         if signal == :vulnerability && advisory.nil?
           warnings << "ignoring vulnerability suppression for #{label}: must name an advisory id so newly disclosed advisories still surface"
           return false
         end
-        if [:activity, :libyear].include?(signal) && gem.nil?
+        if [:activity, :libyear, :poison].include?(signal) && gem.nil?
           warnings << "ignoring #{signal} suppression: must name a gem"
           return false
         end

data/lib/still_active/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module StillActive
-  VERSION = "2.0.0"
+  VERSION = "3.0.0.rc2"
 end

data/lib/still_active/workflow.rb

@@ -1,7 +1,11 @@
 # frozen_string_literal: true
 
 require_relative "artifactory_client"
+require_relative "ceiling_reconciler"
 require_relative "deps_dev_client"
+require_relative "osv_client"
+require_relative "poison_security_correlator"
+require_relative "ecosystems_client"
 require_relative "forgejo_client"
 require_relative "github_client"
 require_relative "gitlab_client"
@@ -9,9 +13,12 @@ require_relative "repository"
 require_relative "../helpers/activity_helper"
 require_relative "../helpers/alternatives_helper"
 require_relative "../helpers/catalog_index"
+require_relative "../helpers/constraint_helper"
+require_relative "../helpers/http_helper"
 require_relative "../helpers/libyear_helper"
 require_relative "../helpers/ruby_advisory_db"
 require_relative "../helpers/ruby_helper"
+require_relative "../helpers/runtime_ceiling_helper"
 require_relative "../helpers/version_helper"
 require_relative "../helpers/vulnerability_helper"
 require "async"
@@ -30,9 +37,33 @@ module StillActive
         # read-only Database is shared across fibers rather than reloaded per gem.
         advisory_db = RubyAdvisoryDb.load
         catalog = StillActive.config.alternatives ? CatalogIndex.load : nil
+        # The Ruby support window (oldest-supported / latest-stable / EOL cycles)
+        # is a per-run constant, so fetch it once here rather than per gem. nil when
+        # the endoflife feed is unavailable -> the language-ceiling signal quietly
+        # sits out, exactly like a missing advisory_db. This runs OUTSIDE the
+        # per-gem rescue, so a defensive rescue keeps a best-effort enrichment from
+        # ever aborting the whole audit (the "never crash the core" contract).
+        ruby_range =
+          begin
+            RubyHelper.supported_ruby_range
+          rescue StandardError => e
+            $stderr.puts("warning: Ruby support window lookup failed: #{e.class} (#{e.message}); skipping language-ceiling checks")
+            nil
+          end
+        # Resolve the GitHub token once here, single-fibered, before the fan-out:
+        # provider_for reads it per gem across fibers and gh_cli_token shells out,
+        # so resolving eagerly keeps that off the concurrent path and guarantees
+        # every fiber sees one consistent value (token -> live GitHub, incl. private
+        # repos; only a genuinely absent token falls back to ecosyste.ms).
+        StillActive.config.github_oauth_token
         barrier = Async::Barrier.new
         semaphore = Async::Semaphore.new(StillActive.config.parallelism, parent: barrier)
         result_object = {}
+        # Memoizes each capped dep's latest version across gems for the run, so a
+        # dep pinned by several dormant gems is resolved once. Shared, single-writer
+        # under Async's cooperative scheduling (a duplicate concurrent miss just
+        # refetches the same value; it can't corrupt the map).
+        constraint_cache = {}
         total = StillActive.config.gems.size
         completed = 0
         StillActive.config.gems.each_with_object(result_object) do |gem, hash|
@@ -47,6 +78,8 @@ module StillActive
               dependency_path: gem[:dependency_path],
               advisory_db: advisory_db,
               catalog: catalog,
+              constraint_cache: constraint_cache,
+              ruby_range: ruby_range,
             )
           rescue Octokit::TooManyRequests
             $stderr.print("\r\e[K") if on_progress
@@ -60,6 +93,13 @@ module StillActive
           end
         end
         barrier.wait
+        # Whole-tree correlation, once every gem's signals are in: a ceiling's
+        # "upgrade to lift it" must not contradict a poison finding that caps the
+        # same gem below that upgrade.
+        CeilingReconciler.reconcile_ceiling_with_poison(result_object)
+        # Flag poison caps that pin a vulnerable dependency: "a dormant package is
+        # holding you on a known-vulnerable dep, below the fix." No extra fetches.
+        PoisonSecurityCorrelator.correlate(result_object)
         # Gems are inserted as their async tasks finish, so the natural order is
         # nondeterministic completion order. Sort by name once here so every
         # consumer (JSON, SARIF, the baseline diff) gets a stable, diffable order.
@@ -74,7 +114,7 @@ module StillActive
 
     private
 
-    def gem_info(gem_name:, result_object:, gem_version: nil, source_type: :rubygems, source_uri: nil, direct: true, dependency_path: nil, advisory_db: nil, catalog: nil)
+    def gem_info(gem_name:, result_object:, gem_version: nil, source_type: :rubygems, source_uri: nil, direct: true, dependency_path: nil, advisory_db: nil, catalog: nil, constraint_cache: {}, ruby_range: nil)
       result_object[gem_name] = { source_type: source_type, direct: direct }
       result_object[gem_name][:dependency_path] = dependency_path if dependency_path
       result_object[gem_name][:version_used] = gem_version if gem_version
@@ -89,13 +129,20 @@ module StillActive
           result_object: result_object,
           source_uri: source_uri,
           advisory_db: advisory_db,
+          ruby_range: ruby_range,
         )
       end
 
       attach_alternatives(gem_name: gem_name, result_object: result_object, catalog: catalog)
+      # Poison-pill enrichment runs last and only on the rubygems path (git/path
+      # gems aren't in the registry). Placed after alternatives so a stray fetch
+      # error can never cost the gem its other, already-assembled signals.
+      unless [:path, :git].include?(source_type)
+        attach_constraints(gem_name: gem_name, result_object: result_object, cache: constraint_cache)
+      end
     end
 
-    def gem_info_rubygems(gem_name:, gem_version:, result_object:, source_uri:, advisory_db: nil)
+    def gem_info_rubygems(gem_name:, gem_version:, result_object:, source_uri:, advisory_db: nil, ruby_range: nil)
       vs = versions(gem_name: gem_name, source_uri: source_uri)
       repo_info = repository_info(gem_name: gem_name, versions: vs, source_uri: source_uri)
       signals = repo_signals(
@@ -106,7 +153,10 @@ module StillActive
       commit_date = signals[:last_commit_date]
       archived = signals[:archived]
       last_release = VersionHelper.find_version(versions: vs, pre_release: false)
-      last_pre_release = VersionHelper.find_version(versions: vs, pre_release: true)
+      last_pre_release = VersionHelper.upcoming_pre_release(
+        pre_release: VersionHelper.find_version(versions: vs, pre_release: true),
+        release: last_release,
+      )
       deps_dev = fetch_deps_dev_info(
         gem_name: gem_name,
         version: gem_version || VersionHelper.gem_version(version_hash: last_release),
@@ -138,8 +188,8 @@ module StillActive
         )
       end
 
+      version_used = gem_version ? VersionHelper.find_version(versions: vs, version_string: gem_version) : nil
       if gem_version
-        version_used = VersionHelper.find_version(versions: vs, version_string: gem_version)
         result_object[gem_name].merge!({
           up_to_date: VersionHelper.up_to_date(
             version_used: version_used,
@@ -156,6 +206,75 @@ module StillActive
           ),
         })
       end
+
+      # A version pinned to a now-yanked release has no resolvable ruby_version to
+      # judge, and `pinned: !version_used.nil?` would otherwise fall through to the
+      # latest version's cap and attach IT to the locked gem -- a false ceiling on a
+      # version we can't actually read. Skip; the yanked lock is already flagged.
+      yanked_lock = !gem_version.nil? && version_used.nil? && !vs.empty?
+      unless yanked_lock
+        attach_ruby_ceiling(
+          gem_data: result_object[gem_name],
+          used_ruby_requirement: canonical_ruby_requirement(vs, version_used),
+          latest_ruby_requirement: canonical_ruby_requirement(vs, last_release),
+          pinned: !version_used.nil?,
+          ruby_range: ruby_range,
+        )
+      end
+    end
+
+    # The ruby_version to judge a language ceiling against, read from the canonical
+    # `ruby` (source) platform entry of a version rather than whichever variant the
+    # registry happens to list first. Native gems ship a permissive `ruby` platform
+    # plus precompiled per-platform variants that cap ruby_version to the ABIs they
+    # were built for; the source platform is the gem's true Ruby support (it can be
+    # compiled on a newer Ruby), so a precompiled variant's tighter cap must not be
+    # read as the gem's ceiling. (Flagging that a project's LOCKED precompiled
+    # variant lacks a newer-Ruby build is a distinct, narrower signal, and needs the
+    # locked platform, which isn't threaded here yet.)
+    def canonical_ruby_requirement(versions, version_hash)
+      number = version_hash && version_hash["number"]
+      return if number.nil?
+
+      entries = versions.select { |version| version["number"] == number }
+      chosen = entries.find { |version| version["platform"] == "ruby" || version["platform"].nil? } || entries.first
+      VersionHelper.ruby_requirement(version_hash: chosen)
+    end
+
+    # Language-runtime ceiling: the sibling of poison. A gem's resolved version
+    # declares a `ruby_version` that caps the runtime -- either onto an end-of-life
+    # Ruby (critical: no patched runtime is reachable) or below the latest stable
+    # (note: a compatibility ceiling to plan around / a place to contribute Ruby-N
+    # support). Unlike poison this is NOT gated on dormancy: a cap is a fact of the
+    # resolved version whether or not the gem is maintained. Best-effort: a nil
+    # range (endoflife feed down) or absent ruby_version yields no finding.
+    def attach_ruby_ceiling(gem_data:, used_ruby_requirement:, latest_ruby_requirement:, pinned:, ruby_range:)
+      return if ruby_range.nil?
+
+      # Analyze the version actually in the tree. Fall back to latest ONLY when
+      # there's no pinned version (a latest-only audit), never when the pinned
+      # version merely declares no ruby_version: an absent cap runs on any Ruby, so
+      # projecting a newer release's cap back onto it would mint a false ceiling.
+      requirement = pinned ? used_ruby_requirement : latest_ruby_requirement
+      finding = RuntimeCeilingHelper.analyze(requirement: requirement, support_window: ruby_range)
+      return if finding.nil?
+
+      finding[:fixed_by_upgrade] = ruby_ceiling_lifted_by_upgrade?(used_req: used_ruby_requirement, latest_req: latest_ruby_requirement, ruby_range: ruby_range)
+      # The runtime this cap is against, so the shared renderers (terminal, md,
+      # SARIF) name it without hardcoding "Ruby". The Python SBOM path attaches the
+      # same shape with runtime "Python"; everything downstream is runtime-neutral.
+      finding[:runtime] = "Ruby"
+      gem_data[:language_ceiling] = finding
+    end
+
+    # Does bumping the gem to its latest lift the ceiling? True only when the cap
+    # is on the resolved (older) version and the latest version declares no ceiling
+    # of its own -- the actionable "upgrade the gem" case (e.g. CFPropertyList
+    # 3.0.9's `< 3.2` cap, gone by 4.0.0). False when already on latest.
+    def ruby_ceiling_lifted_by_upgrade?(used_req:, latest_req:, ruby_range:)
+      return false if used_req.nil? || used_req == latest_req
+
+      RuntimeCeilingHelper.analyze(requirement: latest_req, support_window: ruby_range).nil?
     end
 
     def gem_info_non_rubygems(gem_name:, gem_version:, result_object:, source_uri: nil, advisory_db: nil)
@@ -163,8 +282,15 @@ module StillActive
       source, owner, name = repo_info.values_at(:source, :owner, :name)
       deps_dev = gem_version ? fetch_deps_dev_info(gem_name: gem_name, version: gem_version, advisory_db: advisory_db) : {}
 
-      # Fall back to repo-derived project_id for scorecard when deps.dev doesn't have the version
-      deps_dev[:scorecard_score] ||= DepsDevClient.project_scorecard(project_id: repo_info[:project_id])&.dig(:score)
+      # Fall back to repo-derived project_id for scorecard when deps.dev doesn't
+      # have the version. Use ||= so a maintained score already found via the
+      # version's scorecard is never clobbered by a nil from the repo fallback
+      # (0.0 is truthy, so a measured "unmaintained" is preserved too).
+      if deps_dev[:scorecard_score].nil?
+        fallback = DepsDevClient.project_scorecard(project_id: repo_info[:project_id])
+        deps_dev[:scorecard_score] ||= fallback&.dig(:score)
+        deps_dev[:scorecard_maintained] ||= fallback&.dig(:maintained)
+      end
 
       signals = repo_signals(source:, repository_owner: owner, repository_name: name)
       result_object[gem_name].merge!({
@@ -189,15 +315,74 @@ module StillActive
       nil # cosmetic best-effort: lead-fetching must never break the core audit
     end
 
+    # Poison-pill detection. A dormant gem that declares a runtime constraint
+    # capping a still-evolving dep BELOW that dep's current latest major holds the
+    # tree hostage: the cap will never lift because nobody is shipping the gem, and
+    # it gets more poisonous with time as the capped dep keeps releasing majors.
+    #
+    # Gated on dormancy so a MAINTAINED gem with a cap is never flagged (it'll bump
+    # the cap) -- that gate is the whole discipline of the signal. Each surviving
+    # finding carries its receipt (caps X; latest Y; N majors behind). Best-effort
+    # and non-raising: every underlying call degrades to []/nil on failure, so a
+    # lookup miss just means "no constraints known", never a dropped gem.
+    def attach_constraints(gem_name:, result_object:, cache:)
+      gem_data = result_object[gem_name]
+      # The locked version if the caller pinned one (that's the requirement set
+      # actually in their tree), else the gem's latest.
+      version = gem_data[:version_used] || gem_data[:latest_version]
+      return if version.nil?
+      return unless [:critical, :archived].include?(ActivityHelper.activity_level(gem_data))
+
+      declared = EcosystemsClient.declared_dependencies(name: gem_name, version: version)
+      constraints = ConstraintHelper.poison_findings(declared) do |dep_name|
+        resolve_latest_version(dep_name, result_object: result_object, cache: cache)
+      end
+      return if constraints.empty?
+
+      gem_data[:constraints] = constraints
+      # Poison = a version ceiling that blocks upgrades. An exact-pin below latest
+      # is a milder resolution hazard: still surfaced in constraints, but it may be
+      # deliberate, so it doesn't earn the poison label on its own.
+      gem_data[:poison] = constraints.any? { |constraint| constraint[:kind] == :ceiling }
+      gem_data[:poison_severity] = ConstraintHelper.worst_severity(constraints) if gem_data[:poison]
+    end
+
+    # The capped dep's current latest stable version, for the majors-behind math.
+    # Reuse the tree's already-computed latest_version when the dep is itself in
+    # the audit (no extra request); otherwise fetch and memoize per run, so a dep
+    # capped by several dormant gems is looked up once. Only a RESOLVED version is
+    # cached: an unresolved lookup returns nil whether the dep is genuinely absent
+    # or rubygems.org was momentarily rate-limited, and caching the transient case
+    # would drop the pill for every later gem capping the same dep. So a miss is
+    # re-attempted rather than remembered.
+    def resolve_latest_version(dep_name, result_object:, cache:)
+      cache[dep_name] ||= result_object[dep_name]&.dig(:latest_version) || fetch_latest_version(dep_name)
+    end
+
+    def fetch_latest_version(dep_name)
+      latest = VersionHelper.find_version(versions: versions(gem_name: dep_name), pre_release: false)
+      VersionHelper.gem_version(version_hash: latest)
+    end
+
     def fetch_deps_dev_info(gem_name:, version:, advisory_db: nil)
       info = DepsDevClient.version_info(gem_name: gem_name, version: version)
       scorecard = DepsDevClient.project_scorecard(project_id: info&.dig(:project_id))
       advisory_keys = info&.dig(:advisory_keys) || []
-      deps_dev_vulns = advisory_keys.filter_map { |id| DepsDevClient.advisory_detail(advisory_id: id) }
+      # The keys ARE the evidence the version is vulnerable; the detail fetch only
+      # enriches CVSS/title. A failed enrichment (429/timeout/5xx -> nil) must not
+      # drop the advisory and read a known-vulnerable gem as clean, so an
+      # un-enriched key still contributes a minimal advisory (mirrors EcosystemLens;
+      # ruby-advisory-db then fills the score on merge when it also carries it).
+      deps_dev_vulns = advisory_keys.map { |id| DepsDevClient.advisory_detail(advisory_id: id) || { id: id, source: "deps.dev" } }
       radb_vulns = RubyAdvisoryDb.advisories_for(database: advisory_db, gem_name: gem_name, version: version)
       vulnerabilities = VulnerabilityHelper.merge_advisories(deps_dev: deps_dev_vulns, ruby_advisory_db: radb_vulns)
+      # Enrich with OSV: a real GHSA severity label (deps.dev can't score a CVSS-4-only
+      # advisory) and the fixed-version ranges the "capped below the fix" signal needs.
+      # Native path is rubygems.
+      OsvClient.enrich(vulnerabilities, ecosystem: :rubygems, name: gem_name)
       {
         scorecard_score: scorecard&.dig(:score),
+        scorecard_maintained: scorecard&.dig(:maintained),
         vulnerability_count: vulnerabilities.length,
         vulnerabilities: vulnerabilities,
       }
@@ -216,7 +401,14 @@ module StillActive
       end
     rescue Gems::NotFound
       []
-    rescue Errno::ECONNRESET, Errno::ECONNREFUSED, Net::OpenTimeout, Net::ReadTimeout, SocketError => e
+    # Gems::GemError is the `gems` library's catch-all for any non-success,
+    # non-404 response -- crucially a 429 rate-limit or a 5xx. Left unrescued it
+    # escapes to the per-gem rescue in #call and strips the gem of ALL its signals
+    # (not just versions), blaming a generic "error occurred". The poison-pill
+    # enrichment adds extra version lookups that make a 429 likelier, so a
+    # best-effort feature must not be able to degrade an unrelated gem's core data:
+    # degrade to "no versions known" here, exactly like Gems::NotFound.
+    rescue Gems::GemError, *HttpHelper::TRANSPORT_ERRORS => e
       $stderr.puts("warning: rubygems.org versions lookup failed for #{gem_name}: #{e.class} (#{e.message})")
       []
     end
@@ -342,7 +534,11 @@ module StillActive
     # assumption that every source supports every signal.
     def provider_for(source)
       case source
-      when :github then GithubClient
+      # Without a GitHub token, the live API caps at 60 req/hr -- unusable past a
+      # handful of gems. Fall back to ecosyste.ms (5000 anonymous) so a large
+      # Gemfile still resolves. With a token, the live API stays primary (freshest,
+      # and it carries commits_since_release, which ecosyste.ms doesn't).
+      when :github then StillActive.config.github_oauth_token ? GithubClient : EcosystemsClient
       when :gitlab then GitlabClient
       when :forgejo then ForgejoClient
       end

data/lib/still_active.rb

@@ -3,6 +3,9 @@
 require_relative "still_active/version"
 require_relative "still_active/errors"
 require_relative "still_active/config"
+require_relative "still_active/sbom_reader"
+require_relative "still_active/ecosystem_lens"
+require_relative "still_active/sbom_workflow"
 require_relative "still_active/cli"
 
 # Octokit depends on Faraday and emits a deprecation warning at load time

data/still_active.gemspec

@@ -8,17 +8,22 @@ Gem::Specification.new do |spec|
   spec.authors       = ["Sean Floyd"]
   spec.email         = ["contact@seanfloyd.dev"]
 
-  spec.summary       = "Audit your Ruby dependencies for maintenance health, outdated versions, vulnerabilities, and abandoned gems."
+  spec.summary       = "Audit your dependencies for maintenance health, abandonment, and below-the-fix vulnerabilities. " \
+    "Ruby gems natively; npm, PyPI, Cargo, Go, Maven, and NuGet via a CycloneDX SBOM."
   spec.description   = "Analyses your Gemfile.lock for dependency health across the full transitive graph: " \
     "whether each gem is actively maintained (last activity on GitHub, GitLab, or Codeberg/Forgejo, plus " \
     "release recency), outdated versions, archived repos, OpenSSF Scorecard scores, known vulnerabilities " \
-    "(deps.dev merged with ruby-advisory-db), and libyear drift. Ruby version freshness with EOL detection. " \
+    "(deps.dev and OSV, merged with ruby-advisory-db, flagging advisories with no fix and pins that sit below " \
+    "the fix), poison-pill compatibility ceilings, and libyear drift. Ruby version freshness with EOL detection. " \
+    "The same maintenance lens travels cross-ecosystem: point --sbom at a CycloneDX SBOM to assess npm, PyPI, " \
+    "Cargo, Go, Maven, and NuGet packages via deps.dev and ecosyste.ms. " \
     "Handles rubygems, git, path, GitHub Packages, and JFrog Artifactory sources. " \
     "Outputs coloured terminal tables, markdown, JSON (with a versioned, contract-tested schema), " \
     "SARIF for GitHub code scanning, and a CycloneDX SBOM. " \
-    "CI quality gates (--fail-if-critical / -warning / -vulnerable / -outdated) with granular, committed " \
-    "suppression via .still_active.yml. " \
-    "A comprehensive alternative to running bundle outdated, bundler-audit, and libyear-bundler separately."
+    "CI quality gates (--fail-if-critical / -warning / -vulnerable / -outdated / -poison / -language-ceiling) " \
+    "with granular, committed suppression via .still_active.yml. " \
+    "Complements bundle outdated, bundler-audit, and libyear-bundler by adding the maintenance signal they " \
+    "don't, and folds their version, CVE, and libyear checks into one report."
   spec.homepage      = "https://github.com/SeanLF/still_active"
   spec.license       = "MIT"
   spec.required_ruby_version = ">= 3.3.0"
@@ -26,6 +31,7 @@ Gem::Specification.new do |spec|
   spec.metadata["homepage_uri"] = spec.homepage
   spec.metadata["source_code_uri"] = spec.homepage
   spec.metadata["changelog_uri"] = "#{spec.homepage}/blob/main/CHANGELOG.md"
+  spec.metadata["documentation_uri"] = "#{spec.homepage}#readme"
   spec.metadata["bug_tracker_uri"] = "#{spec.homepage}/issues"
   spec.metadata["rubygems_mfa_required"] = "true"
 
@@ -53,7 +59,24 @@ Gem::Specification.new do |spec|
   # carry an artificial floor.
   spec.add_runtime_dependency("async", ">= 2.2")
   spec.add_runtime_dependency("bundler", ">= 2.0")
+  # cvss-suite (CVSS v4.0 base-score from an OSV vector, for the CVSS-4-only advisory
+  # deps.dev can't score) is an OPTIONAL dependency, NOT declared here: it exact-pins
+  # bundler and caps bigdecimal, the poison-pill pattern still_active flags, so we
+  # won't force it on users or trip our own audit. CvssHelper soft-requires it; absent,
+  # the OSV/GHSA severity label still carries gating + level and the number is skipped.
+  # Install cvss-suite (or run the distribution that bundles it) to light up the number.
   spec.add_runtime_dependency("faraday-retry")
   spec.add_runtime_dependency("gems")
   spec.add_runtime_dependency("octokit")
+  # Spec-compliant package-URL parsing for SBOM ingestion (decodes npm scopes,
+  # maven group:artifact, qualifiers). 0.1 is the verified floor; the official
+  # package-url org gem (vetted via still_active itself: maintained, no advisories).
+  spec.add_runtime_dependency("packageurl-ruby", ">= 0.1.0")
+  # node-semver range satisfaction for the npm/cargo below-the-fix signal: deciding
+  # whether a CVE's fixed version escapes a package's declared constraint needs
+  # PATCH precision (their fixes are mostly same-major patch bumps), and hand-rolling
+  # node-semver's prerelease + caret-on-0.x rules is the correctness minefield this
+  # composes away. Vetted via still_active itself: maintained (2026 release), MIT,
+  # zero runtime dependencies. cargo reuses it behind a bare-version->caret shim.
+  spec.add_runtime_dependency("semantic_range", ">= 3.0")
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: still_active
 version: !ruby/object:Gem::Version
-  version: 2.0.0
+  version: 3.0.0.rc2
 platform: ruby
 authors:
 - Sean Floyd
@@ -191,17 +191,49 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
+- !ruby/object:Gem::Dependency
+  name: packageurl-ruby
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.1.0
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.1.0
+- !ruby/object:Gem::Dependency
+  name: semantic_range
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '3.0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '3.0'
 description: 'Analyses your Gemfile.lock for dependency health across the full transitive
   graph: whether each gem is actively maintained (last activity on GitHub, GitLab,
   or Codeberg/Forgejo, plus release recency), outdated versions, archived repos, OpenSSF
-  Scorecard scores, known vulnerabilities (deps.dev merged with ruby-advisory-db),
-  and libyear drift. Ruby version freshness with EOL detection. Handles rubygems,
-  git, path, GitHub Packages, and JFrog Artifactory sources. Outputs coloured terminal
-  tables, markdown, JSON (with a versioned, contract-tested schema), SARIF for GitHub
-  code scanning, and a CycloneDX SBOM. CI quality gates (--fail-if-critical / -warning
-  / -vulnerable / -outdated) with granular, committed suppression via .still_active.yml.
-  A comprehensive alternative to running bundle outdated, bundler-audit, and libyear-bundler
-  separately.'
+  Scorecard scores, known vulnerabilities (deps.dev and OSV, merged with ruby-advisory-db,
+  flagging advisories with no fix and pins that sit below the fix), poison-pill compatibility
+  ceilings, and libyear drift. Ruby version freshness with EOL detection. The same
+  maintenance lens travels cross-ecosystem: point --sbom at a CycloneDX SBOM to assess
+  npm, PyPI, Cargo, Go, Maven, and NuGet packages via deps.dev and ecosyste.ms. Handles
+  rubygems, git, path, GitHub Packages, and JFrog Artifactory sources. Outputs coloured
+  terminal tables, markdown, JSON (with a versioned, contract-tested schema), SARIF
+  for GitHub code scanning, and a CycloneDX SBOM. CI quality gates (--fail-if-critical
+  / -warning / -vulnerable / -outdated / -poison / -language-ceiling) with granular,
+  committed suppression via .still_active.yml. Complements bundle outdated, bundler-audit,
+  and libyear-bundler by adding the maintenance signal they don''t, and folds their
+  version, CVE, and libyear checks into one report.'
 email:
 - contact@seanfloyd.dev
 executables:
@@ -219,37 +251,53 @@ files:
 - lib/helpers/bot_context.rb
 - lib/helpers/bundler_helper.rb
 - lib/helpers/catalog_index.rb
+- lib/helpers/constraint_helper.rb
+- lib/helpers/cvss_helper.rb
 - lib/helpers/cyclonedx_helper.rb
 - lib/helpers/diff_markdown_helper.rb
 - lib/helpers/emoji_helper.rb
+- lib/helpers/endoflife_helper.rb
 - lib/helpers/http_helper.rb
 - lib/helpers/libyear_helper.rb
 - lib/helpers/lockfile_dependency_parser.rb
 - lib/helpers/lockfile_indexer.rb
 - lib/helpers/markdown_escape.rb
 - lib/helpers/markdown_helper.rb
+- lib/helpers/pep440_helper.rb
+- lib/helpers/python_helper.rb
 - lib/helpers/ruby_advisory_db.rb
 - lib/helpers/ruby_helper.rb
+- lib/helpers/runtime_ceiling_helper.rb
 - lib/helpers/sarif_helper.rb
+- lib/helpers/semver_satisfaction.rb
+- lib/helpers/status_helper.rb
 - lib/helpers/summary_helper.rb
 - lib/helpers/terminal_helper.rb
 - lib/helpers/version_helper.rb
 - lib/helpers/vulnerability_helper.rb
 - lib/still_active.rb
 - lib/still_active/artifactory_client.rb
+- lib/still_active/ceiling_reconciler.rb
 - lib/still_active/cli.rb
 - lib/still_active/config.rb
 - lib/still_active/config_file.rb
 - lib/still_active/core_ext.rb
 - lib/still_active/deps_dev_client.rb
 - lib/still_active/diff.rb
+- lib/still_active/ecosystem_lens.rb
+- lib/still_active/ecosystems_client.rb
 - lib/still_active/errors.rb
 - lib/still_active/forgejo_client.rb
 - lib/still_active/github_client.rb
 - lib/still_active/gitlab_client.rb
 - lib/still_active/options.rb
+- lib/still_active/osv_client.rb
+- lib/still_active/poison_security_correlator.rb
+- lib/still_active/pypi_client.rb
 - lib/still_active/repository.rb
 - lib/still_active/sarif/rules.rb
+- lib/still_active/sbom_reader.rb
+- lib/still_active/sbom_workflow.rb
 - lib/still_active/suppressions.rb
 - lib/still_active/version.rb
 - lib/still_active/workflow.rb
@@ -261,6 +309,7 @@ metadata:
   homepage_uri: https://github.com/SeanLF/still_active
   source_code_uri: https://github.com/SeanLF/still_active
   changelog_uri: https://github.com/SeanLF/still_active/blob/main/CHANGELOG.md
+  documentation_uri: https://github.com/SeanLF/still_active#readme
   bug_tracker_uri: https://github.com/SeanLF/still_active/issues
   rubygems_mfa_required: 'true'
 rdoc_options: []
@@ -279,6 +328,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
 requirements: []
 rubygems_version: 4.0.10
 specification_version: 4
-summary: Audit your Ruby dependencies for maintenance health, outdated versions, vulnerabilities,
-  and abandoned gems.
+summary: Audit your dependencies for maintenance health, abandonment, and below-the-fix
+  vulnerabilities. Ruby gems natively; npm, PyPI, Cargo, Go, Maven, and NuGet via
+  a CycloneDX SBOM.
 test_files: []