still_active 3.0.0.rc1 → 3.0.0.rc3

data/lib/helpers/dependency_helper.rb

@@ -0,0 +1,20 @@
+# frozen_string_literal: true
+
+module StillActive
+  # The canonical identity of an assessed dependency, shared by every renderer
+  # (terminal/markdown/SARIF display) and by the suppression matchers (--ignore
+  # and .still_active.yml).
+  module DependencyHelper
+    extend self
+
+    # A cross-ecosystem SBOM dependency is "ecosystem/name" (the lens sets
+    # :ecosystem and :name); a native gem is its bare name (the hash key), where
+    # gem_data carries no :ecosystem. Deliberately version-independent: it is NOT
+    # the composite "ecosystem/name@version" hash key, so one suppression covers a
+    # dependency across version bumps and matches the same identity the poison /
+    # ceiling correlators key on.
+    def identity(name, data)
+      data[:ecosystem] ? "#{data[:ecosystem]}/#{data[:name]}" : name
+    end
+  end
+end

data/lib/helpers/dotnet_helper.rb

@@ -0,0 +1,142 @@
+# frozen_string_literal: true
+
+require_relative "constraint_helper"
+require_relative "endoflife_helper"
+
+module StillActive
+  # The NuGet calibration layer for the language-runtime ceiling (SA009), the
+  # .NET sibling of RubyHelper/PythonHelper. NuGet is shaped differently from
+  # Ruby/Python: a package declares not one version RANGE but a SET of target
+  # framework monikers (net6.0, netcoreapp3.1, net48, netstandard2.0). Targeting a
+  # framework is an enforced restore-time wall (NuGet error NU1202), so if EVERY
+  # concrete runtime the package targets is end-of-life, consuming it forces your
+  # project onto a dead runtime -- the same "no supported runtime is reachable"
+  # cap the Ruby/Python ceiling catches, expressed as a set rather than a range.
+  #
+  # The honesty rule is the netstandard exclusion: `netstandard*` is a
+  # compatibility contract consumable FROM a modern .NET, not a runtime, so it
+  # imposes no ceiling. Without excluding it the signal would fire on nearly every
+  # modern library. We therefore fire only when the package has at least one
+  # concrete runtime target AND every concrete runtime target is EOL.
+  module DotnetHelper
+    extend self
+
+    # The two .NET runtime calendars, fetched once per SBOM. .NET Core/5+ is a
+    # single unified endoflife feed; .NET Framework 4.x is its own (`dotnetfx`),
+    # with a different EOL schedule tied to Windows servicing.
+    def supported_dotnet_range = EndoflifeHelper.support_window(feed_path: "/api/dotnet.json")
+    def supported_dotnetfx_range = EndoflifeHelper.support_window(feed_path: "/api/dotnetfx.json")
+
+    # A target framework moniker -> { family: :dotnet | :dotnetfx, version: } (the
+    # runtime it names and the endoflife.date cycle to look it up by), or nil when
+    # the moniker is not a concrete runtime (netstandard, or unrecognized -- we
+    # never guess). Tolerates deps.dev's short form (net45, netcoreapp3.1), its
+    # long form (.NETFramework4.5), platform suffixes (net6.0-windows), and case.
+    def classify(moniker)
+      return if moniker.nil?
+
+      m = moniker.to_s.strip.downcase
+      return if m.empty?
+
+      # Drop a platform suffix (net6.0-windows -> net6.0) and the long-form dot.
+      dash = m.index("-")
+      m = m[0, dash] if dash
+      m = m.delete_prefix(".")
+
+      return if m.start_with?("netstandard") # a compatibility contract, not a runtime
+
+      # Ordered, mutually-exclusive prefixes; the load-bearing distinction is the
+      # dot: a dotted "netX.Y" is .NET 5+ (major cycle), a dot-less "netXY" is .NET
+      # Framework (digits expand to the cycle).
+      if m.start_with?("netcoreapp")
+        dotnet(m.delete_prefix("netcoreapp")) # netcoreapp3.1 -> .NET "3.1" (minor kept)
+      elsif m.start_with?("netframework")
+        dotnetfx(m.delete_prefix("netframework"))    # long form: .NETFramework4.7.2
+      elsif m.start_with?("net")
+        rest = m.delete_prefix("net")
+        if rest.include?(".")
+          dotnet(rest.split(".").first)              # net6.0 -> .NET "6" (major only)
+        elsif all_digits?(rest)
+          dotnetfx(expand_framework_digits(rest))    # net48 -> .NET Framework "4.8"
+        end
+      end
+    end
+
+    # Whether a moniker is a netstandard target (tolerating the long-form ".NETStandard"
+    # and platform/case variants) -- the escape hatch analyze must honour.
+    def netstandard?(moniker)
+      return false if moniker.nil?
+
+      moniker.to_s.strip.downcase.delete_prefix(".").start_with?("netstandard")
+    end
+
+    # => the SA009 eol_forced finding hash, or nil when the package is not capped.
+    # `dotnet` / `dotnetfx` are EndoflifeHelper.support_window results (or nil when
+    # the feed is down); only their :cycles list is read.
+    def analyze(target_frameworks:, dotnet:, dotnetfx:)
+      monikers = Array(target_frameworks)
+      # THE honesty rule: a netstandard target is a compatibility contract
+      # consumable from a current .NET, so its mere presence is an escape hatch --
+      # the package is not capped, whatever else it targets. Without this the signal
+      # fires on nearly every modern .NET library (Newtonsoft.Json, EF Core, ...),
+      # which all ship a netstandard2.0 target alongside older concrete runtimes.
+      return if monikers.any? { |moniker| netstandard?(moniker) }
+
+      runtimes = monikers.filter_map do |moniker|
+        classification = classify(moniker)
+        classification&.merge(moniker: moniker, cycle: cycle_for(classification, dotnet: dotnet, dotnetfx: dotnetfx))
+      end
+      return if runtimes.empty?
+
+      # A still-supported runtime target is a clear escape hatch: not capped.
+      return if runtimes.any? { |r| r[:cycle] && r[:cycle][:eol] == false }
+
+      eol = runtimes.select { |r| r[:cycle] && r[:cycle][:eol] == true }
+      return if eol.empty? # nothing KNOWN-EOL: don't fabricate a ceiling from unknown cycles
+
+      # The longest-lived dead runtime is the best the package offers -- the ceiling.
+      ceiling = eol.max_by { |r| r[:cycle][:eol_date] || Time.at(0) }
+      finding = {
+        requirement: runtimes.map { |r| r[:moniker] }.uniq.sort.join(", "),
+        eol_forced: true,
+        runtime: ceiling[:family] == :dotnetfx ? ".NET Framework" : ".NET",
+        ceiling_version: ceiling[:version].to_s,
+        ceiling_eol_date: ceiling[:cycle][:eol_date],
+      }
+      finding.merge(severity: ConstraintHelper.constraint_severity(finding))
+    end
+
+    private
+
+    # "461" -> "4.6.1", "48" -> "4.8", "45" -> "4.5": first digit is the major, each
+    # remaining digit a further segment. Only called on an all-digit remainder.
+    def expand_framework_digits(digits) = ([digits[0]] + digits[1..].chars).join(".")
+
+    def all_digits?(str)
+      !str.empty? && str.chars.all? { |c| ("0".."9").cover?(c) }
+    end
+
+    def dotnet(version) = build(:dotnet, version)
+    def dotnetfx(version) = build(:dotnetfx, version)
+
+    def build(family, version)
+      return unless version && Gem::Version.correct?(version)
+
+      { family: family, version: Gem::Version.new(version) }
+    end
+
+    # The endoflife cycle for a classified target, or nil when the feed is down or
+    # the cycle isn't tracked (an ancient net20 predating the feed) -- unknown, not
+    # assumed EOL.
+    def cycle_for(classification, dotnet:, dotnetfx:)
+      window = classification[:family] == :dotnetfx ? dotnetfx : dotnet
+      return if window.nil?
+
+      # Match on the release segment, ignoring any prerelease suffix: endoflife
+      # keys .NET Framework 3.5 as "3.5-sp1", so net35 ("3.5") must still match it
+      # (otherwise a still-supported target reads as unknown and can false-fire).
+      target = classification[:version].release
+      window[:cycles].find { |cycle| cycle[:version].release == target }
+    end
+  end
+end

data/lib/helpers/markdown_helper.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require_relative "markdown_escape"
+require_relative "dependency_helper"
 require_relative "vulnerability_helper"
 require_relative "activity_helper"
 require_relative "constraint_helper"
@@ -40,7 +41,7 @@ module StillActive
       inactive_repository_emoji = data[:last_activity_warning_emoji]
       using_latest_version_emoji = data[:up_to_date_emoji]
 
-      formatted_name = markdown_url(text: gem_name, url: repository_url)
+      formatted_name = markdown_url(text: DependencyHelper.identity(gem_name, data), url: repository_url)
 
       formatted_version_used = if [:git, :path].include?(data[:source_type])
         data[:version_used] ? "#{data[:version_used]} (#{data[:source_type]})" : "(#{data[:source_type]})"
@@ -66,7 +67,11 @@ module StillActive
         date: data[:latest_pre_release_version_release_date],
       )
 
-      formatted_last_commit = markdown_url(text: year_month(data[:last_commit_date]), url: repository_url)
+      # Only link when there is a date: markdown_url with a nil date + a present
+      # repo returns "[](url)" (an invisible link, and truthy, so the `|| unsure`
+      # fallback below never fires). Guard here so a missing date shows unsure.
+      last_commit_ym = year_month(data[:last_commit_date])
+      formatted_last_commit = markdown_url(text: last_commit_ym, url: repository_url) if last_commit_ym
 
       unsure = StillActive.config.unsure_emoji
 
@@ -179,7 +184,7 @@ module StillActive
       ranked = flagged.sort_by { |name, data| [-ConstraintHelper::SEVERITY.index(data[:language_ceiling][:severity] || :note), name.to_s] }
       ranked.each do |name, data|
         ceiling = data[:language_ceiling]
-        lines << "- **#{ceiling[:severity] || :note}** #{MarkdownEscape.code_span(name)} #{language_ceiling_receipt(ceiling, data)}"
+        lines << "- **#{ceiling[:severity] || :note}** #{MarkdownEscape.code_span(DependencyHelper.identity(name, data))} #{language_ceiling_receipt(ceiling, data)}"
       end
       lines.join("\n")
     end
@@ -202,7 +207,7 @@ module StillActive
     end
 
     def poison_gem_ref(name, data)
-      ref = MarkdownEscape.code_span(name)
+      ref = MarkdownEscape.code_span(DependencyHelper.identity(name, data))
       path = data[:dependency_path]
       # Transitive pill: name the direct parent the user can actually act on (#60).
       return ref unless data[:direct] == false && Array(path).length >= 2
@@ -290,10 +295,14 @@ module StillActive
       "[#{safe_text}](#{MarkdownEscape.url(url)})"
     end
 
-    def year_month(time_object)
-      return if time_object.nil?
+    # The native Ruby path stores dates as Time; the cross-ecosystem lens carries
+    # deps.dev's raw ISO8601 strings. Parse either (nil-safe) rather than assuming
+    # Time, so an SBOM audit renders dates instead of crashing on String#strftime.
+    def year_month(value)
+      time = ActivityHelper.parse_time(value)
+      return if time.nil?
 
-      time_object.strftime("%Y/%m")
+      time.strftime("%Y/%m")
     end
   end
 end

data/lib/helpers/sarif_helper.rb

@@ -6,6 +6,7 @@ require "time"
 require_relative "../still_active/sarif/rules"
 require_relative "lockfile_indexer"
 require_relative "activity_helper"
+require_relative "dependency_helper"
 require_relative "constraint_helper"
 
 module StillActive
@@ -44,6 +45,27 @@ module StillActive
       JSON.pretty_generate(document(results: results, tool_version: tool_version))
     end
 
+    # The SBOM path emits the same rule set and document, but there is no lockfile
+    # to annotate: every finding anchors to the SBOM file itself (line 1), and
+    # ruby_info is nil (Ruby EOL / SA006 is a native-only signal). Findings are
+    # named ecosystem/name (each gem_data carries :ecosystem and :name), so a
+    # cross-ecosystem alert reads "npm/left-pad ..." rather than a bare gem name.
+    #
+    # result: SbomWorkflow assessed hash ("ecosystem/name@version" => gem_data)
+    # source_uri: the SBOM file to point findings at (basename)
+    # tool_version: StillActive::VERSION at emit time
+    def render_sbom(result:, source_uri:, tool_version:)
+      results = build_results(
+        report: result,
+        ruby_info: nil,
+        line_index: {},
+        ruby_line: nil,
+        lockfile_uri: source_uri,
+      )
+
+      JSON.pretty_generate(document(results: results, tool_version: tool_version))
+    end
+
     private
 
     def document(results:, tool_version:)
@@ -94,13 +116,21 @@ module StillActive
       results
     end
 
+    # `name` is the hash key: the bare gem name natively, the composite
+    # "ecosystem/name@version" on the SBOM path. It drives the fingerprint and
+    # location, both of which MUST stay version-distinct so two pinned versions of
+    # one package (a merged monorepo SBOM) never collapse into a single Code
+    # Scanning alert. `display` is the version-independent "ecosystem/name" (bare
+    # name natively): what the message shows and what a --ignore/.still_active.yml
+    # suppression names, so one suppression covers a dependency across versions.
     def gem_results(name, data, line_index, lockfile_uri)
       out = []
       version = data[:version_used]
+      display = DependencyHelper.identity(name, data)
       location = location_for(name, line_index, lockfile_uri)
 
       if data[:archived]
-        out << mark_suppressed(result("SA001", name, "#{name} #{version}: upstream repository is archived#{repo_suffix(data)}#{alternatives_suffix(data)}#{transitive_suffix(data)}.", location), name, :activity)
+        out << mark_suppressed(result("SA001", name, "#{display} #{version}: upstream repository is archived#{repo_suffix(data)}#{alternatives_suffix(data)}#{transitive_suffix(data)}.", location), display, :activity)
       end
 
       unless data[:archived]
@@ -112,10 +142,10 @@ module StillActive
             result(
               "SA002",
               name,
-              "#{name} #{version}: #{noun} in #{years} years (last #{activity[:date].utc.strftime("%Y-%m-%d")})#{alternatives_suffix(data)}#{transitive_suffix(data)}.",
+              "#{display} #{version}: #{noun} in #{years} years (last #{activity[:date].utc.strftime("%Y-%m-%d")})#{alternatives_suffix(data)}#{transitive_suffix(data)}.",
               location,
             ),
-            name,
+            display,
             :activity,
           )
         end
@@ -127,15 +157,15 @@ module StillActive
 
       if data[:libyear] && data[:libyear] > LIBYEAR_THRESHOLD
         latest = data[:latest_version] ? " behind #{data[:latest_version]}" : ""
-        out << mark_suppressed(result("SA004", name, "#{name} #{version}: #{data[:libyear]} libyears#{latest}#{transitive_suffix(data)}.", location), name, :libyear)
+        out << mark_suppressed(result("SA004", name, "#{display} #{version}: #{data[:libyear]} libyears#{latest}#{transitive_suffix(data)}.", location), display, :libyear)
       end
 
       if data[:scorecard_score] && data[:scorecard_score] < SCORECARD_LOW_THRESHOLD
-        out << mark_suppressed(result("SA005", name, "#{name} #{version}: OpenSSF Scorecard #{data[:scorecard_score]}/10 (low).", location), name, :scorecard)
+        out << mark_suppressed(result("SA005", name, "#{display} #{version}: OpenSSF Scorecard #{data[:scorecard_score]}/10 (low).", location), display, :scorecard)
       end
 
       if data[:version_yanked]
-        out << mark_suppressed(result("SA007", name, "#{name} #{version}: this version has been yanked from RubyGems.", location), name, :yanked)
+        out << mark_suppressed(result("SA007", name, "#{display} #{version}: this version has been yanked from RubyGems.", location), display, :yanked)
       end
 
       if data[:poison] && !Array(data[:constraints]).empty?
@@ -151,7 +181,7 @@ module StillActive
         else
           "maintenance"
         end
-        out << mark_suppressed(result("SA008", name, poison_message(name, version, data), location, level: poison_level(data), fp_extra: state), name, :poison)
+        out << mark_suppressed(result("SA008", name, poison_message(display, version, data), location, level: poison_level(data), fp_extra: state), display, :poison)
       end
 
       if data[:language_ceiling]
@@ -163,7 +193,7 @@ module StillActive
         # silently mute the critical -- that transition is exactly the one a human
         # must see.
         state = data[:language_ceiling][:eol_forced] ? "eol_forced" : "latest_not_yet"
-        out << mark_suppressed(result("SA009", name, language_ceiling_message(name, version, data), location, level: language_ceiling_level(data), fp_extra: state), name, :language_ceiling)
+        out << mark_suppressed(result("SA009", name, language_ceiling_message(display, version, data), location, level: language_ceiling_level(data), fp_extra: state), display, :language_ceiling)
       end
 
       out
@@ -173,7 +203,7 @@ module StillActive
       { critical: "error", warning: "warning", note: "note" }.fetch(data[:language_ceiling][:severity], "note")
     end
 
-    def language_ceiling_message(name, version, data)
+    def language_ceiling_message(display, version, data)
       ceiling = data[:language_ceiling]
       runtime = ceiling[:runtime]
       body =
@@ -185,7 +215,7 @@ module StillActive
           "no #{runtime} #{ceiling[:latest_stable]} support yet"
         end
       fix = ceiling[:fixed_by_upgrade] && data[:latest_version] ? "; upgrade to #{data[:latest_version]} to lift it" : ""
-      "#{name} #{version}: requires #{runtime} #{ceiling[:requirement]}, #{body}#{fix}#{transitive_suffix(data)}."
+      "#{display} #{version}: requires #{runtime} #{ceiling[:requirement]}, #{body}#{fix}#{transitive_suffix(data)}."
     end
 
     # The poison receipt for a Code Scanning alert: the worst 3 caps (shared
@@ -203,7 +233,7 @@ module StillActive
       { critical: "error", warning: "warning", note: "note" }.fetch(data[:poison_severity], "warning")
     end
 
-    def poison_message(name, version, data)
+    def poison_message(display, version, data)
       top = ConstraintHelper.top_findings(Array(data[:constraints]), limit: 3)
       caps = top[:shown].map do |finding|
         behind = finding[:majors_behind]
@@ -211,7 +241,7 @@ module StillActive
       end
       remaining = top[:total] - top[:shown].length
       caps << "+#{remaining} more" if remaining.positive?
-      "#{name} #{version}: caps #{caps.join("; ")}#{transitive_suffix(data)}#{poison_security_note(data)}."
+      "#{display} #{version}: caps #{caps.join("; ")}#{transitive_suffix(data)}#{poison_security_note(data)}."
     end
 
     # Spells out the security escalation for a code-scanning alert. Only claims
@@ -254,6 +284,10 @@ module StillActive
     end
 
     def vulnerability_result(name, version, vuln, location, data = {})
+      # `name` (the version-distinct hash key) fingerprints the finding; `display`
+      # (version-independent "ecosystem/name") is what the message shows and the
+      # suppression matches. See gem_results for why the two differ.
+      display = DependencyHelper.identity(name, data)
       # Level tracks the resolved severity LABEL (a real CVSS score OR OSV's GHSA
       # label), so a CVSS-4-only HIGH -- which deps.dev returns as cvss3Score 0 --
       # exports as error, not a note/warning a code-scanning gate reads as
@@ -274,13 +308,13 @@ module StillActive
       base = result(
         "SA003",
         name,
-        "#{name} #{version}: #{advisory_id}#{title}#{alias_suffix}#{no_fix}#{transitive_suffix(data)}.",
+        "#{display} #{version}: #{advisory_id}#{title}#{alias_suffix}#{no_fix}#{transitive_suffix(data)}.",
         location,
         level: level,
         fp_extra: advisory_id,
       )
       base["properties"] = { "security-severity" => severity } if severity
-      mark_suppressed(base, name, :vulnerability, advisory: vuln[:id], aliases: Array(vuln[:aliases]))
+      mark_suppressed(base, display, :vulnerability, advisory: vuln[:id], aliases: Array(vuln[:aliases]))
     end
 
     # Names the direct dependency a transitive flagged gem rides in on, so a

data/lib/helpers/terminal_helper.rb

@@ -3,6 +3,7 @@
 require_relative "activity_helper"
 require_relative "ansi_helper"
 require_relative "constraint_helper"
+require_relative "dependency_helper"
 require_relative "summary_helper"
 require_relative "libyear_helper"
 require_relative "version_helper"
@@ -34,9 +35,16 @@ module StillActive
 
     private
 
+    # "dependencies" for a cross-ecosystem SBOM audit (the lens sets :ecosystem),
+    # "gems" for a native Ruby audit -- calling npm/cargo/go packages "gems" is a
+    # Ruby-ism that reads wrong cross-ecosystem.
+    def dependency_noun(result)
+      result.each_value.any? { |data| data[:ecosystem] } ? "dependencies" : "gems"
+    end
+
     def build_row(name, data)
       [
-        name,
+        DependencyHelper.identity(name, data),
         format_version(data),
         format_activity(data),
         format_scorecard(data[:scorecard_score]),
@@ -64,9 +72,15 @@ module StillActive
       return AnsiHelper.dim("-") if used.nil? && latest.nil?
       return AnsiHelper.red("#{used} (YANKED)") if data[:version_yanked]
 
-      if VersionHelper.up_to_date(version_used: used, latest_version: latest)
+      # up_to_date is tri-state: true (on latest), false (genuinely behind), or nil
+      # (a version Gem::Version can't parse -- a pypi epoch, an exotic build string).
+      # Only paint the "-> latest" upgrade arrow on a definite false; a nil means we
+      # couldn't compare, so show the version plainly rather than a false "behind"
+      # (markdown shows unsure via its emoji tri-state for the same case).
+      current = VersionHelper.up_to_date(version_used: used, latest_version: latest)
+      if current
         AnsiHelper.green("#{used} (latest)")
-      elsif latest
+      elsif current == false && latest
         AnsiHelper.yellow("#{used} → #{latest}")
       else
         used.to_s
@@ -318,7 +332,7 @@ module StillActive
       archived = summary[:activity][:archived]
       yanked = result.each_value.count { |d| d[:version_yanked] }
 
-      parts = ["#{summary[:total_gems]} gems: #{summary[:up_to_date]} up to date, #{summary[:outdated]} outdated"]
+      parts = ["#{summary[:total_gems]} #{dependency_noun(result)}: #{summary[:up_to_date]} up to date, #{summary[:outdated]} outdated"]
       parts.last << ", #{yanked} yanked" if yanked > 0
       activity = "#{active} active, #{stale} stale"
       activity << ", #{archived} archived" if archived > 0

data/lib/helpers/version_helper.rb

@@ -22,6 +22,24 @@ module StillActive
       end
     end
 
+    # The latest pre-release is only a useful signal when it is newer than the
+    # latest stable release: an upcoming version you could opt into. A pre-release
+    # that predates the latest stable is historical noise (e.g. a lone 2009 `rc`
+    # on a gem now at 0.9.x, or an `8.1.0.rc1` after `8.1.2` already shipped), and
+    # it silently corrupts downstream logic: up_to_date compares `used >=`
+    # latest_pre_release, so any current version reads `>=` a stale pre-release and
+    # a behind gem is painted up to date (the futurist emoji). Returns the
+    # pre-release only when strictly newer than the release; keeps it when there is
+    # no stable release at all (a pre-release-only gem), where it is the only signal.
+    def upcoming_pre_release(pre_release:, release:)
+      return pre_release if release.nil?
+      return if pre_release.nil?
+
+      pre = to_gem_version(pre_release)
+      stable = to_gem_version(release)
+      pre_release if pre && stable && pre > stable
+    end
+
     def up_to_date(version_used:, latest_version: nil, latest_pre_release_version: nil)
       return if latest_version.nil? && latest_pre_release_version.nil?
 
@@ -34,6 +52,14 @@ module StillActive
         .any? { |v| used >= v }
     end
 
+    # A Gem::Version for cross-ecosystem comparison (leading "v" and SemVer build
+    # metadata normalized away), or nil when the string can't be parsed. Public so
+    # the deps.dev client can rank a package's versions to find the real latest
+    # stable rather than trusting deps.dev's unreliable `isDefault` flag.
+    def comparable(version_string)
+      to_gem_version(version_string)
+    end
+
     def gem_version(version_hash:)
       version_hash&.dig("number")
     end
@@ -70,7 +96,20 @@ module StillActive
 
     def to_gem_version(version)
       str = normalize_version(version)
-      Gem::Version.new(str) if str && Gem::Version.correct?(str)
+      return unless str
+
+      # Normalize two cross-ecosystem shapes Gem::Version can't parse, so a
+      # current dependency compares as up to date instead of reading "behind":
+      #   - a leading "v" (Go module versions, "v2.0.1")
+      #   - SemVer build metadata (cargo's "1.0.4+wasi-0.2.12"), everything from the
+      #     first "+", which SemVer 2.0.0 sec 10 says MUST be ignored for precedence
+      # rubygems/npm/pypi versions are digit-first with no "+", so this is a no-op.
+      # Sliced by index rather than a regex (/\+.*/ on the external version string
+      # trips a polynomial-ReDoS scanner, and this is provably linear anyway).
+      str = str.delete_prefix("v")
+      plus = str.index("+")
+      str = str[0, plus] if plus
+      Gem::Version.new(str) if Gem::Version.correct?(str)
     end
   end
 end

data/lib/still_active/cli.rb

@@ -8,6 +8,7 @@ require_relative "../helpers/bot_context"
 require_relative "../helpers/bundler_helper"
 require_relative "../helpers/constraint_helper"
 require_relative "../helpers/cyclonedx_helper"
+require_relative "../helpers/dependency_helper"
 require_relative "../helpers/diff_markdown_helper"
 require_relative "../helpers/emoji_helper"
 require_relative "../helpers/markdown_helper"
@@ -140,11 +141,58 @@ module StillActive
       # assessment-time failure (a raised lens call) both mean "not assessed":
       # surface them together so neither is a silent hole in the reported coverage.
       unassessable = sbom.unassessable + outcome.failures
-      emit_sbom_json(outcome.assessed, unassessable)
+      render_sbom_output(outcome.assessed, unassessable, path)
       warn_unassessable(unassessable)
       check_exit_status(outcome.assessed)
     end
 
+    # The assessment is the same per-dependency shape whether the input was a
+    # Gemfile or an SBOM, so the SBOM path honours the same output-format flags
+    # rather than forcing JSON. SARIF and markdown are the two that matter for the
+    # cross-ecosystem/CI use case; JSON stays the piped default. Two formats need
+    # the native Ruby audit's shape (a lockfile to annotate for SARIF's line
+    # numbers, a gems/ruby snapshot for the diff), which a cross-ecosystem SBOM
+    # can't honestly supply, so they error loudly rather than silently falling
+    # back to JSON: --baseline (diff) and --cyclonedx (SBOM in, SBOM out would
+    # need per-ecosystem PURL reconstruction; the honest way to add it later is to
+    # thread the input SBOM's own PURLs through rather than rebuild them).
+    def render_sbom_output(result, unassessable, sbom_path)
+      config = StillActive.config
+      if config.baseline_path
+        unsupported_sbom_format!("--baseline")
+      elsif config.cyclonedx_path
+        unsupported_sbom_format!("--cyclonedx")
+      elsif config.sarif_path
+        emit_sbom_sarif(result, config.sarif_path, sbom_path)
+      else
+        case resolve_format
+        when :json then emit_sbom_json(result, unassessable)
+        when :terminal then puts TerminalHelper.render(result)
+        when :markdown then render_markdown(result)
+        end
+      end
+    end
+
+    def unsupported_sbom_format!(flag)
+      $stderr.puts("error: #{flag} output is not supported in --sbom mode (it needs the native Ruby audit's lockfile/snapshot, which a cross-ecosystem SBOM can't supply); use --sarif, --markdown, --terminal, or --json")
+      exit(2)
+    end
+
+    def emit_sbom_sarif(result, sarif_path, sbom_path)
+      sarif_json = SarifHelper.render_sbom(
+        result: result,
+        source_uri: File.basename(sbom_path),
+        tool_version: StillActive::VERSION,
+      )
+
+      write_output(sarif_path, sarif_json)
+    end
+
+    # "-" means stdout (the SARIF/CycloneDX convention); any other PATH is a file.
+    def write_output(path, content)
+      path == "-" ? puts(content) : File.write(path, content)
+    end
+
     # SbomReader never raises (a malformed file degrades to an empty result), which
     # is right for the library entrypoint but wrong for the explicit --sbom flag:
     # the user pointed at a file to audit, so a truncated/wrong-format one must
@@ -271,11 +319,7 @@ module StillActive
         tool_version: StillActive::VERSION,
       )
 
-      if sarif_path == "-"
-        puts sarif_json
-      else
-        File.write(sarif_path, sarif_json)
-      end
+      write_output(sarif_path, sarif_json)
     end
 
     def emit_cyclonedx(result, ruby_info, cyclonedx_path)
@@ -286,11 +330,7 @@ module StillActive
         spec_version: StillActive.config.cyclonedx_version,
       )
 
-      if cyclonedx_path == "-"
-        puts sbom
-      else
-        File.write(cyclonedx_path, sbom)
-      end
+      write_output(cyclonedx_path, sbom)
     end
 
     # Mirrors Bundler's convention: gems.rb -> gems.locked, otherwise <gemfile>.lock.
@@ -394,7 +434,10 @@ module StillActive
       return unless config.fail_if_critical || config.fail_if_warning || config.fail_if_vulnerable || config.fail_if_outdated || config.fail_if_poison || config.fail_if_language_ceiling
 
       warn_unknown_severity_gate(result, config)
-      exit(1) if result.any? { |name, data| gate_failed?(name, data, config) }
+      # Match the gate on the dependency's identity (bare gem name natively,
+      # "ecosystem/name" for an SBOM dep), not the composite SBOM hash key, so an
+      # --ignore/.still_active.yml entry actually covers a cross-ecosystem finding.
+      exit(1) if result.any? { |name, data| gate_failed?(DependencyHelper.identity(name, data), data, config) }
     end
 
     # --fail-if-vulnerable=<threshold> fails closed on an advisory with no CVSS
@@ -409,14 +452,15 @@ module StillActive
 
       suppressions = config.suppressions
       result.each do |name, data|
-        next if config.ignored_gems.include?(name)
+        gem = DependencyHelper.identity(name, data)
+        next if config.ignored_gems.include?(gem)
 
-        unknown = live_advisories(name, data, suppressions).select { |vuln| VulnerabilityHelper.unknown_severity?(vuln) }
+        unknown = live_advisories(gem, data, suppressions).select { |vuln| VulnerabilityHelper.unknown_severity?(vuln) }
         next if unknown.empty?
 
         ids = unknown.filter_map { |vuln| vuln[:id] }.join(", ")
         labelled = ids.empty? ? "" : " (#{ids})"
-        $stderr.puts("warning: #{name} has an advisory of unknown severity#{labelled}; failing --fail-if-vulnerable=#{threshold} because it can't be ruled out below the threshold (review, then fix or suppress it in .still_active.yml)")
+        $stderr.puts("warning: #{gem} has an advisory of unknown severity#{labelled}; failing --fail-if-vulnerable=#{threshold} because it can't be ruled out below the threshold (review, then fix or suppress it in .still_active.yml)")
       end
     end