still_active 3.0.0.rc4 → 3.0.0.rc5

data/lib/still_active/cli.rb

@@ -32,20 +32,20 @@ module StillActive
       # Apply the committed .still_active.yml first so CLI flags (parsed next)
       # win over it: CLI flag > env var > config file > default.
       config_data = ConfigFile.load
-      ConfigFile.apply(StillActive.config, config_data).each { |warning| $stderr.puts("warning: #{warning}") }
+      ConfigFile.apply(StillActive.config, config_data).each { |warning| warn("warning: #{warning}") }
       options = begin
         Options.new.parse!(args)
       rescue ArgumentError, OptionParser::ParseError => e
         # Bad CLI input (conflicting flags, a missing file, an unknown flag, a bad
         # enum value) is a user error: print it and exit 2, matching the SBOM/baseline
         # paths, rather than letting the raise bubble into a Ruby backtrace.
-        $stderr.puts("error: #{e.message}")
+        warn("error: #{e.message}")
         exit(2)
       end
       # After CLI flags resolve, nudge (don't auto-inherit) an un-imported
       # bundler-audit ignore list when the vulnerability gate is on.
       hint = ConfigFile.import_hint(config_data)
-      $stderr.puts("hint: #{hint}") if hint
+      warn("hint: #{hint}") if hint
       # An SBOM audit is cross-ecosystem: it runs the deps.dev/ecosyste.ms lens
       # over the SBOM's packages, not Bundler over a lockfile. Dispatch before the
       # Bundler resolution below so a Gemfile is never required (or read).
@@ -55,7 +55,7 @@ module StillActive
         begin
           StillActive.config.gems = BundlerHelper.gemfile_dependencies
         rescue MissingLockfileError => e
-          $stderr.puts("error: #{e.message}")
+          warn("error: #{e.message}")
           exit(2)
         end
       end
@@ -85,7 +85,7 @@ module StillActive
           output = {
             "$schema": SCHEMA_URL,
             schema_version: 1,
-            tool: { name: "still_active", version: StillActive::VERSION },
+            tool: {name: "still_active", version: StillActive::VERSION},
             generated_at: Time.now.utc.iso8601,
             # A one-object digest of the audit's posture, so a machine/LLM
             # consumer reads the headline counts without iterating every gem.
@@ -95,9 +95,9 @@ module StillActive
             gems: result.transform_values do |data|
               data.merge(
                 activity_level: ActivityHelper.activity_level(data),
-                status: StatusHelper.gem_status(data),
+                status: StatusHelper.gem_status(data)
               )
-            end,
+            end
           }
           output[:ruby] = ruby_info if ruby_info
           output[:pr_context] = pr_context if pr_context
@@ -127,7 +127,7 @@ module StillActive
       # field rename would silently zero every vuln count. Canary the schema once
       # and warn loudly so a degraded run never reads as an authoritative all-clear.
       unless DepsDevClient.advisory_schema_ok?
-        $stderr.puts("warning: deps.dev vulnerability schema check failed (its `advisoryKeys` field may have changed, or the API is unreachable); vulnerability counts may be understated -- a clean result is NOT authoritative")
+        warn("warning: deps.dev vulnerability schema check failed (its `advisoryKeys` field may have changed, or the API is unreachable); vulnerability counts may be understated -- a clean result is NOT authoritative")
       end
       sbom = SbomReader.parse(path)
       outcome = if $stderr.tty?
@@ -174,7 +174,7 @@ module StillActive
     end
 
     def unsupported_sbom_format!(flag)
-      $stderr.puts("error: #{flag} output is not supported in --sbom mode (it needs the native Ruby audit's lockfile/snapshot, which a cross-ecosystem SBOM can't supply); use --sarif, --markdown, --terminal, or --json")
+      warn("error: #{flag} output is not supported in --sbom mode (it needs the native Ruby audit's lockfile/snapshot, which a cross-ecosystem SBOM can't supply); use --sarif, --markdown, --terminal, or --json")
       exit(2)
     end
 
@@ -182,7 +182,7 @@ module StillActive
       sarif_json = SarifHelper.render_sbom(
         result: result,
         source_uri: File.basename(sbom_path),
-        tool_version: StillActive::VERSION,
+        tool_version: StillActive::VERSION
       )
 
       write_output(sarif_path, sarif_json)
@@ -190,7 +190,7 @@ module StillActive
 
     # "-" means stdout (the SARIF/CycloneDX convention); any other PATH is a file.
     def write_output(path, content)
-      path == "-" ? puts(content) : File.write(path, content)
+      (path == "-") ? puts(content) : File.write(path, content)
     end
 
     # SbomReader never raises (a malformed file degrades to an empty result), which
@@ -204,15 +204,15 @@ module StillActive
       # Matches SbomReader's own parse contract (a `components` array is what it
       # reads). A metadata-only CycloneDX has nothing to audit, so the message
       # names the missing array rather than over-claiming "not CycloneDX".
-      $stderr.puts("error: #{path} has no CycloneDX `components` array to audit")
+      warn("error: #{path} has no CycloneDX `components` array to audit")
       exit(2)
     rescue JSON::ParserError
-      $stderr.puts("error: #{path} is not valid JSON")
+      warn("error: #{path} is not valid JSON")
       exit(2)
     rescue SystemCallError => e
       # Options checked the path exists, not that it's readable (a permission
       # denial, or a directory). Exit cleanly instead of crashing with a trace.
-      $stderr.puts("error: cannot read SBOM file #{path}: #{e.message}")
+      warn("error: cannot read SBOM file #{path}: #{e.message}")
       exit(2)
     end
 
@@ -222,16 +222,16 @@ module StillActive
     def emit_sbom_json(result, unassessable)
       output = {
         schema_version: 1,
-        tool: { name: "still_active", version: StillActive::VERSION },
+        tool: {name: "still_active", version: StillActive::VERSION},
         generated_at: Time.now.utc.iso8601,
         summary: sbom_summary(result, unassessable),
         dependencies: result.transform_values do |data|
           data.merge(
             activity_level: ActivityHelper.activity_level(data),
-            status: StatusHelper.gem_status(data),
+            status: StatusHelper.gem_status(data)
           )
         end,
-        unassessable:,
+        unassessable:
       }
       puts iso8601_times(output).to_json
     end
@@ -244,7 +244,7 @@ module StillActive
         # The single worst per-dependency verdict, so a consumer reads one
         # project-level posture without scanning every dependency.
         status: StatusHelper.project_status(result),
-        status_counts: statuses.tally,
+        status_counts: statuses.tally
       }
     end
 
@@ -253,8 +253,8 @@ module StillActive
     def warn_unassessable(unassessable)
       return if unassessable.empty?
 
-      noun = unassessable.size == 1 ? "dependency" : "dependencies"
-      $stderr.puts("warning: #{unassessable.size} #{noun} could not be assessed " \
+      noun = (unassessable.size == 1) ? "dependency" : "dependencies"
+      warn("warning: #{unassessable.size} #{noun} could not be assessed " \
         "(a private/alternative registry, unsupported ecosystem, missing version, no package URL, or a lookup failure); " \
         "see \"unassessable\" in the JSON output")
     end
@@ -278,7 +278,7 @@ module StillActive
     def warn_stale_suppressions
       present = StillActive.config.gems.map { |gem| gem[:name] }
       StillActive.config.suppressions.stale_gem_warnings(present).each do |warning|
-        $stderr.puts("warning: #{warning}")
+        warn("warning: #{warning}")
       end
     end
 
@@ -288,10 +288,10 @@ module StillActive
     def warn_output_flag_conflicts(options)
       modes = active_output_modes
       if modes.size > 1
-        $stderr.puts("warning: multiple output modes set (#{modes.join(", ")}); using #{modes.first}, ignoring #{modes.drop(1).join(", ")}")
+        warn("warning: multiple output modes set (#{modes.join(", ")}); using #{modes.first}, ignoring #{modes.drop(1).join(", ")}")
       end
       if options[:provided_cyclonedx_version] && StillActive.config.cyclonedx_path.nil?
-        $stderr.puts("warning: --cyclonedx-version has no effect without --cyclonedx")
+        warn("warning: --cyclonedx-version has no effect without --cyclonedx")
       end
     end
 
@@ -301,14 +301,14 @@ module StillActive
       [
         ("--baseline" if config.baseline_path),
         ("--sarif" if config.sarif_path),
-        ("--cyclonedx" if config.cyclonedx_path),
+        ("--cyclonedx" if config.cyclonedx_path)
       ].compact
     end
 
     def emit_sarif(result, ruby_info, sarif_path)
       lockfile = resolve_lockfile_path(StillActive.config.gemfile_path)
       unless File.exist?(lockfile)
-        $stderr.puts("error: --sarif requires a lockfile at #{lockfile}")
+        warn("error: --sarif requires a lockfile at #{lockfile}")
         exit(2)
       end
 
@@ -316,7 +316,7 @@ module StillActive
         result: result,
         ruby_info: ruby_info,
         lockfile_path: lockfile,
-        tool_version: StillActive::VERSION,
+        tool_version: StillActive::VERSION
       )
 
       write_output(sarif_path, sarif_json)
@@ -327,7 +327,7 @@ module StillActive
         result: result,
         ruby_info: ruby_info,
         tool_version: StillActive::VERSION,
-        spec_version: StillActive.config.cyclonedx_version,
+        spec_version: StillActive.config.cyclonedx_version
       )
 
       write_output(cyclonedx_path, sbom)
@@ -349,13 +349,13 @@ module StillActive
       puts DiffMarkdownHelper.render(diff, accepted: accepted)
       exit(1) if diff.regressions.any?
     rescue JSON::ParserError => e
-      $stderr.puts("error: --baseline file is not valid JSON: #{e.message}")
+      warn("error: --baseline file is not valid JSON: #{e.message}")
       exit(2)
     rescue Diff::UnsupportedSchemaError => e
-      $stderr.puts("error: #{e.message}")
+      warn("error: #{e.message}")
       exit(2)
     rescue Errno::ENOENT, Errno::EACCES, Errno::EISDIR => e
-      $stderr.puts("error: cannot read baseline file: #{e.message}")
+      warn("error: cannot read baseline file: #{e.message}")
       exit(2)
     end
 
@@ -383,9 +383,9 @@ module StillActive
     def current_snapshot(result, ruby_info)
       snapshot = {
         "schema_version" => 1,
-        "tool" => { "name" => "still_active", "version" => StillActive::VERSION },
+        "tool" => {"name" => "still_active", "version" => StillActive::VERSION},
         "generated_at" => Time.now.utc.iso8601,
-        "gems" => JSON.parse(result.to_json),
+        "gems" => JSON.parse(result.to_json)
       }
       snapshot["ruby"] = JSON.parse(ruby_info.to_json) if ruby_info
       snapshot
@@ -406,11 +406,11 @@ module StillActive
         gem_data[:last_activity_warning_emoji] = EmojiHelper.inactive_gem_emoji(gem_data)
         gem_data[:up_to_date_emoji] = EmojiHelper.using_latest_emoji(
           using_last_release: VersionHelper.up_to_date(
-            version_used: gem_data[:version_used], latest_version: gem_data[:latest_version],
+            version_used: gem_data[:version_used], latest_version: gem_data[:latest_version]
           ),
           using_last_pre_release: VersionHelper.up_to_date(
-            version_used: gem_data[:version_used], latest_pre_release_version: gem_data[:latest_pre_release_version],
-          ),
+            version_used: gem_data[:version_used], latest_pre_release_version: gem_data[:latest_pre_release_version]
+          )
         )
 
         puts MarkdownHelper.markdown_table_body_line(gem_name: name, data: gem_data)
@@ -460,7 +460,7 @@ module StillActive
 
         ids = unknown.filter_map { |vuln| vuln[:id] }.join(", ")
         labelled = ids.empty? ? "" : " (#{ids})"
-        $stderr.puts("warning: #{gem} has an advisory of unknown severity#{labelled}; failing --fail-if-vulnerable=#{threshold} because it can't be ruled out below the threshold (review, then fix or suppress it in .still_active.yml)")
+        warn("warning: #{gem} has an advisory of unknown severity#{labelled}; failing --fail-if-vulnerable=#{threshold} because it can't be ruled out below the threshold (review, then fix or suppress it in .still_active.yml)")
       end
     end
 
@@ -485,7 +485,7 @@ module StillActive
 
       # Bare --fail-if-poison fails at :warning and above (a 1-behind :note is FYI,
       # not a build breaker); --fail-if-poison=TIER sets an explicit threshold.
-      threshold = config.fail_if_poison == true ? :warning : config.fail_if_poison
+      threshold = (config.fail_if_poison == true) ? :warning : config.fail_if_poison
       ConstraintHelper.severity_at_or_above?(data[:poison_severity], threshold)
     end
 
@@ -498,7 +498,7 @@ module StillActive
       # bare flag defaults to :critical (the genuine blocker: no supported runtime
       # is reachable). A latest-not-yet :note is an FYI/contribution lead that gates
       # only when the user explicitly opts in with =note.
-      threshold = config.fail_if_language_ceiling == true ? :critical : config.fail_if_language_ceiling
+      threshold = (config.fail_if_language_ceiling == true) ? :critical : config.fail_if_language_ceiling
       ConstraintHelper.severity_at_or_above?(data.dig(:language_ceiling, :severity), threshold)
     end
 

data/lib/still_active/compact_index_client.rb

@@ -0,0 +1,117 @@
+# frozen_string_literal: true
+
+require "cgi"
+require "rubygems/resolver"
+require "uri"
+require_relative "../helpers/http_helper"
+
+module StillActive
+  # The RubyGems compact index (`/info/<gem>`), which is what Bundler itself
+  # resolves through. It is not built by merging upstream metadata, so it lists
+  # the versions actually resolvable from the source even when a member remote (a
+  # legacy private gem host) can't answer the metadata endpoint Artifactory
+  # prefers (#142).
+  #
+  # The protocol is generic: any host that serves it (rubygems.org, Artifactory, a
+  # direct Contribsys/Gemstash/geminabox source) works here. The caller supplies
+  # the source URI and any auth headers, so this stays free of host-specific
+  # credential handling.
+  module CompactIndexClient
+    extend self
+
+    def versions(gem_name:, source_uri:, headers: {})
+      base = URI(source_uri.chomp("/"))
+      path = "#{base.path}/info/#{CGI.escape(gem_name)}"
+      body = HttpHelper.get_text(base, path, headers: headers)
+      return [] if body.nil? || body.empty?
+
+      result = parse(body)
+      # The parser never raises: a non-index 200 (an auth wall or HTML error page
+      # served with status 200) yields no versions instead of an error. Since the
+      # compact index is the primary source, a silent empty result would look
+      # identical to a clean parse and hide a broken source, so say so and let the
+      # caller fall through. A header-only index (every version yanked) is valid
+      # and empty, so the "---" marker, not mere emptiness, tells them apart.
+      if result.empty? && !compact_index?(body)
+        warn("warning: #{base.host} answered /info/#{gem_name} with a 200 that is not a RubyGems " \
+          "compact index (an auth wall or error page?); ignoring it and trying other sources")
+      end
+      result
+    end
+
+    private
+
+    def compact_index?(body)
+      body.split("\n").include?("---")
+    end
+
+    def parse(body)
+      entries(body)
+        .filter_map { |line| version_hash(line) }
+        .group_by { |hash| hash["number"] }
+        .map { |_number, rows| platform_independent(rows).except("platform") }
+        .sort_by { |hash| Gem::Version.new(hash["number"]) }
+        .reverse
+    end
+
+    # A version gets one row per built platform, variants first and the
+    # platform-independent build last. That last row is the one describing the
+    # gem rather than one prebuilt binary: a native gem's variants ship fewer
+    # dependencies, since they don't need the toolchain the source build does.
+    def platform_independent(rows)
+      rows.find { |row| row["platform"].nil? } || rows.first
+    end
+
+    # Everything after the `---` header. Artifactory is known to emit blank
+    # lines inside its index files (Bundler's own compact index parser carries
+    # the same workaround), and a blank line would parse as a nil version.
+    def entries(body)
+      lines = body.split("\n")
+      header = lines.index("---")
+      lines = lines[(header + 1)..] if header
+      lines.reject { |line| line.strip.empty? }
+    end
+
+    def version_hash(line)
+      number, platform = gem_parser.parse(line)
+      return if number.nil? || !Gem::Version.correct?(number)
+
+      meta = metadata(line)
+      {
+        "number" => number,
+        "platform" => platform,
+        "prerelease" => Gem::Version.new(number).prerelease?,
+        # Omitted entirely when a version declares no Ruby requirement, where
+        # the versions API sends ">= 0". Both mean unconstrained, and the
+        # ceiling check reads a missing requirement as "no ceiling".
+        "ruby_version" => meta["ruby"],
+        "checksum" => meta["checksum"],
+        # rubygems.org emits this; Artifactory's generated index does not, which
+        # is why a compact-index list still gets dated from the versions API.
+        "created_at" => meta["created_at"]
+      }
+    end
+
+    # The requirements section (everything after "|") is comma-separated
+    # `key:value` pairs, with `&` joining multiple constraints on one key. We
+    # parse it directly rather than through GemParser: GemParser's colon split
+    # changed across RubyGems versions and shreds an ISO-8601 `created_at`, whose
+    # value contains colons. Splitting on the FIRST colon keeps the timestamp
+    # whole on every version.
+    def metadata(line)
+      _deps, requirements = line.split("|", 2)
+      return {} unless requirements
+
+      requirements.split(",").each_with_object({}) do |pair, meta|
+        key, value = pair.split(":", 2)
+        meta[key] = value.split("&").join(", ") if value
+      end
+    end
+
+    # Used only for the leading `version[-platform]` token, which is a stable
+    # split across RubyGems versions. Ships with RubyGems since 3.2.3.
+    def gem_parser
+      @gem_parser ||= Gem::Resolver::APISet::GemParser.new
+    end
+  end
+end

data/lib/still_active/config.rb

@@ -174,7 +174,7 @@ module StillActive
     end
 
     def presence(value)
-      value && !value.empty? ? value : nil
+      (value && !value.empty?) ? value : nil
     end
   end
 end

data/lib/still_active/config_file.rb

@@ -26,7 +26,7 @@ module StillActive
       return {} if data.nil?
 
       unless data.is_a?(Hash)
-        $stderr.puts("warning: #{FILENAME} must be a mapping of settings; ignoring it")
+        warn("warning: #{FILENAME} must be a mapping of settings; ignoring it")
         return {}
       end
 
@@ -34,7 +34,7 @@ module StillActive
     rescue Psych::Exception => e
       # Covers a syntax error and a disallowed tag (e.g. !ruby/object); either
       # way the committed file must never take the audit down with it.
-      $stderr.puts("warning: #{FILENAME} could not be loaded (#{e.message}); ignoring it")
+      warn("warning: #{FILENAME} could not be loaded (#{e.message}); ignoring it")
       {}
     end
 
@@ -89,7 +89,7 @@ module StillActive
       count = bundler_audit_ignore_count(path)
       return unless count.positive?
 
-      noun = count == 1 ? "advisory" : "advisories"
+      noun = (count == 1) ? "advisory" : "advisories"
       "#{BUNDLER_AUDIT_FILE} lists #{count} accepted #{noun}; add `import: [#{BUNDLER_AUDIT_FILE}]` to #{FILENAME} to honour them in still_active's --fail-if-vulnerable gate too"
     end
 
@@ -197,7 +197,7 @@ module StillActive
           next []
         end
 
-        Array(imported["ignore"]).map { |advisory| { "advisory" => advisory, "reason" => "imported from #{rel}" } }
+        Array(imported["ignore"]).map { |advisory| {"advisory" => advisory, "reason" => "imported from #{rel}"} }
       rescue Psych::Exception => e
         warnings << "#{FILENAME}: import target #{rel} could not be loaded (#{e.message}), skipping it"
         []

data/lib/still_active/deps_dev_client.rb

@@ -15,7 +15,7 @@ module StillActive
     # `[]` -- so a rename or drop of that field would silently turn every count to
     # 0 and read a known-vulnerable package as clean (exit 0). django 3.0.0 carries
     # 30+ permanent advisories; if the canary returns none, the schema drifted.
-    ADVISORY_CANARY = { system: "pypi", name: "django", version: "3.0.0" }.freeze
+    ADVISORY_CANARY = {system: "pypi", name: "django", version: "3.0.0"}.freeze
 
     # Is deps.dev still returning advisories in the shape we parse? False when the
     # canary comes back empty (schema drift) or unreachable (can't confirm). The
@@ -42,7 +42,7 @@ module StillActive
         # The locked version's release date -- the cross-ecosystem libyear input
         # (paired with the package's latest-release date). Already in this response,
         # so no extra fetch; nil when the feed omits it.
-        published_at: body["publishedAt"],
+        published_at: body["publishedAt"]
       }
     end
 
@@ -74,7 +74,7 @@ module StillActive
         newest_version(versions)
       return if entry.nil?
 
-      { version: entry.dig("versionKey", "version"), published_at: entry["publishedAt"] }
+      {version: entry.dig("versionKey", "version"), published_at: entry["publishedAt"]}
     end
 
     # The newest non-prerelease version by version number (not publishedAt: a
@@ -117,7 +117,7 @@ module StillActive
         # activity directly -- still_active's core question -- so we surface it
         # alongside the aggregate. nil when the check is absent (never 0, which
         # would read as "unmaintained" rather than "not measured").
-        maintained: maintained_check_score(scorecard),
+        maintained: maintained_check_score(scorecard)
       }
     end
 
@@ -153,7 +153,7 @@ module StillActive
         cvss3_score: body["cvss3Score"],
         cvss3_vector: body["cvss3Vector"],
         cvss2_score: body["cvss2Score"],
-        source: "deps.dev",
+        source: "deps.dev"
       }
     end
 
@@ -177,7 +177,7 @@ module StillActive
       return if @alias_drift_warned
 
       @alias_drift_warned = true
-      $stderr.puts("warning: deps.dev returned a non-string advisory alias (#{raw.class}); the ALPHA API schema may have drifted")
+      warn("warning: deps.dev returned a non-string advisory alias (#{raw.class}); the ALPHA API schema may have drifted")
     end
 
     # The OpenSSF "Maintained" check score (0-10), or nil when it's absent. A
@@ -221,7 +221,7 @@ module StillActive
     # link). Parsing it as owner/repo yields a 404 and a blank repo cell, so treat a
     # reserved first segment as "no repo" rather than a bogus lookup.
     GITHUB_RESERVED_PATHS = [
-      "sponsors", "orgs", "marketplace", "apps", "topics", "settings", "notifications", "about", "pricing", "features", "security", "contact",
+      "sponsors", "orgs", "marketplace", "apps", "topics", "settings", "notifications", "about", "pricing", "features", "security", "contact"
     ].freeze
 
     def repo_path_segments(host, segments)

data/lib/still_active/diff.rb

@@ -25,7 +25,7 @@ module StillActive
       new_gem_archived: :activity,
       archived: :activity,
       new_gem_stale: :libyear,
-      libyear_worsened: :libyear,
+      libyear_worsened: :libyear
     }.freeze
 
     class UnsupportedSchemaError < StandardError; end
@@ -70,7 +70,7 @@ module StillActive
             after_version: after["version_used"],
             kind: classify_bump(before, after),
             before: before,
-            after: after,
+            after: after
           )
         end
         changes = collect_signal_changes(before, after)
@@ -82,7 +82,7 @@ module StillActive
         added: added,
         bumped: bumped,
         signal_changes: signal_changes,
-        ruby_delta: ruby,
+        ruby_delta: ruby
       )
 
       Result.new(
@@ -91,7 +91,7 @@ module StillActive
         bumped: bumped,
         signal_changes: signal_changes,
         regressions: regressions,
-        ruby: ruby,
+        ruby: ruby
       )
     end
 
@@ -181,7 +181,7 @@ module StillActive
       changes = []
 
       if !before["archived"] && after["archived"]
-        changes << { kind: :archived, from: false, to: true }
+        changes << {kind: :archived, from: false, to: true}
       end
 
       opened = vuln_count(after) - vuln_count(before)
@@ -191,7 +191,7 @@ module StillActive
         # "new" in this list even though it's a re-keying of the same issue.
         # The vulnerability_count gate above keeps that to detail-string noise.
         new_ids = advisory_ids(after) - advisory_ids(before)
-        changes << { kind: :new_vulnerability, from: vuln_count(before), to: vuln_count(after), ids: new_ids.first(3) }
+        changes << {kind: :new_vulnerability, from: vuln_count(before), to: vuln_count(after), ids: new_ids.first(3)}
       end
 
       if before["scorecard_score"] && after["scorecard_score"]
@@ -200,7 +200,7 @@ module StillActive
         # -> 7.0 dip is noise within the safe zone). Only drops below 7.0 cross.
         crossed = before["scorecard_score"] >= SCORECARD_GOOD_THRESHOLD && after["scorecard_score"] < SCORECARD_GOOD_THRESHOLD
         if drop >= SCORECARD_DROP_THRESHOLD || crossed
-          changes << { kind: :scorecard_dropped, from: before["scorecard_score"], to: after["scorecard_score"], crossed_good: crossed }
+          changes << {kind: :scorecard_dropped, from: before["scorecard_score"], to: after["scorecard_score"], crossed_good: crossed}
         end
       end
 
@@ -211,12 +211,12 @@ module StillActive
         # technically grows (because upstream is releasing faster).
         delta = after["libyear"] - before["libyear"]
         if delta > LIBYEAR_DELTA_THRESHOLD
-          changes << { kind: :libyear_worsened, from: before["libyear"], to: after["libyear"], delta: delta.round(2) }
+          changes << {kind: :libyear_worsened, from: before["libyear"], to: after["libyear"], delta: delta.round(2)}
         end
       end
 
       if !before["version_yanked"] && after["version_yanked"]
-        changes << { kind: :version_yanked }
+        changes << {kind: :version_yanked}
       end
 
       changes
@@ -241,7 +241,7 @@ module StillActive
           regs << Regression.new(
             kind: :bump_introduced_vulns,
             gem: b.name,
-            detail: "#{b.before_version} -> #{b.after_version}",
+            detail: "#{b.before_version} -> #{b.after_version}"
           )
         end
       end
@@ -263,7 +263,7 @@ module StillActive
             regs << Regression.new(
               kind: :libyear_worsened,
               gem: sc.name,
-              detail: "libyear #{ch[:from]} -> #{ch[:to]} (+#{ch[:delta]}y; same pinned version)",
+              detail: "libyear #{ch[:from]} -> #{ch[:to]} (+#{ch[:delta]}y; same pinned version)"
             )
           end
         end
@@ -287,7 +287,7 @@ module StillActive
         to: after["version"],
         newly_eol: !before["eol"] && !!after["eol"],
         libyear_before: before["libyear"],
-        libyear_after: after["libyear"],
+        libyear_after: after["libyear"]
       }
     end
 

data/lib/still_active/ecosystem_lens.rb

@@ -39,7 +39,7 @@ module StillActive
       rubygems: "rubygems.org",
       npm: "npmjs.org",
       pypi: "pypi.org",
-      cargo: "crates.io",
+      cargo: "crates.io"
     }.freeze
 
     # A transitive cap only holds the WHOLE tree hostage where the ecosystem
@@ -98,7 +98,7 @@ module StillActive
         # already fetched above (no extra call); nil when either date is missing.
         libyear: LibyearHelper.gem_libyear(
           version_used_release_date: parse_time(used_release_date),
-          latest_version_release_date: parse_time(latest_release_date),
+          latest_version_release_date: parse_time(latest_release_date)
         ),
         # Whether the pinned version is at or ahead of deps.dev's latest stable, so a
         # prerelease or an ahead-of-stable pin reads current (true), not "behind" --
@@ -110,7 +110,7 @@ module StillActive
         scorecard_score: scorecard&.dig(:score),
         scorecard_maintained: scorecard&.dig(:maintained),
         vulnerability_count: vulnerabilities.length,
-        vulnerabilities: vulnerabilities,
+        vulnerabilities: vulnerabilities
       }
       gem_data[:version_unresolved] = true if version_unresolved
       attach_constraints(gem_data, ecosystem: ecosystem, name: name, version: version, cache: constraint_cache)
@@ -239,7 +239,7 @@ module StillActive
       candidates = declared.filter_map do |dep|
         next if dep[:package_name].to_s.empty? || dep[:requirements].to_s.empty?
 
-        { dependency: dep[:package_name], requirement: dep[:requirements] }
+        {dependency: dep[:package_name], requirement: dep[:requirements]}
       end
       gem_data[:capped_deps] = candidates unless candidates.empty?
     end
@@ -262,7 +262,7 @@ module StillActive
       # fetch only enriches CVSS/title. A failed enrichment must not drop the
       # count to zero and read a known-vulnerable dep as clean, so a key whose
       # detail can't be loaded still contributes a minimal advisory.
-      deps_dev = advisory_keys.map { DepsDevClient.advisory_detail(advisory_id: _1) || { id: _1, source: "deps.dev" } }
+      deps_dev = advisory_keys.map { DepsDevClient.advisory_detail(advisory_id: _1) || {id: _1, source: "deps.dev"} }
       # No ruby-advisory-db here: that database is Ruby-only and the native
       # Bundler path already merges it. Cross-ecosystem advisories come from
       # deps.dev/OSV, which covers every system the lens serves.