still_active 3.0.0.rc2 → 3.0.0.rc3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 89af276523def67c4566cdcc8ff084c14383f4c43dff3429a739f861cfea8555
-  data.tar.gz: 8a6da7245242d2778126ed993484fd5bddf0cfba66d612cc120c705c1c519383
+  metadata.gz: 48cf9cbac0c507c9de0eae6930aac65686f32893d1e330c19d0392ccc5a3a824
+  data.tar.gz: 0a1370fc970a0b03e7a5663a4c320322f4ac7788d161d144405cb8c703b005b5
 SHA512:
-  metadata.gz: b3fd52ed8f8ad9a05267c22074b3720f9bdc48d0e65e0ff557a56c9d9f43cee7c9f07d1ec7acca2f82012a34a7c181d10a23d2427edd245d7055dad9e8866c4b
-  data.tar.gz: 3751290569ec6bbd5e0d7cb9da9e76ebdd8add640c2baca94f04488b4f0874a8407ae9d5ceffecde0cc1296552aaaf765e3bb96f6e7e80e13fcf79a9e65471f3
+  metadata.gz: 85e0df44ac6e16fe28023c5dedf5e7a08466c045f5e36558b91d42e71949d159df10262a894139916fc6dc5c744d5c15ec159630297a734104c17e1e60b2826e
+  data.tar.gz: 4da6ad45492f57b76a1ec2f3e0f486be5aa7765cd2a4b956de0cf02c66af61c2d21ae0ff278aaf77a33a0e38b18a7d72a1a61bcd9b91d46259fac4d3a266b57b

data/CHANGELOG.md

@@ -20,12 +20,12 @@ The new `--fail-if-poison[=TIER]` and `--fail-if-language-ceiling[=TIER]` gates
 
 - **Poison-pill / compatibility-ceiling signal (SA008).** A dormant or archived package that caps one of its runtime dependencies below that dependency's current latest major holds the tree below a ceiling no upstream release will raise, and it grows more constraining over time as the capped dep ships new majors. still_active flags it with a receipt naming the capped dep, the cap, and how many majors behind it holds you, ranked by a severity tier (`note`/`warning`/`critical`, scaling with majors-behind) and enforceable in CI with `--fail-if-poison[=TIER]`. Rendered in terminal, markdown, and SARIF, and computed for `rubygems` (native) and the flat-resolution SBOM ecosystems. Scoped to flat resolution deliberately: npm nests versions and cargo coexists majors, so a below-latest cap there is subtree-local noise, not a tree-wide block, and is suppressed.
 - **Security "below the fix", the strongest poison case, now cross-ecosystem.** When a dormant/archived package pins a dependency that is *itself* known-vulnerable in the same tree, below the version that patches a HIGH-or-critical advisory, you cannot patch the CVE without replacing the dead capper. still_active leads with these findings (red in terminal/markdown, escalated to `error` in SARIF) and names the advisory and its nearest fix. This case travels to **npm and cargo** at patch precision (their fixes are mostly same-major patch bumps, invisible to a major-level check), via a real node-semver/Cargo matcher and a tree-copy soundness guard that only fires when every resolved copy the constraint governs is vulnerable (a safe copy elsewhere, or a patched copy the cap can reach, clears it). The correlation is whole-tree from data already assembled, no extra fetches.
-- **Language-runtime ceiling signal (SA009), poison's sibling.** A pinned dependency version can strand you on an end-of-life language runtime (its `required_ruby_version` / `requires_python` forbids a supported one). still_active flags it against the runtime's EOL schedule (from endoflife.date), enforceable with `--fail-if-language-ceiling[=TIER]`, and reconciled against poison so an "upgrade to lift the ceiling" can't contradict a cap that forbids that upgrade. Ruby on the native path; **Python on the `--sbom` path** (pypi).
+- **Language-runtime ceiling signal (SA009), poison's sibling.** A pinned dependency version can strand you on an end-of-life language runtime (its `required_ruby_version` / `requires_python` forbids a supported one). still_active flags it against the runtime's EOL schedule (from endoflife.date), enforceable with `--fail-if-language-ceiling[=TIER]`, and reconciled against poison so an "upgrade to lift the ceiling" can't contradict a cap that forbids that upgrade. Ruby on the native path; **Python** (`requires_python`) and **.NET/NuGet** on the `--sbom` path. .NET is shaped differently: a package declares a SET of target frameworks, and consuming one is a restore-time wall (NU1202), so the ceiling fires only when every concrete runtime target is end-of-life. A `netstandard` target is the escape hatch (consumable from a current .NET), so its presence never fires, keeping the signal off nearly every modern library; `.NET Framework` (4.x) and `.NET` (Core/5+) are checked against their separate EOL calendars.
 - **CVSS-4-only advisory scoring via an optional `cvss-suite`.** deps.dev stores only CVSS 3.x, so a CVSS-4-only advisory arrives unscored; still_active enriches every advisory with OSV's real severity label and fixed-version ranges, and, when the optional `cvss-suite` gem is installed, computes the CVSS-4 base score from the OSV vector. Without it, the OSV/GHSA label still gates and only the computed number is skipped, so the fail-closed logic never reads a real HIGH as clean. `cvss-suite` is opt-in (see Upgrading).
 - **Vulnerabilities with no fixed version available are flagged** (`no_fix_available`): a known advisory you cannot upgrade out of, the one you most need to see because upgrading isn't the answer.
 - **A schema canary for the deps.dev advisory field** (`api.deps.dev`'s alpha `advisoryKeys`): every cross-ecosystem vulnerability count flows through it, so a silent field rename would zero every count and read a vulnerable package as clean. A known-vulnerable canary (`django 3.0.0`) is checked each run; an empty result warns loudly rather than presenting a possibly-understated "all clear".
-- **The `--sbom` path now carries the same version signals as the native audit**: `libyear` drift, a prerelease/ahead-aware `up_to_date`, and (when the SBOM marks CycloneDX dev-vs-prod scope) a `production` boolean so a consumer can separate prod risk from test debt. A private/alternative registry named in a PURL's `repository_url` is refused a public-by-name lookup (the cross-ecosystem dependency-confusion guard), and a pinned version deps.dev can't resolve reads `unknown` rather than riding the fresh package date to a false `ok`.
-- **`--sbom=PATH` audits a CycloneDX SBOM cross-ecosystem**, so the maintenance lens travels beyond Ruby: point it at a Syft/Trivy-produced SBOM and still_active assesses every `npm`, `pypi`, `cargo`, `go`, `maven`, and `nuget` package the same way it does gems (latest release date, archived repo, advisories, OpenSSF Scorecard, lifecycle `status`), sourcing signals from deps.dev and ecosyste.ms instead of Bundler. Mutually exclusive with `--gemfile`/`--gems`; emits JSON only (its shape differs from the Ruby audit, so it deliberately omits the `$schema` contract). Results are keyed `ecosystem/name@version` so nothing collides and overwrites, not a same-named package across two ecosystems nor two versions of one package pinned by different subprojects of a monorepo (a lockfile resolves one version per name, a merged SBOM doesn't), and each dependency carries its `activity_level` and `status`. The SBOM is treated as **untrusted input**: the only things read from it are ecosystem/name/version, the repository is discovered from deps.dev (never a lockfile-supplied URL, so a hostile SBOM can't redirect a lookup), and anything deps.dev doesn't index degrades to `unknown` rather than a fabricated `ok`. Packages it can't assess (unsupported ecosystems, a component with no version or PURL, **and** a dependency whose lookup raised, e.g. a rate-limited or flaky deps.dev) are surfaced in an `unassessable` list and a stderr count, never silently dropped, so a transient upstream hiccup can't shrink the audit scope invisibly and let it read "all clear" while ignoring the deps it skipped. A present-but-unreadable SBOM (truncated, or not CycloneDX) errors rather than degrading to an empty clean report. OS packages land in `unassessable` too; the differentiated play is maintenance, not vuln scanning, so compose Trivy/Grype for CVEs.
+- **The `--sbom` path now carries the same version signals as the native audit**: `libyear` drift, a prerelease/ahead-aware `up_to_date`, the `latest_version` string, and (when the SBOM marks CycloneDX dev-vs-prod scope) a `production` boolean so a consumer can separate prod risk from test debt. A private/alternative registry named in a PURL's `repository_url` is refused a public-by-name lookup (the cross-ecosystem dependency-confusion guard), and a pinned version deps.dev can't resolve reads `unknown` rather than riding the fresh package date to a false `ok`.
+- **`--sbom=PATH` audits a CycloneDX SBOM cross-ecosystem**, so the maintenance lens travels beyond Ruby: point it at a Syft/Trivy-produced SBOM and still_active assesses every `npm`, `pypi`, `cargo`, `go`, `maven`, and `nuget` package the same way it does gems (latest release date, archived repo, advisories, OpenSSF Scorecard, lifecycle `status`), sourcing signals from deps.dev and ecosyste.ms instead of Bundler. Mutually exclusive with `--gemfile`/`--gems`, and honours the same output-format flags as the Gemfile path (`--sarif` for GitHub Code Scanning, `--markdown` for CI step summaries, `--terminal`, `--json`), so formatting is independent of whether the input was a Gemfile or an SBOM; findings are named `ecosystem/name`, and SARIF anchors them to the SBOM file since there is no lockfile to annotate. The JSON shape differs from the Ruby audit, so it deliberately omits the `$schema` contract. `--cyclonedx` and `--baseline` need the native audit's lockfile/snapshot (per-ecosystem PURL reconstruction, a gems/ruby diff), which a cross-ecosystem SBOM can't honestly supply, so they error loudly rather than silently falling back to JSON. A cross-ecosystem finding's suppression identity (for `--ignore` and `.still_active.yml`) is `ecosystem/name` (e.g. `npm/left-pad`), version-independent and matching what the SARIF `suppressions[]` and the fail-if gates key on, not the composite `ecosystem/name@version` result key. Results are keyed `ecosystem/name@version` so nothing collides and overwrites, not a same-named package across two ecosystems nor two versions of one package pinned by different subprojects of a monorepo (a lockfile resolves one version per name, a merged SBOM doesn't), and each dependency carries its `activity_level` and `status`. The SBOM is treated as **untrusted input**: the only things read from it are ecosystem/name/version, the repository is discovered from deps.dev (never a lockfile-supplied URL, so a hostile SBOM can't redirect a lookup), and anything deps.dev doesn't index degrades to `unknown` rather than a fabricated `ok`. Packages it can't assess (unsupported ecosystems, a component with no version or PURL, **and** a dependency whose lookup raised, e.g. a rate-limited or flaky deps.dev) are surfaced in an `unassessable` list and a stderr count, never silently dropped, so a transient upstream hiccup can't shrink the audit scope invisibly and let it read "all clear" while ignoring the deps it skipped. A present-but-unreadable SBOM (truncated, or not CycloneDX) errors rather than degrading to an empty clean report. OS packages land in `unassessable` too; the differentiated play is maintenance, not vuln scanning, so compose Trivy/Grype for CVEs.
 - **Tokenless GitHub repo signals via [ecosyste.ms](https://ecosyste.ms).** Without a GitHub token the live API caps at 60 requests/hour, unusable past a handful of gems; still_active now falls back to ecosyste.ms (5000 anonymous requests/hour) for GitHub repos' archived + last-commit signals, so a large Gemfile audits cleanly with no token. GitHub-only by design (ecosyste.ms doesn't track commit recency for GitLab/Codeberg, so those keep their own clients); a configured token still takes precedence (freshest data, and it carries `--unreleased-commits`). Requests identify still_active in the User-Agent, and an optional `--ecosystems-email` / `STILL_ACTIVE_ECOSYSTEMS_EMAIL` joins ecosyste.ms's "polite pool" (higher rate limit) as a courtesy to the free service. ecosyste.ms data is CC-BY-SA 4.0 and attributed in the README.
 
 - Each gem now carries the OpenSSF Scorecard **`Maintained` sub-check** (`scorecard_maintained`, 0.0-10.0) alongside the aggregate `scorecard_score`. The sub-check scores recent commit and issue activity directly, the question still_active exists to answer, and it was already present in the deps.dev response still_active fetches (previously discarded). `nil` when a project has no scorecard, deliberately distinct from `0.0` ("measured: unmaintained") so absent data never reads as healthy.
@@ -41,6 +41,11 @@ The new `--fail-if-poison[=TIER]` and `--fail-if-language-ceiling[=TIER]` gates
 - **A pinned version the registry can't resolve reads `unknown`, not `ok`.** A nonexistent or yanked pinned version on the `--sbom` path rode the fresh package date to a false `ok`; it now reports `unknown`, with a single retry distinguishing a real 404 from a transient miss.
 - **Graceful degradation on real SBOM/CLI input.** A git-scheme or scp `SOURCE_REPO` URL from deps.dev now parses correctly (recovering repo signals and silencing a warning flood); a malformed PURL (`pkg:npm/@1.0.0`, bad `%`-encoding) degrades to `unassessable` instead of backtracing and dropping every other dependency's verdict; and bad CLI input exits 2 with a friendly error instead of a stack trace (see Upgrading).
 - **The published JSON Schema matches real output.** It had rejected any report containing a vulnerability, because OSV enrichment adds fields (`osv_severity`, `fixed_versions`, and more) the strict `additionalProperties: false` schema didn't list. The schema now covers them (and the poison/below-the-fix keys), and the contract test validates enriched output so it can't drift silently again.
+- **A current Go dependency no longer reads as "behind".** Go module versions carry a `v` prefix (`v2.0.1`) that `Gem::Version` can't parse, so the up-to-date comparison silently failed and the `--sbom` terminal/markdown table painted a `v2.0.1 -> v2.0.1` upgrade arrow on a package already on its latest release. The prefix is now stripped before comparison (a no-op for digit-first rubygems/npm/pypi/cargo versions).
+- **A cross-ecosystem package with a "wrong" default version no longer reads as abandoned.** deps.dev's `isDefault` flag is not reliably the latest release: for `cargo/wasi` it points at `0.7.0` (2019) while `0.14.7` (2025) ships, and for `pypi/httpx` it points at a `1.0.0.dev3` prerelease over the `0.28.1` stable. The `--sbom` path trusted it, so an actively-maintained package rendered as years-stale (a false SA002 "no release in N years", which can fail `--fail-if-critical` and pollute Code Scanning) and a downgrade was shown as an upgrade. still_active now ranks a package's versions and takes the newest *stable* release, falling back to `isDefault`/newest-by-date only when no stable version parses.
+- **SemVer build metadata no longer breaks the up-to-date comparison.** A cargo version like `1.0.4+wasi-0.2.12` couldn't be parsed by `Gem::Version` (the `+build` suffix), so `--sbom` painted a "behind" arrow on an already-current crate. Build metadata (which SemVer 2.0.0 says MUST be ignored for precedence) is now stripped before comparison, and the terminal version column distinguishes "behind" from "couldn't compare" (showing the version plainly rather than a false upgrade arrow, matching the markdown "unsure" state).
+- **The terminal summary says "dependencies", not "gems", for a cross-ecosystem `--sbom` audit** (calling npm/cargo/go packages "gems" is a Ruby-ism); the native Ruby audit still says "gems".
+- **A GitHub funding link is no longer mistaken for a repository.** deps.dev sometimes returns a `SOURCE_REPO` of `https://github.com/sponsors/<user>` (a funding page); parsed as `owner/repo` it 404'd and left a blank "last commit" cell. Reserved GitHub top-level paths (`sponsors`, `orgs`, `apps`, ...) are now treated as "no repo", and the markdown "last commit" column shows the unsure marker instead of an empty link when a date is missing.
 
 ## [2.0.0] - 2026-06-14
 

data/lib/helpers/dependency_helper.rb

@@ -0,0 +1,20 @@
+# frozen_string_literal: true
+
+module StillActive
+  # The canonical identity of an assessed dependency, shared by every renderer
+  # (terminal/markdown/SARIF display) and by the suppression matchers (--ignore
+  # and .still_active.yml).
+  module DependencyHelper
+    extend self
+
+    # A cross-ecosystem SBOM dependency is "ecosystem/name" (the lens sets
+    # :ecosystem and :name); a native gem is its bare name (the hash key), where
+    # gem_data carries no :ecosystem. Deliberately version-independent: it is NOT
+    # the composite "ecosystem/name@version" hash key, so one suppression covers a
+    # dependency across version bumps and matches the same identity the poison /
+    # ceiling correlators key on.
+    def identity(name, data)
+      data[:ecosystem] ? "#{data[:ecosystem]}/#{data[:name]}" : name
+    end
+  end
+end

data/lib/helpers/dotnet_helper.rb

@@ -0,0 +1,142 @@
+# frozen_string_literal: true
+
+require_relative "constraint_helper"
+require_relative "endoflife_helper"
+
+module StillActive
+  # The NuGet calibration layer for the language-runtime ceiling (SA009), the
+  # .NET sibling of RubyHelper/PythonHelper. NuGet is shaped differently from
+  # Ruby/Python: a package declares not one version RANGE but a SET of target
+  # framework monikers (net6.0, netcoreapp3.1, net48, netstandard2.0). Targeting a
+  # framework is an enforced restore-time wall (NuGet error NU1202), so if EVERY
+  # concrete runtime the package targets is end-of-life, consuming it forces your
+  # project onto a dead runtime -- the same "no supported runtime is reachable"
+  # cap the Ruby/Python ceiling catches, expressed as a set rather than a range.
+  #
+  # The honesty rule is the netstandard exclusion: `netstandard*` is a
+  # compatibility contract consumable FROM a modern .NET, not a runtime, so it
+  # imposes no ceiling. Without excluding it the signal would fire on nearly every
+  # modern library. We therefore fire only when the package has at least one
+  # concrete runtime target AND every concrete runtime target is EOL.
+  module DotnetHelper
+    extend self
+
+    # The two .NET runtime calendars, fetched once per SBOM. .NET Core/5+ is a
+    # single unified endoflife feed; .NET Framework 4.x is its own (`dotnetfx`),
+    # with a different EOL schedule tied to Windows servicing.
+    def supported_dotnet_range = EndoflifeHelper.support_window(feed_path: "/api/dotnet.json")
+    def supported_dotnetfx_range = EndoflifeHelper.support_window(feed_path: "/api/dotnetfx.json")
+
+    # A target framework moniker -> { family: :dotnet | :dotnetfx, version: } (the
+    # runtime it names and the endoflife.date cycle to look it up by), or nil when
+    # the moniker is not a concrete runtime (netstandard, or unrecognized -- we
+    # never guess). Tolerates deps.dev's short form (net45, netcoreapp3.1), its
+    # long form (.NETFramework4.5), platform suffixes (net6.0-windows), and case.
+    def classify(moniker)
+      return if moniker.nil?
+
+      m = moniker.to_s.strip.downcase
+      return if m.empty?
+
+      # Drop a platform suffix (net6.0-windows -> net6.0) and the long-form dot.
+      dash = m.index("-")
+      m = m[0, dash] if dash
+      m = m.delete_prefix(".")
+
+      return if m.start_with?("netstandard") # a compatibility contract, not a runtime
+
+      # Ordered, mutually-exclusive prefixes; the load-bearing distinction is the
+      # dot: a dotted "netX.Y" is .NET 5+ (major cycle), a dot-less "netXY" is .NET
+      # Framework (digits expand to the cycle).
+      if m.start_with?("netcoreapp")
+        dotnet(m.delete_prefix("netcoreapp")) # netcoreapp3.1 -> .NET "3.1" (minor kept)
+      elsif m.start_with?("netframework")
+        dotnetfx(m.delete_prefix("netframework"))    # long form: .NETFramework4.7.2
+      elsif m.start_with?("net")
+        rest = m.delete_prefix("net")
+        if rest.include?(".")
+          dotnet(rest.split(".").first)              # net6.0 -> .NET "6" (major only)
+        elsif all_digits?(rest)
+          dotnetfx(expand_framework_digits(rest))    # net48 -> .NET Framework "4.8"
+        end
+      end
+    end
+
+    # Whether a moniker is a netstandard target (tolerating the long-form ".NETStandard"
+    # and platform/case variants) -- the escape hatch analyze must honour.
+    def netstandard?(moniker)
+      return false if moniker.nil?
+
+      moniker.to_s.strip.downcase.delete_prefix(".").start_with?("netstandard")
+    end
+
+    # => the SA009 eol_forced finding hash, or nil when the package is not capped.
+    # `dotnet` / `dotnetfx` are EndoflifeHelper.support_window results (or nil when
+    # the feed is down); only their :cycles list is read.
+    def analyze(target_frameworks:, dotnet:, dotnetfx:)
+      monikers = Array(target_frameworks)
+      # THE honesty rule: a netstandard target is a compatibility contract
+      # consumable from a current .NET, so its mere presence is an escape hatch --
+      # the package is not capped, whatever else it targets. Without this the signal
+      # fires on nearly every modern .NET library (Newtonsoft.Json, EF Core, ...),
+      # which all ship a netstandard2.0 target alongside older concrete runtimes.
+      return if monikers.any? { |moniker| netstandard?(moniker) }
+
+      runtimes = monikers.filter_map do |moniker|
+        classification = classify(moniker)
+        classification&.merge(moniker: moniker, cycle: cycle_for(classification, dotnet: dotnet, dotnetfx: dotnetfx))
+      end
+      return if runtimes.empty?
+
+      # A still-supported runtime target is a clear escape hatch: not capped.
+      return if runtimes.any? { |r| r[:cycle] && r[:cycle][:eol] == false }
+
+      eol = runtimes.select { |r| r[:cycle] && r[:cycle][:eol] == true }
+      return if eol.empty? # nothing KNOWN-EOL: don't fabricate a ceiling from unknown cycles
+
+      # The longest-lived dead runtime is the best the package offers -- the ceiling.
+      ceiling = eol.max_by { |r| r[:cycle][:eol_date] || Time.at(0) }
+      finding = {
+        requirement: runtimes.map { |r| r[:moniker] }.uniq.sort.join(", "),
+        eol_forced: true,
+        runtime: ceiling[:family] == :dotnetfx ? ".NET Framework" : ".NET",
+        ceiling_version: ceiling[:version].to_s,
+        ceiling_eol_date: ceiling[:cycle][:eol_date],
+      }
+      finding.merge(severity: ConstraintHelper.constraint_severity(finding))
+    end
+
+    private
+
+    # "461" -> "4.6.1", "48" -> "4.8", "45" -> "4.5": first digit is the major, each
+    # remaining digit a further segment. Only called on an all-digit remainder.
+    def expand_framework_digits(digits) = ([digits[0]] + digits[1..].chars).join(".")
+
+    def all_digits?(str)
+      !str.empty? && str.chars.all? { |c| ("0".."9").cover?(c) }
+    end
+
+    def dotnet(version) = build(:dotnet, version)
+    def dotnetfx(version) = build(:dotnetfx, version)
+
+    def build(family, version)
+      return unless version && Gem::Version.correct?(version)
+
+      { family: family, version: Gem::Version.new(version) }
+    end
+
+    # The endoflife cycle for a classified target, or nil when the feed is down or
+    # the cycle isn't tracked (an ancient net20 predating the feed) -- unknown, not
+    # assumed EOL.
+    def cycle_for(classification, dotnet:, dotnetfx:)
+      window = classification[:family] == :dotnetfx ? dotnetfx : dotnet
+      return if window.nil?
+
+      # Match on the release segment, ignoring any prerelease suffix: endoflife
+      # keys .NET Framework 3.5 as "3.5-sp1", so net35 ("3.5") must still match it
+      # (otherwise a still-supported target reads as unknown and can false-fire).
+      target = classification[:version].release
+      window[:cycles].find { |cycle| cycle[:version].release == target }
+    end
+  end
+end

data/lib/helpers/markdown_helper.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require_relative "markdown_escape"
+require_relative "dependency_helper"
 require_relative "vulnerability_helper"
 require_relative "activity_helper"
 require_relative "constraint_helper"
@@ -40,7 +41,7 @@ module StillActive
       inactive_repository_emoji = data[:last_activity_warning_emoji]
       using_latest_version_emoji = data[:up_to_date_emoji]
 
-      formatted_name = markdown_url(text: gem_name, url: repository_url)
+      formatted_name = markdown_url(text: DependencyHelper.identity(gem_name, data), url: repository_url)
 
       formatted_version_used = if [:git, :path].include?(data[:source_type])
         data[:version_used] ? "#{data[:version_used]} (#{data[:source_type]})" : "(#{data[:source_type]})"
@@ -66,7 +67,11 @@ module StillActive
         date: data[:latest_pre_release_version_release_date],
       )
 
-      formatted_last_commit = markdown_url(text: year_month(data[:last_commit_date]), url: repository_url)
+      # Only link when there is a date: markdown_url with a nil date + a present
+      # repo returns "[](url)" (an invisible link, and truthy, so the `|| unsure`
+      # fallback below never fires). Guard here so a missing date shows unsure.
+      last_commit_ym = year_month(data[:last_commit_date])
+      formatted_last_commit = markdown_url(text: last_commit_ym, url: repository_url) if last_commit_ym
 
       unsure = StillActive.config.unsure_emoji
 
@@ -179,7 +184,7 @@ module StillActive
       ranked = flagged.sort_by { |name, data| [-ConstraintHelper::SEVERITY.index(data[:language_ceiling][:severity] || :note), name.to_s] }
       ranked.each do |name, data|
         ceiling = data[:language_ceiling]
-        lines << "- **#{ceiling[:severity] || :note}** #{MarkdownEscape.code_span(name)} #{language_ceiling_receipt(ceiling, data)}"
+        lines << "- **#{ceiling[:severity] || :note}** #{MarkdownEscape.code_span(DependencyHelper.identity(name, data))} #{language_ceiling_receipt(ceiling, data)}"
       end
       lines.join("\n")
     end
@@ -202,7 +207,7 @@ module StillActive
     end
 
     def poison_gem_ref(name, data)
-      ref = MarkdownEscape.code_span(name)
+      ref = MarkdownEscape.code_span(DependencyHelper.identity(name, data))
       path = data[:dependency_path]
       # Transitive pill: name the direct parent the user can actually act on (#60).
       return ref unless data[:direct] == false && Array(path).length >= 2
@@ -290,10 +295,14 @@ module StillActive
       "[#{safe_text}](#{MarkdownEscape.url(url)})"
     end
 
-    def year_month(time_object)
-      return if time_object.nil?
+    # The native Ruby path stores dates as Time; the cross-ecosystem lens carries
+    # deps.dev's raw ISO8601 strings. Parse either (nil-safe) rather than assuming
+    # Time, so an SBOM audit renders dates instead of crashing on String#strftime.
+    def year_month(value)
+      time = ActivityHelper.parse_time(value)
+      return if time.nil?
 
-      time_object.strftime("%Y/%m")
+      time.strftime("%Y/%m")
     end
   end
 end

data/lib/helpers/sarif_helper.rb

@@ -6,6 +6,7 @@ require "time"
 require_relative "../still_active/sarif/rules"
 require_relative "lockfile_indexer"
 require_relative "activity_helper"
+require_relative "dependency_helper"
 require_relative "constraint_helper"
 
 module StillActive
@@ -44,6 +45,27 @@ module StillActive
       JSON.pretty_generate(document(results: results, tool_version: tool_version))
     end
 
+    # The SBOM path emits the same rule set and document, but there is no lockfile
+    # to annotate: every finding anchors to the SBOM file itself (line 1), and
+    # ruby_info is nil (Ruby EOL / SA006 is a native-only signal). Findings are
+    # named ecosystem/name (each gem_data carries :ecosystem and :name), so a
+    # cross-ecosystem alert reads "npm/left-pad ..." rather than a bare gem name.
+    #
+    # result: SbomWorkflow assessed hash ("ecosystem/name@version" => gem_data)
+    # source_uri: the SBOM file to point findings at (basename)
+    # tool_version: StillActive::VERSION at emit time
+    def render_sbom(result:, source_uri:, tool_version:)
+      results = build_results(
+        report: result,
+        ruby_info: nil,
+        line_index: {},
+        ruby_line: nil,
+        lockfile_uri: source_uri,
+      )
+
+      JSON.pretty_generate(document(results: results, tool_version: tool_version))
+    end
+
     private
 
     def document(results:, tool_version:)
@@ -94,13 +116,21 @@ module StillActive
       results
     end
 
+    # `name` is the hash key: the bare gem name natively, the composite
+    # "ecosystem/name@version" on the SBOM path. It drives the fingerprint and
+    # location, both of which MUST stay version-distinct so two pinned versions of
+    # one package (a merged monorepo SBOM) never collapse into a single Code
+    # Scanning alert. `display` is the version-independent "ecosystem/name" (bare
+    # name natively): what the message shows and what a --ignore/.still_active.yml
+    # suppression names, so one suppression covers a dependency across versions.
     def gem_results(name, data, line_index, lockfile_uri)
       out = []
       version = data[:version_used]
+      display = DependencyHelper.identity(name, data)
       location = location_for(name, line_index, lockfile_uri)
 
       if data[:archived]
-        out << mark_suppressed(result("SA001", name, "#{name} #{version}: upstream repository is archived#{repo_suffix(data)}#{alternatives_suffix(data)}#{transitive_suffix(data)}.", location), name, :activity)
+        out << mark_suppressed(result("SA001", name, "#{display} #{version}: upstream repository is archived#{repo_suffix(data)}#{alternatives_suffix(data)}#{transitive_suffix(data)}.", location), display, :activity)
       end
 
       unless data[:archived]
@@ -112,10 +142,10 @@ module StillActive
             result(
               "SA002",
               name,
-              "#{name} #{version}: #{noun} in #{years} years (last #{activity[:date].utc.strftime("%Y-%m-%d")})#{alternatives_suffix(data)}#{transitive_suffix(data)}.",
+              "#{display} #{version}: #{noun} in #{years} years (last #{activity[:date].utc.strftime("%Y-%m-%d")})#{alternatives_suffix(data)}#{transitive_suffix(data)}.",
               location,
             ),
-            name,
+            display,
             :activity,
           )
         end
@@ -127,15 +157,15 @@ module StillActive
 
       if data[:libyear] && data[:libyear] > LIBYEAR_THRESHOLD
         latest = data[:latest_version] ? " behind #{data[:latest_version]}" : ""
-        out << mark_suppressed(result("SA004", name, "#{name} #{version}: #{data[:libyear]} libyears#{latest}#{transitive_suffix(data)}.", location), name, :libyear)
+        out << mark_suppressed(result("SA004", name, "#{display} #{version}: #{data[:libyear]} libyears#{latest}#{transitive_suffix(data)}.", location), display, :libyear)
       end
 
       if data[:scorecard_score] && data[:scorecard_score] < SCORECARD_LOW_THRESHOLD
-        out << mark_suppressed(result("SA005", name, "#{name} #{version}: OpenSSF Scorecard #{data[:scorecard_score]}/10 (low).", location), name, :scorecard)
+        out << mark_suppressed(result("SA005", name, "#{display} #{version}: OpenSSF Scorecard #{data[:scorecard_score]}/10 (low).", location), display, :scorecard)
       end
 
       if data[:version_yanked]
-        out << mark_suppressed(result("SA007", name, "#{name} #{version}: this version has been yanked from RubyGems.", location), name, :yanked)
+        out << mark_suppressed(result("SA007", name, "#{display} #{version}: this version has been yanked from RubyGems.", location), display, :yanked)
       end
 
       if data[:poison] && !Array(data[:constraints]).empty?
@@ -151,7 +181,7 @@ module StillActive
         else
           "maintenance"
         end
-        out << mark_suppressed(result("SA008", name, poison_message(name, version, data), location, level: poison_level(data), fp_extra: state), name, :poison)
+        out << mark_suppressed(result("SA008", name, poison_message(display, version, data), location, level: poison_level(data), fp_extra: state), display, :poison)
       end
 
       if data[:language_ceiling]
@@ -163,7 +193,7 @@ module StillActive
         # silently mute the critical -- that transition is exactly the one a human
         # must see.
         state = data[:language_ceiling][:eol_forced] ? "eol_forced" : "latest_not_yet"
-        out << mark_suppressed(result("SA009", name, language_ceiling_message(name, version, data), location, level: language_ceiling_level(data), fp_extra: state), name, :language_ceiling)
+        out << mark_suppressed(result("SA009", name, language_ceiling_message(display, version, data), location, level: language_ceiling_level(data), fp_extra: state), display, :language_ceiling)
       end
 
       out
@@ -173,7 +203,7 @@ module StillActive
       { critical: "error", warning: "warning", note: "note" }.fetch(data[:language_ceiling][:severity], "note")
     end
 
-    def language_ceiling_message(name, version, data)
+    def language_ceiling_message(display, version, data)
       ceiling = data[:language_ceiling]
       runtime = ceiling[:runtime]
       body =
@@ -185,7 +215,7 @@ module StillActive
           "no #{runtime} #{ceiling[:latest_stable]} support yet"
         end
       fix = ceiling[:fixed_by_upgrade] && data[:latest_version] ? "; upgrade to #{data[:latest_version]} to lift it" : ""
-      "#{name} #{version}: requires #{runtime} #{ceiling[:requirement]}, #{body}#{fix}#{transitive_suffix(data)}."
+      "#{display} #{version}: requires #{runtime} #{ceiling[:requirement]}, #{body}#{fix}#{transitive_suffix(data)}."
     end
 
     # The poison receipt for a Code Scanning alert: the worst 3 caps (shared
@@ -203,7 +233,7 @@ module StillActive
       { critical: "error", warning: "warning", note: "note" }.fetch(data[:poison_severity], "warning")
     end
 
-    def poison_message(name, version, data)
+    def poison_message(display, version, data)
       top = ConstraintHelper.top_findings(Array(data[:constraints]), limit: 3)
       caps = top[:shown].map do |finding|
         behind = finding[:majors_behind]
@@ -211,7 +241,7 @@ module StillActive
       end
       remaining = top[:total] - top[:shown].length
       caps << "+#{remaining} more" if remaining.positive?
-      "#{name} #{version}: caps #{caps.join("; ")}#{transitive_suffix(data)}#{poison_security_note(data)}."
+      "#{display} #{version}: caps #{caps.join("; ")}#{transitive_suffix(data)}#{poison_security_note(data)}."
     end
 
     # Spells out the security escalation for a code-scanning alert. Only claims
@@ -254,6 +284,10 @@ module StillActive
     end
 
     def vulnerability_result(name, version, vuln, location, data = {})
+      # `name` (the version-distinct hash key) fingerprints the finding; `display`
+      # (version-independent "ecosystem/name") is what the message shows and the
+      # suppression matches. See gem_results for why the two differ.
+      display = DependencyHelper.identity(name, data)
       # Level tracks the resolved severity LABEL (a real CVSS score OR OSV's GHSA
       # label), so a CVSS-4-only HIGH -- which deps.dev returns as cvss3Score 0 --
       # exports as error, not a note/warning a code-scanning gate reads as
@@ -274,13 +308,13 @@ module StillActive
       base = result(
         "SA003",
         name,
-        "#{name} #{version}: #{advisory_id}#{title}#{alias_suffix}#{no_fix}#{transitive_suffix(data)}.",
+        "#{display} #{version}: #{advisory_id}#{title}#{alias_suffix}#{no_fix}#{transitive_suffix(data)}.",
         location,
         level: level,
         fp_extra: advisory_id,
       )
       base["properties"] = { "security-severity" => severity } if severity
-      mark_suppressed(base, name, :vulnerability, advisory: vuln[:id], aliases: Array(vuln[:aliases]))
+      mark_suppressed(base, display, :vulnerability, advisory: vuln[:id], aliases: Array(vuln[:aliases]))
     end
 
     # Names the direct dependency a transitive flagged gem rides in on, so a

data/lib/helpers/terminal_helper.rb

@@ -3,6 +3,7 @@
 require_relative "activity_helper"
 require_relative "ansi_helper"
 require_relative "constraint_helper"
+require_relative "dependency_helper"
 require_relative "summary_helper"
 require_relative "libyear_helper"
 require_relative "version_helper"
@@ -34,9 +35,16 @@ module StillActive
 
     private
 
+    # "dependencies" for a cross-ecosystem SBOM audit (the lens sets :ecosystem),
+    # "gems" for a native Ruby audit -- calling npm/cargo/go packages "gems" is a
+    # Ruby-ism that reads wrong cross-ecosystem.
+    def dependency_noun(result)
+      result.each_value.any? { |data| data[:ecosystem] } ? "dependencies" : "gems"
+    end
+
     def build_row(name, data)
       [
-        name,
+        DependencyHelper.identity(name, data),
         format_version(data),
         format_activity(data),
         format_scorecard(data[:scorecard_score]),
@@ -64,9 +72,15 @@ module StillActive
       return AnsiHelper.dim("-") if used.nil? && latest.nil?
       return AnsiHelper.red("#{used} (YANKED)") if data[:version_yanked]
 
-      if VersionHelper.up_to_date(version_used: used, latest_version: latest)
+      # up_to_date is tri-state: true (on latest), false (genuinely behind), or nil
+      # (a version Gem::Version can't parse -- a pypi epoch, an exotic build string).
+      # Only paint the "-> latest" upgrade arrow on a definite false; a nil means we
+      # couldn't compare, so show the version plainly rather than a false "behind"
+      # (markdown shows unsure via its emoji tri-state for the same case).
+      current = VersionHelper.up_to_date(version_used: used, latest_version: latest)
+      if current
         AnsiHelper.green("#{used} (latest)")
-      elsif latest
+      elsif current == false && latest
         AnsiHelper.yellow("#{used} → #{latest}")
       else
         used.to_s
@@ -318,7 +332,7 @@ module StillActive
       archived = summary[:activity][:archived]
       yanked = result.each_value.count { |d| d[:version_yanked] }
 
-      parts = ["#{summary[:total_gems]} gems: #{summary[:up_to_date]} up to date, #{summary[:outdated]} outdated"]
+      parts = ["#{summary[:total_gems]} #{dependency_noun(result)}: #{summary[:up_to_date]} up to date, #{summary[:outdated]} outdated"]
       parts.last << ", #{yanked} yanked" if yanked > 0
       activity = "#{active} active, #{stale} stale"
       activity << ", #{archived} archived" if archived > 0

data/lib/helpers/version_helper.rb

@@ -52,6 +52,14 @@ module StillActive
         .any? { |v| used >= v }
     end
 
+    # A Gem::Version for cross-ecosystem comparison (leading "v" and SemVer build
+    # metadata normalized away), or nil when the string can't be parsed. Public so
+    # the deps.dev client can rank a package's versions to find the real latest
+    # stable rather than trusting deps.dev's unreliable `isDefault` flag.
+    def comparable(version_string)
+      to_gem_version(version_string)
+    end
+
     def gem_version(version_hash:)
       version_hash&.dig("number")
     end
@@ -88,7 +96,20 @@ module StillActive
 
     def to_gem_version(version)
       str = normalize_version(version)
-      Gem::Version.new(str) if str && Gem::Version.correct?(str)
+      return unless str
+
+      # Normalize two cross-ecosystem shapes Gem::Version can't parse, so a
+      # current dependency compares as up to date instead of reading "behind":
+      #   - a leading "v" (Go module versions, "v2.0.1")
+      #   - SemVer build metadata (cargo's "1.0.4+wasi-0.2.12"), everything from the
+      #     first "+", which SemVer 2.0.0 sec 10 says MUST be ignored for precedence
+      # rubygems/npm/pypi versions are digit-first with no "+", so this is a no-op.
+      # Sliced by index rather than a regex (/\+.*/ on the external version string
+      # trips a polynomial-ReDoS scanner, and this is provably linear anyway).
+      str = str.delete_prefix("v")
+      plus = str.index("+")
+      str = str[0, plus] if plus
+      Gem::Version.new(str) if Gem::Version.correct?(str)
     end
   end
 end

data/lib/still_active/cli.rb

@@ -8,6 +8,7 @@ require_relative "../helpers/bot_context"
 require_relative "../helpers/bundler_helper"
 require_relative "../helpers/constraint_helper"
 require_relative "../helpers/cyclonedx_helper"
+require_relative "../helpers/dependency_helper"
 require_relative "../helpers/diff_markdown_helper"
 require_relative "../helpers/emoji_helper"
 require_relative "../helpers/markdown_helper"
@@ -140,11 +141,58 @@ module StillActive
       # assessment-time failure (a raised lens call) both mean "not assessed":
       # surface them together so neither is a silent hole in the reported coverage.
       unassessable = sbom.unassessable + outcome.failures
-      emit_sbom_json(outcome.assessed, unassessable)
+      render_sbom_output(outcome.assessed, unassessable, path)
       warn_unassessable(unassessable)
       check_exit_status(outcome.assessed)
     end
 
+    # The assessment is the same per-dependency shape whether the input was a
+    # Gemfile or an SBOM, so the SBOM path honours the same output-format flags
+    # rather than forcing JSON. SARIF and markdown are the two that matter for the
+    # cross-ecosystem/CI use case; JSON stays the piped default. Two formats need
+    # the native Ruby audit's shape (a lockfile to annotate for SARIF's line
+    # numbers, a gems/ruby snapshot for the diff), which a cross-ecosystem SBOM
+    # can't honestly supply, so they error loudly rather than silently falling
+    # back to JSON: --baseline (diff) and --cyclonedx (SBOM in, SBOM out would
+    # need per-ecosystem PURL reconstruction; the honest way to add it later is to
+    # thread the input SBOM's own PURLs through rather than rebuild them).
+    def render_sbom_output(result, unassessable, sbom_path)
+      config = StillActive.config
+      if config.baseline_path
+        unsupported_sbom_format!("--baseline")
+      elsif config.cyclonedx_path
+        unsupported_sbom_format!("--cyclonedx")
+      elsif config.sarif_path
+        emit_sbom_sarif(result, config.sarif_path, sbom_path)
+      else
+        case resolve_format
+        when :json then emit_sbom_json(result, unassessable)
+        when :terminal then puts TerminalHelper.render(result)
+        when :markdown then render_markdown(result)
+        end
+      end
+    end
+
+    def unsupported_sbom_format!(flag)
+      $stderr.puts("error: #{flag} output is not supported in --sbom mode (it needs the native Ruby audit's lockfile/snapshot, which a cross-ecosystem SBOM can't supply); use --sarif, --markdown, --terminal, or --json")
+      exit(2)
+    end
+
+    def emit_sbom_sarif(result, sarif_path, sbom_path)
+      sarif_json = SarifHelper.render_sbom(
+        result: result,
+        source_uri: File.basename(sbom_path),
+        tool_version: StillActive::VERSION,
+      )
+
+      write_output(sarif_path, sarif_json)
+    end
+
+    # "-" means stdout (the SARIF/CycloneDX convention); any other PATH is a file.
+    def write_output(path, content)
+      path == "-" ? puts(content) : File.write(path, content)
+    end
+
     # SbomReader never raises (a malformed file degrades to an empty result), which
     # is right for the library entrypoint but wrong for the explicit --sbom flag:
     # the user pointed at a file to audit, so a truncated/wrong-format one must
@@ -271,11 +319,7 @@ module StillActive
         tool_version: StillActive::VERSION,
       )
 
-      if sarif_path == "-"
-        puts sarif_json
-      else
-        File.write(sarif_path, sarif_json)
-      end
+      write_output(sarif_path, sarif_json)
     end
 
     def emit_cyclonedx(result, ruby_info, cyclonedx_path)
@@ -286,11 +330,7 @@ module StillActive
         spec_version: StillActive.config.cyclonedx_version,
       )
 
-      if cyclonedx_path == "-"
-        puts sbom
-      else
-        File.write(cyclonedx_path, sbom)
-      end
+      write_output(cyclonedx_path, sbom)
     end
 
     # Mirrors Bundler's convention: gems.rb -> gems.locked, otherwise <gemfile>.lock.
@@ -394,7 +434,10 @@ module StillActive
       return unless config.fail_if_critical || config.fail_if_warning || config.fail_if_vulnerable || config.fail_if_outdated || config.fail_if_poison || config.fail_if_language_ceiling
 
       warn_unknown_severity_gate(result, config)
-      exit(1) if result.any? { |name, data| gate_failed?(name, data, config) }
+      # Match the gate on the dependency's identity (bare gem name natively,
+      # "ecosystem/name" for an SBOM dep), not the composite SBOM hash key, so an
+      # --ignore/.still_active.yml entry actually covers a cross-ecosystem finding.
+      exit(1) if result.any? { |name, data| gate_failed?(DependencyHelper.identity(name, data), data, config) }
     end
 
     # --fail-if-vulnerable=<threshold> fails closed on an advisory with no CVSS
@@ -409,14 +452,15 @@ module StillActive
 
       suppressions = config.suppressions
       result.each do |name, data|
-        next if config.ignored_gems.include?(name)
+        gem = DependencyHelper.identity(name, data)
+        next if config.ignored_gems.include?(gem)
 
-        unknown = live_advisories(name, data, suppressions).select { |vuln| VulnerabilityHelper.unknown_severity?(vuln) }
+        unknown = live_advisories(gem, data, suppressions).select { |vuln| VulnerabilityHelper.unknown_severity?(vuln) }
         next if unknown.empty?
 
         ids = unknown.filter_map { |vuln| vuln[:id] }.join(", ")
         labelled = ids.empty? ? "" : " (#{ids})"
-        $stderr.puts("warning: #{name} has an advisory of unknown severity#{labelled}; failing --fail-if-vulnerable=#{threshold} because it can't be ruled out below the threshold (review, then fix or suppress it in .still_active.yml)")
+        $stderr.puts("warning: #{gem} has an advisory of unknown severity#{labelled}; failing --fail-if-vulnerable=#{threshold} because it can't be ruled out below the threshold (review, then fix or suppress it in .still_active.yml)")
       end
     end
 

data/lib/still_active/deps_dev_client.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require_relative "../helpers/http_helper"
+require_relative "../helpers/version_helper"
 
 module StillActive
   module DepsDevClient
@@ -61,12 +62,36 @@ module StillActive
       versions = body["versions"]
       return unless versions.is_a?(Array) && !versions.empty?
 
-      entry = versions.find { |v| v.is_a?(Hash) && v["isDefault"] } || newest_version(versions)
+      # deps.dev's `isDefault` is NOT reliably the latest release: cargo/wasi flags
+      # 0.7.0 (2019) while 0.14.7 (2025) ships, and pypi/httpx flags a 1.0.0.dev3
+      # prerelease over the 0.28.1 stable. Trusting it reads an active package as
+      # years-stale (a false SA002 "abandoned") and paints a downgrade as an
+      # upgrade. So rank by version and take the newest STABLE release; fall back to
+      # isDefault, then newest-by-date, only when no stable version parses (a
+      # genuinely prerelease-only package still reads active, not dormant).
+      entry = latest_stable_version(versions) ||
+        versions.find { |v| v.is_a?(Hash) && v["isDefault"] } ||
+        newest_version(versions)
       return if entry.nil?
 
       { version: entry.dig("versionKey", "version"), published_at: entry["publishedAt"] }
     end
 
+    # The newest non-prerelease version by version number (not publishedAt: a
+    # backported patch on an old line can post-date the latest major). nil when no
+    # version parses as a stable release.
+    def latest_stable_version(versions)
+      versions
+        .filter_map do |v|
+          next unless v.is_a?(Hash) && !v["isDeprecated"]
+
+          gem_version = VersionHelper.comparable(v.dig("versionKey", "version"))
+          [gem_version, v] if gem_version && !gem_version.prerelease?
+        end
+        .max_by(&:first)
+        &.last
+    end
+
     # The package's most recent release date (ISO8601 string), or nil. This is
     # the cross-ecosystem freshness signal, and deps.dev's publishedAt is more
     # reliable than ecosyste.ms's latest_release_published_at, which can lag badly
@@ -96,6 +121,21 @@ module StillActive
       }
     end
 
+    # The NuGet target framework monikers a version declares (net6.0, net45,
+    # netstandard2.0, ...), or [] when unknown. On the NuGet-specific
+    # `:requirements` endpoint, not the version endpoint. The language-runtime
+    # ceiling (SA009) reads these to detect a package that targets only EOL .NET
+    # runtimes. Degrades to [] on 404/failure, never raising.
+    def target_frameworks(name:, version:)
+      return [] if name.nil? || version.nil?
+
+      path = "/v3alpha/systems/nuget/packages/#{encode(name)}/versions/#{encode(version)}:requirements"
+      body = HttpHelper.get_json(BASE_URI, path)
+      return [] if body.nil?
+
+      Array(body.dig("nuget", "targetFrameworks")).grep(String)
+    end
+
     def advisory_detail(advisory_id:)
       return if advisory_id.nil?
 
@@ -176,6 +216,14 @@ module StillActive
     # Trims a repo URL's path to just the project. On GitLab the project path
     # ends at the "/-/" separator (before tree/blob/etc) and may be nested;
     # elsewhere it's owner/repo. Drops trailing slashes and a ".git" suffix.
+    # github.com top-level paths that are not user/org repositories; deps.dev
+    # occasionally returns one as SOURCE_REPO (a github.com/sponsors/<user> funding
+    # link). Parsing it as owner/repo yields a 404 and a blank repo cell, so treat a
+    # reserved first segment as "no repo" rather than a bogus lookup.
+    GITHUB_RESERVED_PATHS = [
+      "sponsors", "orgs", "marketplace", "apps", "topics", "settings", "notifications", "about", "pricing", "features", "security", "contact",
+    ].freeze
+
     def repo_path_segments(host, segments)
       segments = segments.reject(&:empty?)
 
@@ -183,6 +231,8 @@ module StillActive
         separator = segments.index("-")
         segments = segments[0...separator] if separator
       else
+        return [] if host.to_s.casecmp?("github.com") && GITHUB_RESERVED_PATHS.include?(segments.first&.downcase)
+
         segments = segments.first(2)
       end
 
@@ -196,7 +246,7 @@ module StillActive
     # is chronological), and a dated release always wins over an undated one.
     def newest_version(versions)
       versions
-        .select { |v| v.is_a?(Hash) && v["publishedAt"] }
+        .select { |v| v.is_a?(Hash) && v["publishedAt"] && !v["isDeprecated"] }
         .max_by { |v| v["publishedAt"].to_s }
     end
 

data/lib/still_active/ecosystem_lens.rb

@@ -8,6 +8,7 @@ require_relative "pypi_client"
 require "time"
 require_relative "../helpers/activity_helper"
 require_relative "../helpers/constraint_helper"
+require_relative "../helpers/dotnet_helper"
 require_relative "../helpers/libyear_helper"
 require_relative "../helpers/pep440_helper"
 require_relative "../helpers/runtime_ceiling_helper"
@@ -52,7 +53,7 @@ module StillActive
     # deps.dev; silence beats a false "holds your tree hostage".
     FLAT_RESOLUTION_ECOSYSTEMS = [:rubygems, :pypi].freeze
 
-    def assess(ecosystem:, name:, version:, constraint_cache: {}, python_range: nil)
+    def assess(ecosystem:, name:, version:, constraint_cache: {}, runtime_ranges: {})
       info = DepsDevClient.version_info(gem_name: name, version: version, system: ecosystem)
       default = DepsDevClient.default_version_info(name: name, system: ecosystem)
       # Retry the version lookup once when it came back empty but the package DID
@@ -87,6 +88,10 @@ module StillActive
         name: name,
         version_used: version,
         version_used_release_date: used_release_date,
+        # The latest stable version string, so the shared formatters can render
+        # the "behind X"/up-to-date delta cross-ecosystem the same way the native
+        # path does. nil when deps.dev has no default version for the package.
+        latest_version: latest_version,
         latest_version_release_date: latest_release_date,
         # libyear parity with the native path: how far behind latest the locked
         # version is, in release-years. Both dates come from deps.dev responses
@@ -109,7 +114,7 @@ module StillActive
       }
       gem_data[:version_unresolved] = true if version_unresolved
       attach_constraints(gem_data, ecosystem: ecosystem, name: name, version: version, cache: constraint_cache)
-      attach_language_ceiling(gem_data, ecosystem: ecosystem, name: name, version: version, latest_version: default&.dig(:version), python_range: python_range)
+      attach_language_ceiling(gem_data, ecosystem: ecosystem, name: name, version: version, latest_version: default&.dig(:version), runtime_ranges: runtime_ranges)
       gem_data
     end
 
@@ -124,9 +129,17 @@ module StillActive
     # pypi package; other ecosystems carry no ceiling here rather than a wrong one
     # (cargo's rust_version is a soft MSRV hint, not an install wall). Best-effort:
     # a nil range (endoflife feed down) or absent requires_python yields nothing.
-    def attach_language_ceiling(gem_data, ecosystem:, name:, version:, latest_version:, python_range:)
+    def attach_language_ceiling(gem_data, ecosystem:, name:, version:, latest_version:, runtime_ranges:)
+      finding =
+        case ecosystem
+        when :pypi then python_ceiling(name: name, version: version, latest_version: latest_version, python_range: runtime_ranges[:python])
+        when :nuget then dotnet_ceiling(name: name, version: version, latest_version: latest_version, dotnet: runtime_ranges[:dotnet], dotnetfx: runtime_ranges[:dotnetfx])
+        end
+      gem_data[:language_ceiling] = finding if finding
+    end
+
+    def python_ceiling(name:, version:, latest_version:, python_range:)
       return if python_range.nil?
-      return unless ecosystem == :pypi
 
       requirement = Pep440Helper.to_gem_requirement_string(PypiClient.requires_python(name: name, version: version))
       finding = requirement && RuntimeCeilingHelper.analyze(requirement: requirement, support_window: python_range)
@@ -134,7 +147,36 @@ module StillActive
 
       finding[:runtime] = "Python"
       finding[:fixed_by_upgrade] = python_ceiling_lifted_by_upgrade?(name: name, version: version, latest_version: latest_version, python_range: python_range)
-      gem_data[:language_ceiling] = finding
+      finding
+    end
+
+    # The .NET ceiling: a NuGet package whose ONLY runtime targets are end-of-life
+    # frameworks caps you onto a dead runtime (a restore-time NU1202 wall). Unlike
+    # Python's requires_python range, .NET declares a SET of target frameworks;
+    # DotnetHelper carries the set logic and the netstandard escape-hatch rule.
+    def dotnet_ceiling(name:, version:, latest_version:, dotnet:, dotnetfx:)
+      return if dotnet.nil? && dotnetfx.nil?
+
+      frameworks = DepsDevClient.target_frameworks(name: name, version: version)
+      return if frameworks.empty?
+
+      finding = DotnetHelper.analyze(target_frameworks: frameworks, dotnet: dotnet, dotnetfx: dotnetfx)
+      return if finding.nil?
+
+      finding[:fixed_by_upgrade] = dotnet_ceiling_lifted_by_upgrade?(name: name, version: version, latest_version: latest_version, dotnet: dotnet, dotnetfx: dotnetfx)
+      finding
+    end
+
+    # Positive confirmation, like the Python check: only claim an upgrade lifts the
+    # ceiling when the latest version's targets ACTUALLY clear it (a fresh fetch),
+    # never inferring "safe to bump" from a failed lookup.
+    def dotnet_ceiling_lifted_by_upgrade?(name:, version:, latest_version:, dotnet:, dotnetfx:)
+      return false if latest_version.nil? || latest_version == version
+
+      latest_frameworks = DepsDevClient.target_frameworks(name: name, version: latest_version)
+      return false if latest_frameworks.empty?
+
+      DotnetHelper.analyze(target_frameworks: latest_frameworks, dotnet: dotnet, dotnetfx: dotnetfx).nil?
     end
 
     # Does upgrading the package to its latest release lift the cap? Requires

data/lib/still_active/options.rb

@@ -62,7 +62,7 @@ module StillActive
     end
 
     def add_sbom_option(opts)
-      opts.on("--sbom=PATH", String, "audit a CycloneDX SBOM cross-ecosystem (npm/pypi/cargo/go/maven/nuget) instead of a Gemfile; JSON output") do |value|
+      opts.on("--sbom=PATH", String, "audit a CycloneDX SBOM cross-ecosystem (npm/pypi/cargo/go/maven/nuget) instead of a Gemfile; honours --sarif/--markdown/--terminal/--json") do |value|
         options[:provided_sbom] = true
         StillActive.config { |config| config.sbom_path = value }
       end

data/lib/still_active/sbom_workflow.rb

@@ -4,6 +4,7 @@ require_relative "ecosystem_lens"
 require_relative "ceiling_reconciler"
 require_relative "poison_security_correlator"
 require_relative "../helpers/python_helper"
+require_relative "../helpers/dotnet_helper"
 require "async"
 require "async/barrier"
 require "async/semaphore"
@@ -32,16 +33,15 @@ module StillActive
     def call(sbom_result, &on_progress)
       dependencies = sbom_result.dependencies
       Async do
-        # The Python runtime support window, fetched once for the whole SBOM (the
-        # language-ceiling input for pypi deps). Guarded like the native Ruby path:
-        # a feed failure degrades to "no ceiling checks", never aborts the audit.
-        python_range =
-          begin
-            PythonHelper.supported_python_range
-          rescue StandardError => e
-            $stderr.puts("warning: Python support window lookup failed: #{e.class} (#{e.message}); skipping language-ceiling checks")
-            nil
-          end
+        # The language-runtime support windows, fetched once for the whole SBOM
+        # (pypi reads :python; nuget reads :dotnet/:dotnetfx). Guarded per feed like
+        # the native Ruby path: a feed failure degrades to "no ceiling checks" for
+        # that runtime, never aborts the audit.
+        runtime_ranges = {
+          python: safe_support_window("Python") { PythonHelper.supported_python_range },
+          dotnet: safe_support_window(".NET") { DotnetHelper.supported_dotnet_range },
+          dotnetfx: safe_support_window(".NET Framework") { DotnetHelper.supported_dotnetfx_range },
+        }
         barrier = Async::Barrier.new
         semaphore = Async::Semaphore.new(StillActive.config.parallelism, parent: barrier)
         result = {}
@@ -61,7 +61,7 @@ module StillActive
             # when the SBOM actually marked it (SbomReader leaves the key absent
             # otherwise): absent stays "unknown", never a false that reads as test-only.
             result["#{dep[:ecosystem]}/#{dep[:name]}@#{dep[:version]}"] =
-              EcosystemLens.assess(ecosystem: dep[:ecosystem], name: dep[:name], version: dep[:version], constraint_cache: constraint_cache, python_range: python_range)
+              EcosystemLens.assess(ecosystem: dep[:ecosystem], name: dep[:name], version: dep[:version], constraint_cache: constraint_cache, runtime_ranges: runtime_ranges)
                 .merge(dep.slice(:production))
           rescue StandardError => e
             # One dependency's failure must not abort the audit, but it must not
@@ -92,5 +92,16 @@ module StillActive
         )
       end.wait
     end
+
+    private
+
+    # Fetch one runtime's support window, degrading a feed failure to nil (no
+    # ceiling checks for that runtime) with a warning, never aborting the audit.
+    def safe_support_window(label)
+      yield
+    rescue StandardError => e
+      $stderr.puts("warning: #{label} support window lookup failed: #{e.class} (#{e.message}); skipping language-ceiling checks")
+      nil
+    end
   end
 end

data/lib/still_active/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module StillActive
-  VERSION = "3.0.0.rc2"
+  VERSION = "3.0.0.rc3"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: still_active
 version: !ruby/object:Gem::Version
-  version: 3.0.0.rc2
+  version: 3.0.0.rc3
 platform: ruby
 authors:
 - Sean Floyd
@@ -254,7 +254,9 @@ files:
 - lib/helpers/constraint_helper.rb
 - lib/helpers/cvss_helper.rb
 - lib/helpers/cyclonedx_helper.rb
+- lib/helpers/dependency_helper.rb
 - lib/helpers/diff_markdown_helper.rb
+- lib/helpers/dotnet_helper.rb
 - lib/helpers/emoji_helper.rb
 - lib/helpers/endoflife_helper.rb
 - lib/helpers/http_helper.rb