still_active 3.0.0.rc4 → 3.0.0.rc5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e74ec3ec40686e3eab640b852270c36278b33c82b54fdc85fe7bbb43ce551455
-  data.tar.gz: 7304228ba4411b50474cba46dec421c3ce4ff9e53911ea256bef623874d0910c
+  metadata.gz: 23f5514e3d64b78d82b0812eece16e13325045841fdd0b253acff4f7c5e31dae
+  data.tar.gz: b9d8907b6699755744639cc00e31135cf45991416c222990dc79247ae4c2d88f
 SHA512:
-  metadata.gz: 6879718004e7d7a8765c7666f3d68686323873825ddb26240f929ee4b89a3337b0f7880373a34e669a72e545422dbf7a227a8142c9fede87f186e7f40fccfc3a
-  data.tar.gz: 2ed322c87a224e7e0bf2ea644dca8cdb341349b6985c251a47cf4abc62fcb9cef24d3dd6642d78789190aa7d64e1401814d4c1fa2fac7647746d4fef49657794
+  metadata.gz: 4d571b1a3788960da4f6ae9fb04466c00ab6c3c6dcd1bd2051b4d6244aaf8e14248aeb3acc1c4d2179db33d8d18f98e320182ab0cb15635290e1be795c5509f9
+  data.tar.gz: 7071c08ca0bb94ff85edee290d6d55d47247093863f5599a8c56c2899871ef80e424daac09142e2c9978e0efbd5020d493c88abadc28c5a3bd5b303ffcea6003

data/CHANGELOG.md

@@ -18,6 +18,7 @@ The new `--fail-if-poison[=TIER]` and `--fail-if-language-ceiling[=TIER]` gates
 
 ### Added
 
+- **Direct private gem sources are now audited, not skipped.** A gem resolving from a private host still_active has no bespoke client for (a direct Contribsys, Gemstash, Gemfury, or a private mirror) previously reported no version data at all. still_active now reads such a source through the RubyGems compact index (`/info/<gem>`, the protocol every Bundler-compatible host serves, which is how `bundle install` resolves from it), so these gems get real version/latest/libyear signals for the first time, falling back to the same "unqueryable" notice only when a host genuinely doesn't serve it. Credentials come from Bundler's own host-keyed store (`bundle config` / `BUNDLE_<HOST>`), so a source URL from a lockfile only ever receives the credential the user configured for that exact host, and still_active's ambient `--artifactory-token` is never sent to a lockfile-derived host (it stays behind its explicit `--artifactory-host` allowlist). The #43 guard is unchanged: a private gem still never borrows a public name-collision's repository or maintenance data.
 - **Poison-pill / compatibility-ceiling signal (SA008).** A dormant or archived package that caps one of its runtime dependencies below that dependency's current latest major holds the tree below a ceiling no upstream release will raise, and it grows more constraining over time as the capped dep ships new majors. still_active flags it with a receipt naming the capped dep, the cap, and how many majors behind it holds you, ranked by a severity tier (`note`/`warning`/`critical`, scaling with majors-behind) and enforceable in CI with `--fail-if-poison[=TIER]`. Rendered in terminal, markdown, and SARIF, and computed for `rubygems` (native) and the flat-resolution SBOM ecosystems. Scoped to flat resolution deliberately: npm nests versions and cargo coexists majors, so a below-latest cap there is subtree-local noise, not a tree-wide block, and is suppressed.
 - **Security "below the fix", the strongest poison case, now cross-ecosystem.** When a dormant/archived package pins a dependency that is *itself* known-vulnerable in the same tree, below the version that patches a HIGH-or-critical advisory, you cannot patch the CVE without replacing the dead capper. still_active leads with these findings (red in terminal/markdown, escalated to `error` in SARIF) and names the advisory and its nearest fix. This case travels to **npm and cargo** at patch precision (their fixes are mostly same-major patch bumps, invisible to a major-level check), via a real node-semver/Cargo matcher and a tree-copy soundness guard that only fires when every resolved copy the constraint governs is vulnerable (a safe copy elsewhere, or a patched copy the cap can reach, clears it). The correlation is whole-tree from data already assembled, no extra fetches.
 - **Language-runtime ceiling signal (SA009), poison's sibling.** A pinned dependency version can strand you on an end-of-life language runtime (its `required_ruby_version` / `requires_python` forbids a supported one). still_active flags it against the runtime's EOL schedule (from endoflife.date), enforceable with `--fail-if-language-ceiling[=TIER]`, and reconciled against poison so an "upgrade to lift the ceiling" can't contradict a cap that forbids that upgrade. Ruby on the native path; **Python** (`requires_python`) and **.NET/NuGet** on the `--sbom` path. .NET is shaped differently: a package declares a SET of target frameworks, and consuming one is a restore-time wall (NU1202), so the ceiling fires only when every concrete runtime target is end-of-life. A `netstandard` target is the escape hatch (consumable from a current .NET), so its presence never fires, keeping the signal off nearly every modern library; `.NET Framework` (4.x) and `.NET` (Core/5+) are checked against their separate EOL calendars.
@@ -33,6 +34,8 @@ The new `--fail-if-poison[=TIER]` and `--fail-if-language-ceiling[=TIER]` gates
 
 ### Fixed
 
+- **A private-source gem is no longer linked to the public rubygems.org page.** `ruby_gems_url` was set to `rubygems.org/gems/<name>` for any gem with versions, including one resolving from a private source, where that URL is a public name collision (for `sidekiq-pro`, the `0.0.3` squat-warning decoy) rather than the gem the user installs. It is now set only for a gem that actually lives on public rubygems.org, the same #43 guard the repository-URL substitution already applies.
+- **An Artifactory-sourced gem is no longer reported `(YANKED)` when its real host is a legacy private registry.** Artifactory's `/api/v1/versions/<gem>.json` merges metadata from a virtual repo's member remotes; when a member (a legacy host like Contribsys) can't answer it, the merge returns only whatever rubygems.org holds for the name, which for `sidekiq-pro` is a `0.0.3` squat-warning placeholder. still_active read that endpoint first, so the installed version was absent from the list and looked yanked. It now reads the RubyGems compact index (`/info/<gem>`, what Bundler resolves through) instead, listing exactly the versions the repo can resolve, with the versions API demoted to dating those versions and AQL kept only as a last resort for hosts serving no compact index (and no longer presenting its cache timestamp as a release date). A side benefit: the compact index's per-version Ruby requirement and dependency constraints let the runtime-ceiling and poison-pill checks work on Artifactory sources for the first time.
 - **SARIF `tool.driver` version fields are populated and spec-correct.** `version` was null, so a consumer reading `tool.driver.version` (rather than `semanticVersion`) saw nothing, and `semanticVersion` carried the RubyGems version verbatim (`3.0.0.rc4`), which is not valid SemVer 2.0.0 for a prerelease. Now `version` carries the free-form gem version and `semanticVersion` the SemVer form (`3.0.0-rc4`); final releases like `3.0.0` were already valid.
 - **Cross-ecosystem SARIF no longer reads as a Ruby audit.** The `--sbom` path emitted the native Gemfile audit's Ruby-worded SARIF rule catalog, so a Go/npm/pypi repo's GitHub Code Scanning alerts were titled "Gem source repository is archived", advised `bundle update <gem>`, and referenced `Gemfile.lock`/RubyGems in the rule detail. The catalog now has an ecosystem-neutral flavour for SBOM runs (titles and guidance say "package"/"dependency"), and the native-only SA006 (Ruby runtime EOL), which the cross-ecosystem path can never emit, is dropped from the SBOM catalog rather than advertised in a non-Ruby repo. Per-result finding messages were already neutral; this fixes the rule metadata GitHub renders as the alert title and detail. The native Gemfile SARIF is unchanged (still `gem`-worded, SA006 present).
 - **A stale pre-release no longer corrupts the up-to-date signal.** A pre-release older than the latest stable (an `8.1.0.rc1` still listed after `8.1.2` shipped, or a decade-old `rc` on a gem long past it) was treated as a live upgrade target: `up_to_date` compares the version in hand against it, so any current version read as up to date and a gem that was actually behind got the "futurist" marker, while the pre-release column filled with superseded rcs. The latest pre-release is now kept only when strictly newer than the latest stable (or when there is no stable release at all, where it is the only signal), so the column, the `up_to_date` field, and the emoji agree. Genuine upcoming pre-releases still surface. On a real bundle this was mislabelling roughly twenty gems.

data/lib/helpers/activity_helper.rb

@@ -19,12 +19,12 @@ module StillActive
     def last_activity(gem_data)
       release = [
         gem_data[:latest_version_release_date],
-        gem_data[:latest_pre_release_version_release_date],
+        gem_data[:latest_pre_release_version_release_date]
       ].filter_map { parse_time(_1) }.max
-      return { date: release, kind: :release } if release
+      return {date: release, kind: :release} if release
 
       commit = parse_time(gem_data[:last_commit_date])
-      commit ? { date: commit, kind: :commit } : nil
+      commit ? {date: commit, kind: :commit} : nil
     end
 
     # Coerce a Time or an iso8601-ish string (the SARIF path may supply either)

data/lib/helpers/alternatives_helper.rb

@@ -35,7 +35,7 @@ module StillActive
     def downloads(gem_name)
       info = Gems.info(gem_name)
       info && info["downloads"]
-    rescue StandardError
+    rescue
       nil
     end
   end

data/lib/helpers/ansi_helper.rb

@@ -19,7 +19,7 @@ module StillActive
 
     def pad(text, width)
       padding = width - visible_length(text)
-      padding > 0 ? "#{text}#{" " * padding}" : text
+      (padding > 0) ? "#{text}#{" " * padding}" : text
     end
   end
 end

data/lib/helpers/bot_context.rb

@@ -22,7 +22,7 @@ module StillActive
     # commits ("Update README to mention SARIF"), so we anchor on the v-prefixed
     # version. False negatives (a no-`v` Renovate config) are acceptable; false
     # positives are not. The `v` is consumed, so the captured version excludes it.
-    RENOVATE_SUBJECT = /\A(?:(?:chore|fix|build)\(deps(?:-dev)?\):\s*)?update (?:dependency )?(\S+) to v(\d[\w.\-]*)/i
+    RENOVATE_SUBJECT = /\A(?:(?:chore|fix|build)\(deps(?:-dev)?\):\s*)?update (?:dependency )?(\S+) to v(\d[\w.-]*)/i
 
     # Unanchored variants used only to EXTRACT the bump *after* a bot is already
     # confirmed (via GITHUB_ACTOR / branch / the anchored subject above). Because
@@ -30,7 +30,7 @@ module StillActive
     # prefix or scope Dependabot/Renovate is configured with and just find the
     # "bump X from Y to Z" / "update X to vN" skeleton anywhere in the subject.
     DEPENDABOT_BUMP = /bump (\S+) from (\S+) to (\S+)/i
-    RENOVATE_BUMP = /update (?:dependency )?(\S+) to v(\d[\w.\-]*)/i
+    RENOVATE_BUMP = /update (?:dependency )?(\S+) to v(\d[\w.-]*)/i
 
     # Returns { bot: "dependabot" | "renovate", bumps: [{ gem:, from:, to: }] }
     # or nil when no bot signal is present. `bumps` is parsed from the head
@@ -39,12 +39,12 @@ module StillActive
       bot = detect_bot(env: env, head_subject: head_subject)
       return if bot.nil?
 
-      { bot: bot, bumps: bumps_from(bot, head_subject) }
+      {bot: bot, bumps: bumps_from(bot, head_subject)}
     end
 
     # A one-line, format-agnostic narrative for the detected context.
     def summary(context)
-      label = context[:bot] == "renovate" ? "Renovate" : "Dependabot"
+      label = (context[:bot] == "renovate") ? "Renovate" : "Dependabot"
       bumps = context[:bumps]
 
       case bumps.length
@@ -98,9 +98,9 @@ module StillActive
       return [] if subject.nil?
 
       if bot == "dependabot" && (match = subject.match(DEPENDABOT_BUMP))
-        [{ gem: match[1], from: match[2], to: match[3] }]
+        [{gem: match[1], from: match[2], to: match[3]}]
       elsif bot == "renovate" && (match = subject.match(RENOVATE_BUMP))
-        [{ gem: match[1], from: nil, to: match[2] }]
+        [{gem: match[1], from: nil, to: match[2]}]
       else
         []
       end
@@ -108,7 +108,7 @@ module StillActive
 
     def single_bump_summary(label, bump)
       arrow = bump[:from] ? "#{bump[:from]} → #{bump[:to]}" : "→ #{bump[:to]}"
-      verb = label == "Renovate" ? "update" : "bump"
+      verb = (label == "Renovate") ? "update" : "bump"
       "#{label} #{verb}: #{bump[:gem]} #{arrow}"
     end
 

data/lib/helpers/bundler_helper.rb

@@ -1,6 +1,5 @@
 # frozen_string_literal: true
 
-require "set"
 require_relative "lockfile_dependency_parser"
 
 module StillActive
@@ -41,7 +40,7 @@ module StillActive
             source_type: spec.source_type || :unknown,
             source_uri: spec.source_uri,
             direct: is_direct,
-            dependency_path: is_direct ? nil : paths[spec.name],
+            dependency_path: is_direct ? nil : paths[spec.name]
           }
         end
     end

data/lib/helpers/catalog_index.rb

@@ -27,7 +27,7 @@ module StillActive
       index = build_index(blob)
       write_cache(index)
       index
-    rescue StandardError => e
+    rescue => e
       warn("still_active: could not load Ruby Toolbox catalog for alternatives (#{e.class}); skipping leads")
       nil
     end

data/lib/helpers/constraint_helper.rb

@@ -45,7 +45,7 @@ module StillActive
 
     # => { kind: :permissive|:ceiling|:exact_pin, majors_behind: Integer }
     def analyze(requirement:, dep_latest:)
-      return { kind: :permissive, majors_behind: 0 } if requirement.to_s.length > MAX_REQUIREMENT_LENGTH
+      return {kind: :permissive, majors_behind: 0} if requirement.to_s.length > MAX_REQUIREMENT_LENGTH
 
       # `||` is an OR-range (npm): satisfied by ANY branch, so an unbounded branch
       # lifts the cap entirely and the effective ceiling is the LOOSEST branch.
@@ -56,11 +56,11 @@ module StillActive
       ceilings = branches.map { |clauses| branch_ceiling(clauses) }
       latest_major = major(dep_latest)
 
-      return { kind: :permissive, majors_behind: 0 } if ceilings.any?(&:nil?)
+      return {kind: :permissive, majors_behind: 0} if ceilings.any?(&:nil?)
 
       behind = latest_major ? [latest_major - ceilings.max, 0].max : 0
-      kind = branches.all? { |clauses| all_exact?(clauses) } ? :exact_pin : :ceiling
-      { kind: kind, majors_behind: behind }
+      kind = (branches.all? { |clauses| all_exact?(clauses) }) ? :exact_pin : :ceiling
+      {kind: kind, majors_behind: behind}
     end
 
     # Severity tiers for a compatibility ceiling, worst-last (mirrors
@@ -150,7 +150,7 @@ module StillActive
           requirement: dep[:requirements],
           dep_latest: dep_latest,
           majors_behind: result[:majors_behind],
-          kind: result[:kind],
+          kind: result[:kind]
         }
       end
     end
@@ -161,7 +161,7 @@ module StillActive
     # by the terminal and markdown renderers so the selection can't drift.
     def top_findings(findings, limit: 3)
       ranked = findings.sort_by { |f| [-f[:majors_behind], f[:dependency].to_s] }
-      { shown: ranked.first(limit), total: findings.length }
+      {shown: ranked.first(limit), total: findings.length}
     end
 
     private

data/lib/helpers/cvss_helper.rb

@@ -27,7 +27,7 @@ module StillActive
 
       cvss = CvssSuite.new(vector.to_s)
       cvss.valid? ? cvss.overall_score : nil
-    rescue StandardError => e
+    rescue => e
       # We only reach here with cvss-suite loaded (available?), so a raise is the
       # installed gem failing this call site -- an incompatible version, a renamed
       # `overall_score` -- not a bad vector, which cvss-suite reports via valid?.
@@ -57,7 +57,7 @@ module StillActive
       return if @warned
 
       @warned = true
-      $stderr.puts("warning: cvss-suite scoring failed: #{error.class} (#{error.message}); CVSS numbers unavailable this run, check your cvss-suite version")
+      warn("warning: cvss-suite scoring failed: #{error.class} (#{error.message}); CVSS numbers unavailable this run, check your cvss-suite version")
     end
   end
 end

data/lib/helpers/cyclonedx_helper.rb

@@ -34,9 +34,9 @@ module StillActive
         "version" => 1,
         "metadata" => {
           "timestamp" => now.iso8601,
-          "tools" => [{ "vendor" => "SeanLF", "name" => "still_active", "version" => tool_version }],
+          "tools" => [{"vendor" => "SeanLF", "name" => "still_active", "version" => tool_version}]
         },
-        "components" => components,
+        "components" => components
       }
       document["vulnerabilities"] = vulnerabilities unless vulnerabilities.empty?
       JSON.pretty_generate(document)
@@ -52,13 +52,13 @@ module StillActive
 
     def gem_component(name, data)
       version = data[:version_used]
-      component = { "type" => "library", "name" => name }
+      component = {"type" => "library", "name" => name}
       component["version"] = version if version
       component["bom-ref"] = bom_ref(name, data)
       component["purl"] = purl(name, version, data[:source_type]) if version
       component["licenses"] = licenses(data[:license]) if data[:license]
       if data[:repository_url]
-        component["externalReferences"] = [{ "type" => "vcs", "url" => data[:repository_url] }]
+        component["externalReferences"] = [{"type" => "vcs", "url" => data[:repository_url]}]
       end
       properties = gem_properties(data)
       component["properties"] = properties unless properties.empty?
@@ -78,7 +78,7 @@ module StillActive
     # false-matching a public gem of the same name; git/rubygems-sourced gems
     # get pkg:gem so a fork still matches the upstream gem's advisories.
     def purl(name, version, source_type)
-      type = source_type == :path ? "generic" : "gem"
+      type = (source_type == :path) ? "generic" : "gem"
       "pkg:#{type}/#{name}@#{version}"
     end
 
@@ -86,7 +86,7 @@ module StillActive
     # display; CycloneDX's license.id must be a single SPDX id, so split back
     # into one entry per license rather than emitting an invalid joined id.
     def licenses(license)
-      license.split(", ").map { |id| { "license" => { "id" => id } } }
+      license.split(", ").map { |id| {"license" => {"id" => id}} }
     end
 
     def gem_properties(data)
@@ -95,8 +95,8 @@ module StillActive
         "still_active:scorecard_score" => data[:scorecard_score]&.to_s,
         "still_active:libyear" => data[:libyear]&.to_s,
         "still_active:last_commit_date" => iso8601(data[:last_commit_date]),
-        "still_active:version_yanked" => boolean_property(data[:version_yanked]),
-      }.filter_map { |name, value| { "name" => name, "value" => value } unless value.nil? }
+        "still_active:version_yanked" => boolean_property(data[:version_yanked])
+      }.filter_map { |name, value| {"name" => name, "value" => value} unless value.nil? }
     end
 
     # The Ruby interpreter. CycloneDX's "platform" type fits semantically, but
@@ -116,9 +116,9 @@ module StillActive
         "purl" => "pkg:generic/ruby@#{version}",
         "cpe" => "cpe:2.3:a:ruby-lang:ruby:#{version}:*:*:*:*:*:*:*",
         "properties" => [
-          { "name" => "still_active:eol", "value" => boolean_property(ruby_info[:eol]) },
-          { "name" => "still_active:libyear", "value" => ruby_info[:libyear]&.to_s },
-        ].reject { |p| p["value"].nil? },
+          {"name" => "still_active:eol", "value" => boolean_property(ruby_info[:eol])},
+          {"name" => "still_active:libyear", "value" => ruby_info[:libyear]&.to_s}
+        ].reject { |p| p["value"].nil? }
       }
     end
 
@@ -133,9 +133,9 @@ module StillActive
       entry = {
         "bom-ref" => "#{advisory[:id]}:#{component_ref}",
         "id" => advisory[:id],
-        "affects" => [{ "ref" => component_ref }],
+        "affects" => [{"ref" => component_ref}]
       }
-      entry["source"] = { "name" => advisory[:source] } if advisory[:source]
+      entry["source"] = {"name" => advisory[:source]} if advisory[:source]
       advisory_rating = rating(advisory)
       entry["ratings"] = [advisory_rating] if advisory_rating
       entry
@@ -148,7 +148,7 @@ module StillActive
       score = VulnerabilityHelper.effective_score(advisory)
       return if score.nil?
 
-      rating = { "score" => score, "severity" => VulnerabilityHelper.highest_severity([advisory]) || "unknown", "method" => rating_method(advisory) }
+      rating = {"score" => score, "severity" => VulnerabilityHelper.highest_severity([advisory]) || "unknown", "method" => rating_method(advisory)}
       vector = advisory[:cvss3_vector] || advisory[:cvss_vector]
       rating["vector"] = vector if vector
       rating

data/lib/helpers/diff_markdown_helper.rb

@@ -16,7 +16,7 @@ module StillActive
       fresher: "fresher",
       older_relative: "older relative to latest",
       neutral: nil,
-      unknown: nil,
+      unknown: nil
     }.freeze
 
     def render(diff, accepted: [])
@@ -31,7 +31,7 @@ module StillActive
         removed_section(diff.removed),
         bumps_section(diff.bumped),
         signal_changes_section(diff.signal_changes),
-        ruby_section(diff.ruby),
+        ruby_section(diff.ruby)
       ].reject(&:empty?)
 
       "#{sections.join("\n")}\n"
@@ -45,7 +45,7 @@ module StillActive
         ["added", diff.added.size],
         ["removed", diff.removed.size],
         ["bumped", diff.bumped.size],
-        ["signal-changes", diff.signal_changes.size],
+        ["signal-changes", diff.signal_changes.size]
       ]
       parts << ["accepted", accepted.size] unless accepted.empty?
       parts.map { |label, n| "#{n} #{label}" }.join(" · ")
@@ -124,7 +124,7 @@ module StillActive
         data["scorecard_score"] && "OpenSSF #{data["scorecard_score"]}",
         (data["vulnerability_count"].to_i.positive? ? "#{data["vulnerability_count"]} vulns" : nil),
         (data["archived"] ? "archived" : nil),
-        data["libyear"] && "#{data["libyear"]}y behind",
+        data["libyear"] && "#{data["libyear"]}y behind"
       ].compact
       "#{MarkdownEscape.code_span(added.name)} (#{MarkdownEscape.inline(bits.join(", "))})"
     end

data/lib/helpers/dotnet_helper.rb

@@ -99,9 +99,9 @@ module StillActive
       finding = {
         requirement: runtimes.map { |r| r[:moniker] }.uniq.sort.join(", "),
         eol_forced: true,
-        runtime: ceiling[:family] == :dotnetfx ? ".NET Framework" : ".NET",
+        runtime: (ceiling[:family] == :dotnetfx) ? ".NET Framework" : ".NET",
         ceiling_version: ceiling[:version].to_s,
-        ceiling_eol_date: ceiling[:cycle][:eol_date],
+        ceiling_eol_date: ceiling[:cycle][:eol_date]
       }
       finding.merge(severity: ConstraintHelper.constraint_severity(finding))
     end
@@ -122,14 +122,14 @@ module StillActive
     def build(family, version)
       return unless version && Gem::Version.correct?(version)
 
-      { family: family, version: Gem::Version.new(version) }
+      {family: family, version: Gem::Version.new(version)}
     end
 
     # The endoflife cycle for a classified target, or nil when the feed is down or
     # the cycle isn't tracked (an ancient net20 predating the feed) -- unknown, not
     # assumed EOL.
     def cycle_for(classification, dotnet:, dotnetfx:)
-      window = classification[:family] == :dotnetfx ? dotnetfx : dotnet
+      window = (classification[:family] == :dotnetfx) ? dotnetfx : dotnet
       return if window.nil?
 
       # Match on the release segment, ignoring any prerelease suffix: endoflife

data/lib/helpers/endoflife_helper.rb

@@ -47,13 +47,13 @@ module StillActive
       # nil (the note is then suppressed) rather than returning nil, which would
       # silently disable criticals too.
       latest = cycles.first["latest"]
-      latest_stable = latest && Gem::Version.correct?(latest) ? Gem::Version.new(latest) : nil
+      latest_stable = (latest && Gem::Version.correct?(latest)) ? Gem::Version.new(latest) : nil
 
       {
         oldest_supported: supported.map { |cycle| cycle[:version] }.min,
         latest_stable: latest_stable,
         latest_stable_fresh: !latest_stable.nil? && latest_stable_fresh?(cycles.first),
-        cycles: normalized,
+        cycles: normalized
       }
     end
 
@@ -100,7 +100,7 @@ module StillActive
       {
         version: Gem::Version.new(version),
         eol: eol_reached?(cycle["eol"]) == true,
-        eol_date: parse_eol(cycle["eol"]),
+        eol_date: parse_eol(cycle["eol"])
       }
     end
 

data/lib/helpers/http_helper.rb

@@ -19,7 +19,7 @@ module StillActive
       SocketError,
       SystemCallError,
       OpenSSL::SSL::SSLError,
-      EOFError,
+      EOFError
     ].freeze
     MAX_REDIRECTS = 3
     # Ceiling on a single response body. These are metadata endpoints (version
@@ -29,6 +29,8 @@ module StillActive
     # multi-GB body and OOM the process. 16 MiB leaves generous headroom for a
     # gem with thousands of versions while bounding worst-case memory.
     MAX_BODY_BYTES = 16 * 1024 * 1024
+    JSON_PARSER = ->(body) { JSON.parse(body) }
+    IDENTITY = ->(body) { body }
 
     extend self
 
@@ -40,6 +42,16 @@ module StillActive
       request_json(uri, headers) { |target| Net::HTTP::Get.new(target) }
     end
 
+    # As get_json, but for endpoints that answer in plain text (the RubyGems
+    # compact index). Shares the redirect, auth-scoping and body-cap handling;
+    # only the parse step differs.
+    def get_text(base_uri, path, headers: {})
+      uri = base_uri.dup
+      uri.path = path
+
+      request_json(uri, headers, parse: IDENTITY) { |target| Net::HTTP::Get.new(target) }
+    end
+
     def post_json(base_uri, path, body:, headers: {})
       uri = base_uri.dup
       uri.path = path
@@ -61,10 +73,10 @@ module StillActive
     end
 
     # Runs the request, following up to MAX_REDIRECTS trusted-host redirects,
-    # and returns the parsed JSON (or nil). The block is yielded each URI and
-    # returns the request object, so GET and POST share the redirect/auth/cap
-    # logic.
-    def request_json(uri, headers)
+    # and returns the parsed body (or nil), where `parse` decides JSON vs text.
+    # The block is yielded each URI and returns the request object, so GET and
+    # POST share the redirect/auth/cap logic.
+    def request_json(uri, headers, parse: JSON_PARSER)
       MAX_REDIRECTS.times do
         http = Net::HTTP.new(uri.host, uri.port)
         http.use_ssl = true
@@ -74,7 +86,7 @@ module StillActive
         request = yield(uri)
         headers.each { |key, value| request[key] = value }
 
-        outcome, payload = perform(http, request, uri)
+        outcome, payload = perform(http, request, uri, parse)
         case outcome
         when :done
           return payload
@@ -83,23 +95,23 @@ module StillActive
         when :redirect
           location = payload["Location"]
           if location.nil? || location.empty?
-            $stderr.puts("warning: #{uri.host}#{uri.path} returned HTTP #{payload.code} with no Location header")
+            warn("warning: #{uri.host}#{uri.path} returned HTTP #{payload.code} with no Location header")
             return
           end
 
           redirect_uri = uri + location
           unless TRUSTED_HOSTS.include?(redirect_uri.host)
-            $stderr.puts("warning: #{uri.host}#{uri.path} redirected to untrusted host #{redirect_uri.host}, skipping")
+            warn("warning: #{uri.host}#{uri.path} redirected to untrusted host #{redirect_uri.host}, skipping")
             return
           end
           # We dial every request over TLS (use_ssl = true). A redirect that
           # downgrades to http is either a misconfiguration or a downgrade
           # attempt; refuse it rather than silently dialing http-over-TLS.
           unless redirect_uri.scheme == "https"
-            $stderr.puts("warning: #{uri.host}#{uri.path} redirected to non-https #{redirect_uri.scheme} target, skipping")
+            warn("warning: #{uri.host}#{uri.path} redirected to non-https #{redirect_uri.scheme} target, skipping")
             return
           end
-          $stderr.puts("warning: #{uri.host}#{uri.path} redirected to #{redirect_uri.host}#{redirect_uri.path} (stale metadata?)")
+          warn("warning: #{uri.host}#{uri.path} redirected to #{redirect_uri.host}#{redirect_uri.path} (stale metadata?)")
           # Auth is scoped to an origin (scheme + host + port), not just a host:
           # a different port is a different service and must not inherit the token.
           headers = {} unless same_origin?(uri, redirect_uri)
@@ -107,16 +119,16 @@ module StillActive
         end
       end
 
-      $stderr.puts("warning: #{uri.host}#{uri.path} too many redirects")
+      warn("warning: #{uri.host}#{uri.path} too many redirects")
       nil
     rescue *TRANSPORT_ERRORS => e
-      $stderr.puts("warning: #{uri.host}#{uri.path} failed: #{e.class} (#{e.message})")
+      warn("warning: #{uri.host}#{uri.path} failed: #{e.class} (#{e.message})")
       nil
     rescue JSON::ParserError => e
-      $stderr.puts("warning: #{uri.host}#{uri.path} returned invalid JSON: #{e.message}")
+      warn("warning: #{uri.host}#{uri.path} returned invalid JSON: #{e.message}")
       nil
     rescue URI::InvalidURIError => e
-      $stderr.puts("warning: #{uri.host}#{uri.path} returned an invalid redirect Location: #{e.message}")
+      warn("warning: #{uri.host}#{uri.path} returned an invalid redirect Location: #{e.message}")
       nil
     end
 
@@ -124,23 +136,23 @@ module StillActive
     # cap rather than buffered whole. Returns one of:
     #   [:redirect, response]  a 3xx, for the caller to follow
     #   [:stop, nil]           non-success (warns unless 404), or body over cap
-    #   [:done, parsed]        a 2xx with parsed JSON
+    #   [:done, parsed]        a 2xx with the parsed body (JSON or text)
     # Redirect and non-success bodies are never read: returning from the block
     # unwinds through Net::HTTP, which closes the connection without draining
     # the body, so a huge error/redirect body can't OOM us either.
-    def perform(http, request, uri)
+    def perform(http, request, uri, parse)
       http.request(request) do |response|
         return [:redirect, response] if response.is_a?(Net::HTTPRedirection)
 
         unless response.is_a?(Net::HTTPSuccess)
-          $stderr.puts("warning: #{uri.host}#{uri.path} returned HTTP #{response.code}") unless response.is_a?(Net::HTTPNotFound)
+          warn("warning: #{uri.host}#{uri.path} returned HTTP #{response.code}") unless response.is_a?(Net::HTTPNotFound)
           return [:stop, nil]
         end
 
         body = read_capped_body(response, uri)
         return [:stop, nil] if body.nil?
 
-        return [:done, JSON.parse(body)]
+        return [:done, parse.call(body)]
       end
     end
 
@@ -151,7 +163,7 @@ module StillActive
       response.read_body do |chunk|
         body << chunk
         if body.bytesize > MAX_BODY_BYTES
-          $stderr.puts("warning: #{uri.host}#{uri.path} response exceeded #{MAX_BODY_BYTES} bytes, skipping")
+          warn("warning: #{uri.host}#{uri.path} response exceeded #{MAX_BODY_BYTES} bytes, skipping")
           return nil
         end
       end

data/lib/helpers/lockfile_dependency_parser.rb

@@ -25,7 +25,7 @@ module StillActive
     # Lockfile source blocks and the source_type each maps to. PLUGIN SOURCE is
     # recognized as a block (so its lines are consumed as inert data, not
     # mis-read as specs) but yields no auditable gems.
-    SOURCE_TYPES = { "GEM" => :rubygems, "GIT" => :git, "PATH" => :path }.freeze
+    SOURCE_TYPES = {"GEM" => :rubygems, "GIT" => :git, "PATH" => :path}.freeze
     PLUGIN_SOURCE = "PLUGIN SOURCE"
 
     # A section header sits at column 0; Bundler emits them in SCREAMING form.
@@ -93,7 +93,7 @@ module StillActive
         end
       end
 
-      { specs: specs, direct: direct, plugin_source?: plugin_source }
+      {specs: specs, direct: direct, plugin_source?: plugin_source}
     end
   end
 end

data/lib/helpers/markdown_escape.rb

@@ -51,7 +51,7 @@ module StillActive
       return "`#{content}`" unless content.include?("`")
 
       fence = "`" * (content.scan(/`+/).map(&:length).max + 1)
-      pad = content.start_with?("`") || content.end_with?("`") ? " " : ""
+      pad = (content.start_with?("`") || content.end_with?("`")) ? " " : ""
       "#{fence}#{pad}#{content}#{pad}#{fence}"
     end
   end

data/lib/helpers/markdown_helper.rb

@@ -51,20 +51,20 @@ module StillActive
         version_with_date(
           text: data[:version_used],
           url: version_url(ruby_gems_url, data[:version_used]),
-          date: data[:version_used_release_date],
+          date: data[:version_used_release_date]
         )
       end
 
       formatted_latest_version = version_with_date(
         text: data[:latest_version],
         url: version_url(ruby_gems_url, data[:latest_version]),
-        date: data[:latest_version_release_date],
+        date: data[:latest_version_release_date]
       )
 
       formatted_latest_pre_release = version_with_date(
         text: data[:latest_pre_release_version],
         url: version_url(ruby_gems_url, data[:latest_pre_release_version]),
-        date: data[:latest_pre_release_version_release_date],
+        date: data[:latest_pre_release_version_release_date]
       )
 
       # Only link when there is a date: markdown_url with a nil date + a present
@@ -86,7 +86,7 @@ module StillActive
         formatted_latest_pre_release || unsure,
         formatted_last_commit || unsure,
         format_libyear(data[:libyear]),
-        format_license(data[:license]),
+        format_license(data[:license])
       ]
 
       "| #{cells.join(" | ")} |"
@@ -136,7 +136,7 @@ module StillActive
           poison_rank(data), # below-the-fix leads, then security-relevant, then the rest
           -ConstraintHelper::SEVERITY.index(data[:poison_severity] || :note),
           -Array(data[:constraints]).map { |c| c[:majors_behind].to_i }.max,
-          name.to_s,
+          name.to_s
         ]
       end
       ranked.each do |name, data|
@@ -202,7 +202,7 @@ module StillActive
         else
           "requires #{runtime} #{req}, no #{runtime} #{ceiling[:latest_stable]} support yet"
         end
-      fix = ceiling[:fixed_by_upgrade] && data[:latest_version] ? "; upgrade to #{data[:latest_version]} to lift it" : ""
+      fix = (ceiling[:fixed_by_upgrade] && data[:latest_version]) ? "; upgrade to #{data[:latest_version]} to lift it" : ""
       "#{base}#{fix}"
     end
 
@@ -226,7 +226,7 @@ module StillActive
         i.zero? ? "#{dep} #{req} (#{behind} major#{"s" unless behind == 1} behind, latest #{poison_major(finding[:dep_latest])})" : "#{dep} #{req} (#{behind})"
       end
       joined = parts.join(", ")
-      top[:total] > 1 ? "#{joined} — #{top[:total]} total" : joined
+      (top[:total] > 1) ? "#{joined} — #{top[:total]} total" : joined
     end
 
     # "8.0.1" -> "8.x": the cap is a major-level gap.

data/lib/helpers/ruby_advisory_db.rb

@@ -72,7 +72,7 @@ module StillActive
         # No safe version a consumer can upgrade TO: the correlation bundler-audit
         # + `bundle outdated` can't produce alone. A factual read of the DB.
         no_fix_available: no_forward_fix?(advisory),
-        source: "ruby-advisory-db",
+        source: "ruby-advisory-db"
       }
     end