still_active 3.0.0.rc1 → 3.0.0.rc3

data/lib/still_active/deps_dev_client.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require_relative "../helpers/http_helper"
+require_relative "../helpers/version_helper"
 
 module StillActive
   module DepsDevClient
@@ -61,12 +62,36 @@ module StillActive
       versions = body["versions"]
       return unless versions.is_a?(Array) && !versions.empty?
 
-      entry = versions.find { |v| v.is_a?(Hash) && v["isDefault"] } || newest_version(versions)
+      # deps.dev's `isDefault` is NOT reliably the latest release: cargo/wasi flags
+      # 0.7.0 (2019) while 0.14.7 (2025) ships, and pypi/httpx flags a 1.0.0.dev3
+      # prerelease over the 0.28.1 stable. Trusting it reads an active package as
+      # years-stale (a false SA002 "abandoned") and paints a downgrade as an
+      # upgrade. So rank by version and take the newest STABLE release; fall back to
+      # isDefault, then newest-by-date, only when no stable version parses (a
+      # genuinely prerelease-only package still reads active, not dormant).
+      entry = latest_stable_version(versions) ||
+        versions.find { |v| v.is_a?(Hash) && v["isDefault"] } ||
+        newest_version(versions)
       return if entry.nil?
 
       { version: entry.dig("versionKey", "version"), published_at: entry["publishedAt"] }
     end
 
+    # The newest non-prerelease version by version number (not publishedAt: a
+    # backported patch on an old line can post-date the latest major). nil when no
+    # version parses as a stable release.
+    def latest_stable_version(versions)
+      versions
+        .filter_map do |v|
+          next unless v.is_a?(Hash) && !v["isDeprecated"]
+
+          gem_version = VersionHelper.comparable(v.dig("versionKey", "version"))
+          [gem_version, v] if gem_version && !gem_version.prerelease?
+        end
+        .max_by(&:first)
+        &.last
+    end
+
     # The package's most recent release date (ISO8601 string), or nil. This is
     # the cross-ecosystem freshness signal, and deps.dev's publishedAt is more
     # reliable than ecosyste.ms's latest_release_published_at, which can lag badly
@@ -96,6 +121,21 @@ module StillActive
       }
     end
 
+    # The NuGet target framework monikers a version declares (net6.0, net45,
+    # netstandard2.0, ...), or [] when unknown. On the NuGet-specific
+    # `:requirements` endpoint, not the version endpoint. The language-runtime
+    # ceiling (SA009) reads these to detect a package that targets only EOL .NET
+    # runtimes. Degrades to [] on 404/failure, never raising.
+    def target_frameworks(name:, version:)
+      return [] if name.nil? || version.nil?
+
+      path = "/v3alpha/systems/nuget/packages/#{encode(name)}/versions/#{encode(version)}:requirements"
+      body = HttpHelper.get_json(BASE_URI, path)
+      return [] if body.nil?
+
+      Array(body.dig("nuget", "targetFrameworks")).grep(String)
+    end
+
     def advisory_detail(advisory_id:)
       return if advisory_id.nil?
 
@@ -176,6 +216,14 @@ module StillActive
     # Trims a repo URL's path to just the project. On GitLab the project path
     # ends at the "/-/" separator (before tree/blob/etc) and may be nested;
     # elsewhere it's owner/repo. Drops trailing slashes and a ".git" suffix.
+    # github.com top-level paths that are not user/org repositories; deps.dev
+    # occasionally returns one as SOURCE_REPO (a github.com/sponsors/<user> funding
+    # link). Parsing it as owner/repo yields a 404 and a blank repo cell, so treat a
+    # reserved first segment as "no repo" rather than a bogus lookup.
+    GITHUB_RESERVED_PATHS = [
+      "sponsors", "orgs", "marketplace", "apps", "topics", "settings", "notifications", "about", "pricing", "features", "security", "contact",
+    ].freeze
+
     def repo_path_segments(host, segments)
       segments = segments.reject(&:empty?)
 
@@ -183,6 +231,8 @@ module StillActive
         separator = segments.index("-")
         segments = segments[0...separator] if separator
       else
+        return [] if host.to_s.casecmp?("github.com") && GITHUB_RESERVED_PATHS.include?(segments.first&.downcase)
+
         segments = segments.first(2)
       end
 
@@ -196,7 +246,7 @@ module StillActive
     # is chronological), and a dated release always wins over an undated one.
     def newest_version(versions)
       versions
-        .select { |v| v.is_a?(Hash) && v["publishedAt"] }
+        .select { |v| v.is_a?(Hash) && v["publishedAt"] && !v["isDeprecated"] }
         .max_by { |v| v["publishedAt"].to_s }
     end
 

data/lib/still_active/ecosystem_lens.rb

@@ -8,6 +8,7 @@ require_relative "pypi_client"
 require "time"
 require_relative "../helpers/activity_helper"
 require_relative "../helpers/constraint_helper"
+require_relative "../helpers/dotnet_helper"
 require_relative "../helpers/libyear_helper"
 require_relative "../helpers/pep440_helper"
 require_relative "../helpers/runtime_ceiling_helper"
@@ -52,7 +53,7 @@ module StillActive
     # deps.dev; silence beats a false "holds your tree hostage".
     FLAT_RESOLUTION_ECOSYSTEMS = [:rubygems, :pypi].freeze
 
-    def assess(ecosystem:, name:, version:, constraint_cache: {}, python_range: nil)
+    def assess(ecosystem:, name:, version:, constraint_cache: {}, runtime_ranges: {})
       info = DepsDevClient.version_info(gem_name: name, version: version, system: ecosystem)
       default = DepsDevClient.default_version_info(name: name, system: ecosystem)
       # Retry the version lookup once when it came back empty but the package DID
@@ -87,6 +88,10 @@ module StillActive
         name: name,
         version_used: version,
         version_used_release_date: used_release_date,
+        # The latest stable version string, so the shared formatters can render
+        # the "behind X"/up-to-date delta cross-ecosystem the same way the native
+        # path does. nil when deps.dev has no default version for the package.
+        latest_version: latest_version,
         latest_version_release_date: latest_release_date,
         # libyear parity with the native path: how far behind latest the locked
         # version is, in release-years. Both dates come from deps.dev responses
@@ -109,7 +114,7 @@ module StillActive
       }
       gem_data[:version_unresolved] = true if version_unresolved
       attach_constraints(gem_data, ecosystem: ecosystem, name: name, version: version, cache: constraint_cache)
-      attach_language_ceiling(gem_data, ecosystem: ecosystem, name: name, version: version, latest_version: default&.dig(:version), python_range: python_range)
+      attach_language_ceiling(gem_data, ecosystem: ecosystem, name: name, version: version, latest_version: default&.dig(:version), runtime_ranges: runtime_ranges)
       gem_data
     end
 
@@ -124,9 +129,17 @@ module StillActive
     # pypi package; other ecosystems carry no ceiling here rather than a wrong one
     # (cargo's rust_version is a soft MSRV hint, not an install wall). Best-effort:
     # a nil range (endoflife feed down) or absent requires_python yields nothing.
-    def attach_language_ceiling(gem_data, ecosystem:, name:, version:, latest_version:, python_range:)
+    def attach_language_ceiling(gem_data, ecosystem:, name:, version:, latest_version:, runtime_ranges:)
+      finding =
+        case ecosystem
+        when :pypi then python_ceiling(name: name, version: version, latest_version: latest_version, python_range: runtime_ranges[:python])
+        when :nuget then dotnet_ceiling(name: name, version: version, latest_version: latest_version, dotnet: runtime_ranges[:dotnet], dotnetfx: runtime_ranges[:dotnetfx])
+        end
+      gem_data[:language_ceiling] = finding if finding
+    end
+
+    def python_ceiling(name:, version:, latest_version:, python_range:)
       return if python_range.nil?
-      return unless ecosystem == :pypi
 
       requirement = Pep440Helper.to_gem_requirement_string(PypiClient.requires_python(name: name, version: version))
       finding = requirement && RuntimeCeilingHelper.analyze(requirement: requirement, support_window: python_range)
@@ -134,7 +147,36 @@ module StillActive
 
       finding[:runtime] = "Python"
       finding[:fixed_by_upgrade] = python_ceiling_lifted_by_upgrade?(name: name, version: version, latest_version: latest_version, python_range: python_range)
-      gem_data[:language_ceiling] = finding
+      finding
+    end
+
+    # The .NET ceiling: a NuGet package whose ONLY runtime targets are end-of-life
+    # frameworks caps you onto a dead runtime (a restore-time NU1202 wall). Unlike
+    # Python's requires_python range, .NET declares a SET of target frameworks;
+    # DotnetHelper carries the set logic and the netstandard escape-hatch rule.
+    def dotnet_ceiling(name:, version:, latest_version:, dotnet:, dotnetfx:)
+      return if dotnet.nil? && dotnetfx.nil?
+
+      frameworks = DepsDevClient.target_frameworks(name: name, version: version)
+      return if frameworks.empty?
+
+      finding = DotnetHelper.analyze(target_frameworks: frameworks, dotnet: dotnet, dotnetfx: dotnetfx)
+      return if finding.nil?
+
+      finding[:fixed_by_upgrade] = dotnet_ceiling_lifted_by_upgrade?(name: name, version: version, latest_version: latest_version, dotnet: dotnet, dotnetfx: dotnetfx)
+      finding
+    end
+
+    # Positive confirmation, like the Python check: only claim an upgrade lifts the
+    # ceiling when the latest version's targets ACTUALLY clear it (a fresh fetch),
+    # never inferring "safe to bump" from a failed lookup.
+    def dotnet_ceiling_lifted_by_upgrade?(name:, version:, latest_version:, dotnet:, dotnetfx:)
+      return false if latest_version.nil? || latest_version == version
+
+      latest_frameworks = DepsDevClient.target_frameworks(name: name, version: latest_version)
+      return false if latest_frameworks.empty?
+
+      DotnetHelper.analyze(target_frameworks: latest_frameworks, dotnet: dotnet, dotnetfx: dotnetfx).nil?
     end
 
     # Does upgrading the package to its latest release lift the cap? Requires

data/lib/still_active/options.rb

@@ -62,7 +62,7 @@ module StillActive
     end
 
     def add_sbom_option(opts)
-      opts.on("--sbom=PATH", String, "audit a CycloneDX SBOM cross-ecosystem (npm/pypi/cargo/go/maven/nuget) instead of a Gemfile; JSON output") do |value|
+      opts.on("--sbom=PATH", String, "audit a CycloneDX SBOM cross-ecosystem (npm/pypi/cargo/go/maven/nuget) instead of a Gemfile; honours --sarif/--markdown/--terminal/--json") do |value|
         options[:provided_sbom] = true
         StillActive.config { |config| config.sbom_path = value }
       end

data/lib/still_active/sbom_workflow.rb

@@ -4,6 +4,7 @@ require_relative "ecosystem_lens"
 require_relative "ceiling_reconciler"
 require_relative "poison_security_correlator"
 require_relative "../helpers/python_helper"
+require_relative "../helpers/dotnet_helper"
 require "async"
 require "async/barrier"
 require "async/semaphore"
@@ -32,16 +33,15 @@ module StillActive
     def call(sbom_result, &on_progress)
       dependencies = sbom_result.dependencies
       Async do
-        # The Python runtime support window, fetched once for the whole SBOM (the
-        # language-ceiling input for pypi deps). Guarded like the native Ruby path:
-        # a feed failure degrades to "no ceiling checks", never aborts the audit.
-        python_range =
-          begin
-            PythonHelper.supported_python_range
-          rescue StandardError => e
-            $stderr.puts("warning: Python support window lookup failed: #{e.class} (#{e.message}); skipping language-ceiling checks")
-            nil
-          end
+        # The language-runtime support windows, fetched once for the whole SBOM
+        # (pypi reads :python; nuget reads :dotnet/:dotnetfx). Guarded per feed like
+        # the native Ruby path: a feed failure degrades to "no ceiling checks" for
+        # that runtime, never aborts the audit.
+        runtime_ranges = {
+          python: safe_support_window("Python") { PythonHelper.supported_python_range },
+          dotnet: safe_support_window(".NET") { DotnetHelper.supported_dotnet_range },
+          dotnetfx: safe_support_window(".NET Framework") { DotnetHelper.supported_dotnetfx_range },
+        }
         barrier = Async::Barrier.new
         semaphore = Async::Semaphore.new(StillActive.config.parallelism, parent: barrier)
         result = {}
@@ -61,7 +61,7 @@ module StillActive
             # when the SBOM actually marked it (SbomReader leaves the key absent
             # otherwise): absent stays "unknown", never a false that reads as test-only.
             result["#{dep[:ecosystem]}/#{dep[:name]}@#{dep[:version]}"] =
-              EcosystemLens.assess(ecosystem: dep[:ecosystem], name: dep[:name], version: dep[:version], constraint_cache: constraint_cache, python_range: python_range)
+              EcosystemLens.assess(ecosystem: dep[:ecosystem], name: dep[:name], version: dep[:version], constraint_cache: constraint_cache, runtime_ranges: runtime_ranges)
                 .merge(dep.slice(:production))
           rescue StandardError => e
             # One dependency's failure must not abort the audit, but it must not
@@ -92,5 +92,16 @@ module StillActive
         )
       end.wait
     end
+
+    private
+
+    # Fetch one runtime's support window, degrading a feed failure to nil (no
+    # ceiling checks for that runtime) with a warning, never aborting the audit.
+    def safe_support_window(label)
+      yield
+    rescue StandardError => e
+      $stderr.puts("warning: #{label} support window lookup failed: #{e.class} (#{e.message}); skipping language-ceiling checks")
+      nil
+    end
   end
 end

data/lib/still_active/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module StillActive
-  VERSION = "3.0.0.rc1"
+  VERSION = "3.0.0.rc3"
 end

data/lib/still_active/workflow.rb

@@ -153,7 +153,10 @@ module StillActive
       commit_date = signals[:last_commit_date]
       archived = signals[:archived]
       last_release = VersionHelper.find_version(versions: vs, pre_release: false)
-      last_pre_release = VersionHelper.find_version(versions: vs, pre_release: true)
+      last_pre_release = VersionHelper.upcoming_pre_release(
+        pre_release: VersionHelper.find_version(versions: vs, pre_release: true),
+        release: last_release,
+      )
       deps_dev = fetch_deps_dev_info(
         gem_name: gem_name,
         version: gem_version || VersionHelper.gem_version(version_hash: last_release),

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: still_active
 version: !ruby/object:Gem::Version
-  version: 3.0.0.rc1
+  version: 3.0.0.rc3
 platform: ruby
 authors:
 - Sean Floyd
@@ -254,7 +254,9 @@ files:
 - lib/helpers/constraint_helper.rb
 - lib/helpers/cvss_helper.rb
 - lib/helpers/cyclonedx_helper.rb
+- lib/helpers/dependency_helper.rb
 - lib/helpers/diff_markdown_helper.rb
+- lib/helpers/dotnet_helper.rb
 - lib/helpers/emoji_helper.rb
 - lib/helpers/endoflife_helper.rb
 - lib/helpers/http_helper.rb