still_active 3.0.0.rc4 → 3.0.0.rc5

data/lib/still_active/ecosystems_client.rb

@@ -26,7 +26,7 @@ module StillActive
     # carries per-version declared dependency constraints (the poison-pill input).
     PACKAGES_BASE_URI = URI("https://packages.ecosyste.ms/")
     # ecosyste.ms asks consumers to identify themselves for its "polite pool".
-    USER_AGENT = "still_active/#{StillActive::VERSION} (+https://github.com/SeanLF/still_active)"
+    USER_AGENT = "still_active/#{StillActive::VERSION} (+https://github.com/SeanLF/still_active)".freeze
 
     # archived + last-commit date from a single repository call. ecosyste.ms's
     # pushed_at mirrors GitHub's, so this returns the same shape as GithubClient.
@@ -35,13 +35,13 @@ module StillActive
       return {} if owner.nil? || name.nil?
 
       path = "/api/v1/hosts/GitHub/repositories/#{encode_repo(owner, name)}"
-      body = HttpHelper.get_json(BASE_URI, path, headers: { "User-Agent" => USER_AGENT }, params: politeness_params)
+      body = HttpHelper.get_json(BASE_URI, path, headers: {"User-Agent" => USER_AGENT}, params: politeness_params)
       # A non-Hash 200 body (error envelope rendered as an array, schema drift)
       # would otherwise raise on indexing and vanish the gem from the audit via
       # the workflow's rescue; degrade to "no signal" like any other read failure.
       return {} unless body.is_a?(Hash)
 
-      signals = { last_commit_date: parse_time(body["pushed_at"], owner, name) }
+      signals = {last_commit_date: parse_time(body["pushed_at"], owner, name)}
       # Only assert archived when the field is actually present. A missing field
       # must read as unknown, not be invented as false -- otherwise a partial
       # crawl could silently mask the most actionable verdict (gem is archived).
@@ -73,7 +73,7 @@ module StillActive
       return [] if name.nil? || version.nil?
 
       path = "/api/v1/registries/#{encode(registry)}/packages/#{encode(name)}/versions/#{encode(version)}"
-      body = HttpHelper.get_json(PACKAGES_BASE_URI, path, headers: { "User-Agent" => USER_AGENT }, params: politeness_params)
+      body = HttpHelper.get_json(PACKAGES_BASE_URI, path, headers: {"User-Agent" => USER_AGENT}, params: politeness_params)
       return [] unless body.is_a?(Hash)
 
       dependencies = body["dependencies"]
@@ -86,7 +86,7 @@ module StillActive
         requirements = dep["requirements"]
         next if package_name.nil? || requirements.nil?
 
-        { package_name: package_name, requirements: requirements }
+        {package_name: package_name, requirements: requirements}
       end
     end
 
@@ -98,7 +98,7 @@ module StillActive
     # lockfile and we don't attribute every user's traffic to one address.
     def politeness_params
       email = StillActive.config.ecosystems_email
-      email ? { mailto: email } : {}
+      email ? {mailto: email} : {}
     end
 
     # nil or a non-string (numeric/array from an off-spec payload) -> no date,
@@ -108,7 +108,7 @@ module StillActive
 
       Time.parse(value)
     rescue ArgumentError
-      $stderr.puts("warning: could not parse repo date for #{owner}/#{name}: #{value.inspect}")
+      warn("warning: could not parse repo date for #{owner}/#{name}: #{value.inspect}")
       nil
     end
 

data/lib/still_active/forgejo_client.rb

@@ -24,7 +24,7 @@ module StillActive
       body = HttpHelper.get_json(base_uri(host), "/api/v1/repos/#{owner}/#{name}", headers: auth_headers)
       return {} if body.nil?
 
-      { archived: body["archived"] == true, last_commit_date: parse_time(body["updated_at"], owner, name) }
+      {archived: body["archived"] == true, last_commit_date: parse_time(body["updated_at"], owner, name)}
     end
 
     private
@@ -34,7 +34,7 @@ module StillActive
 
       Time.parse(value)
     rescue ArgumentError
-      $stderr.puts("warning: could not parse repo date for #{owner}/#{name}: #{value.inspect}")
+      warn("warning: could not parse repo date for #{owner}/#{name}: #{value.inspect}")
       nil
     end
 
@@ -44,7 +44,7 @@ module StillActive
 
     def auth_headers
       token = StillActive.config.forgejo_token
-      token ? { "Authorization" => "token #{token}" } : {}
+      token ? {"Authorization" => "token #{token}"} : {}
     end
   end
 end

data/lib/still_active/github_client.rb

@@ -29,9 +29,9 @@ module StillActive
       end
       return {} unless repo
 
-      { archived: repo.archived, last_commit_date: as_time(repo.pushed_at, owner, name) }
+      {archived: repo.archived, last_commit_date: as_time(repo.pushed_at, owner, name)}
     rescue Octokit::Error, Faraday::Error => e
-      $stderr.puts("warning: repo signals failed for #{owner}/#{name}: #{e.class}")
+      warn("warning: repo signals failed for #{owner}/#{name}: #{e.class}")
       {}
     end
 
@@ -54,7 +54,7 @@ module StillActive
       end
       nil
     rescue Octokit::Error, Faraday::Error => e
-      $stderr.puts("warning: unreleased-commits check failed for #{owner}/#{name}: #{e.class}")
+      warn("warning: unreleased-commits check failed for #{owner}/#{name}: #{e.class}")
       nil
     end
 
@@ -75,12 +75,12 @@ module StillActive
           # Hourly-limit exhaustion (or a far reset): not worth auto-waiting.
           # Surface the one actionable hint rather than a generic class name,
           # then return nil so this signal is simply absent for the gem.
-          $stderr.puts("rate limited on #{label}; set GITHUB_TOKEN to raise your limit, or run less often")
+          warn("rate limited on #{label}; set GITHUB_TOKEN to raise your limit, or run less often")
           return
         end
 
         retried = true
-        $stderr.puts("rate limited on #{label}; waiting #{wait}s for reset")
+        warn("rate limited on #{label}; waiting #{wait}s for reset")
         sleep(wait)
         retry
       end
@@ -119,7 +119,7 @@ module StillActive
 
       Time.parse(value)
     rescue ArgumentError
-      $stderr.puts("warning: could not parse repo date for #{owner}/#{name}: #{value.inspect}")
+      warn("warning: could not parse repo date for #{owner}/#{name}: #{value.inspect}")
       nil
     end
   end

data/lib/still_active/gitlab_client.rb

@@ -20,7 +20,7 @@ module StillActive
       body = HttpHelper.get_json(BASE_URI, path, headers: auth_headers)
       return {} if body.nil?
 
-      { archived: body["archived"] == true, last_commit_date: parse_time(body["last_activity_at"], owner, name) }
+      {archived: body["archived"] == true, last_commit_date: parse_time(body["last_activity_at"], owner, name)}
     end
 
     private
@@ -30,13 +30,13 @@ module StillActive
 
       Time.parse(value)
     rescue ArgumentError
-      $stderr.puts("warning: could not parse repo date for #{owner}/#{name}: #{value.inspect}")
+      warn("warning: could not parse repo date for #{owner}/#{name}: #{value.inspect}")
       nil
     end
 
     def auth_headers
       token = StillActive.config.gitlab_token
-      token ? { "PRIVATE-TOKEN" => token } : {}
+      token ? {"PRIVATE-TOKEN" => token} : {}
     end
 
     def encode_project(owner, name)

data/lib/still_active/options.rb

@@ -57,7 +57,7 @@ module StillActive
       opts.on("--gems=GEM,GEM2,...", Array, "Gem(s)") do |value|
         options[:provided_gems] = true
         # Explicitly named gems are direct by definition (the user chose them).
-        StillActive.config { |config| config.gems = value.map { |g| { name: g, direct: true } } }
+        StillActive.config { |config| config.gems = value.map { |g| {name: g, direct: true} } }
       end
     end
 
@@ -130,14 +130,14 @@ module StillActive
       opts.on(
         "--safe-range-end=YEARS",
         Float,
-        "maximum years since last release considered safe, no warning (default 1.5; fractional allowed)",
+        "maximum years since last release considered safe, no warning (default 1.5; fractional allowed)"
       ) do |value|
         StillActive.config { |config| config.no_warning_range_end = value }
       end
       opts.on(
         "--warning-range-end=YEARS",
         Float,
-        "maximum years since last release that triggers a warning, beyond this is critical (default 3)",
+        "maximum years since last release that triggers a warning, beyond this is critical (default 3)"
       ) do |value|
         StillActive.config { |config| config.warning_range_end = value }
       end
@@ -181,7 +181,7 @@ module StillActive
           # Ceiling findings are only ever :critical or :note, so =warning can't
           # match anything the bare (=critical) default doesn't already catch.
           if value == "warning"
-            $stderr.puts("warning: --fail-if-language-ceiling=warning has no effect (runtime ceilings are only critical or note); behaves as =critical")
+            warn("warning: --fail-if-language-ceiling=warning has no effect (runtime ceilings are only critical or note); behaves as =critical")
           end
           StillActive.config { |config| config.fail_if_language_ceiling = value.to_sym }
         else

data/lib/still_active/osv_client.rb

@@ -34,15 +34,15 @@ module StillActive
       cargo: "crates.io",
       maven: "Maven",
       go: "Go",
-      nuget: "NuGet",
+      nuget: "NuGet"
     }.freeze
 
     # Prefer the newest CVSS version a record carries (v4 is the whole point: it's the
     # one deps.dev can't score). `severity[].score` is the vector STRING, oddly named.
-    CVSS_PRIORITY = { "CVSS_V4" => 3, "CVSS_V3" => 2, "CVSS_V2" => 1 }.freeze
+    CVSS_PRIORITY = {"CVSS_V4" => 3, "CVSS_V3" => 2, "CVSS_V2" => 1}.freeze
     # A v2 vector has no `CVSS:X.Y` prefix, so the version can't be read from the
     # string; fall back to the entry type so the CycloneDX rating method labels it v2.
-    TYPE_VERSIONS = { "CVSS_V4" => "4.0", "CVSS_V3" => "3.1", "CVSS_V2" => "2.0" }.freeze
+    TYPE_VERSIONS = {"CVSS_V4" => "4.0", "CVSS_V3" => "3.1", "CVSS_V2" => "2.0"}.freeze
 
     # Enrich each advisory in place with the OSV severity label and the fixed
     # versions for the audited package. A missing/failed lookup is a no-op on that
@@ -57,12 +57,12 @@ module StillActive
         advisory[:cvss_version] = record[:cvss_version]
         advisory[:cvss_vector] = record[:cvss_vector]
         advisory[:fixed_versions] = fixed_versions(record, ecosystem: ecosystem, name: name)
-      rescue StandardError => e
+      rescue => e
         # Enrichment is additive and best-effort. An unexpected OSV shape must never
         # raise out through the workflow's per-gem rescue, which would DROP the whole
         # gem and read a known-vulnerable dependency as clean. Leave the advisory
         # exactly as deps.dev produced it.
-        $stderr.puts("warning: OSV enrichment for #{advisory[:id]} failed: #{e.class} (#{e.message}); leaving advisory unchanged")
+        warn("warning: OSV enrichment for #{advisory[:id]} failed: #{e.class} (#{e.message}); leaving advisory unchanged")
       end
     end
 
@@ -83,7 +83,7 @@ module StillActive
         cvss_score: cvss[:score],
         cvss_version: cvss[:version],
         cvss_vector: cvss[:vector],
-        affected: Array(body["affected"]).filter_map { |entry| parse_affected(entry) },
+        affected: Array(body["affected"]).filter_map { |entry| parse_affected(entry) }
       }
     end
 
@@ -100,7 +100,7 @@ module StillActive
       return {} if entry.nil?
 
       vector = entry["score"]
-      { score: CvssHelper.score(vector), version: cvss_version(vector) || TYPE_VERSIONS[entry["type"]], vector: vector }
+      {score: CvssHelper.score(vector), version: cvss_version(vector) || TYPE_VERSIONS[entry["type"]], vector: vector}
     end
 
     # The X.Y version from a "CVSS:X.Y/..." vector prefix, or nil.
@@ -137,7 +137,7 @@ module StillActive
 
         Array(range["events"]).filter_map { |event| event["fixed"] if event.is_a?(Hash) }
       end
-      { ecosystem: package["ecosystem"], name: package["name"], fixed: fixed }
+      {ecosystem: package["ecosystem"], name: package["name"], fixed: fixed}
     end
 
     def encode(value)

data/lib/still_active/poison_security_correlator.rb

@@ -73,7 +73,7 @@ module StillActive
         next unless data[:vulnerability_count].to_i.positive?
 
         name = data[:name] || key
-        map["#{data[:ecosystem]}/#{name}"] = { vulns: hashes(data[:vulnerabilities]), used_version: data[:version_used] }
+        map["#{data[:ecosystem]}/#{name}"] = {vulns: hashes(data[:vulnerabilities]), used_version: data[:version_used]}
       end
     end
 
@@ -85,7 +85,7 @@ module StillActive
     def copy_index(result_object)
       result_object.each_with_object({}) do |(key, data), map|
         name = data[:name] || key
-        (map["#{data[:ecosystem]}/#{name}"] ||= []) << { version: data[:version_used], vulns: hashes(data[:vulnerabilities]) }
+        (map["#{data[:ecosystem]}/#{name}"] ||= []) << {version: data[:version_used], vulns: hashes(data[:vulnerabilities])}
       end
     end
 
@@ -148,7 +148,7 @@ module StillActive
         capped_dep_vulnerable: true,
         capped_below_fix: true,
         below_fix_advisory: receipt[:id],
-        below_fix_fixed_in: nearest_fix(receipt, oldest),
+        below_fix_fixed_in: nearest_fix(receipt, oldest)
       }
     end
 

data/lib/still_active/pypi_client.rb

@@ -20,7 +20,7 @@ module StillActive
 
     BASE_URI = URI("https://pypi.org/")
     # Polite identification, matching EcosystemsClient's convention.
-    USER_AGENT = "still_active/#{StillActive::VERSION} (+https://github.com/SeanLF/still_active)"
+    USER_AGENT = "still_active/#{StillActive::VERSION} (+https://github.com/SeanLF/still_active)".freeze
 
     # The PEP 440 `requires_python` specifier a release declares (e.g.
     # ">=3.8,<3.13"), or nil when the version is unreadable or declares none.
@@ -30,7 +30,7 @@ module StillActive
       return if name.nil? || version.nil?
 
       path = "/pypi/#{encode(name)}/#{encode(version)}/json"
-      body = HttpHelper.get_json(BASE_URI, path, headers: { "User-Agent" => USER_AGENT })
+      body = HttpHelper.get_json(BASE_URI, path, headers: {"User-Agent" => USER_AGENT})
       return unless body.is_a?(Hash)
 
       # Guard the nested read: a non-Hash `info` (schema drift) would make

data/lib/still_active/repository.rb

@@ -8,9 +8,9 @@ module StillActive
     SOURCE_BY_HOST = {
       "github.com" => :github,
       "gitlab.com" => :gitlab,
-      "codeberg.org" => :forgejo,
+      "codeberg.org" => :forgejo
     }.freeze
-    REPO_REGEX = %r{(?<url>https?://(?:www\.)?(?<host>github\.com|gitlab\.com|codeberg\.org)/(?<owner>[\w.\-]+)/(?<name>[\w.\-]+))}i
+    REPO_REGEX = %r{(?<url>https?://(?:www\.)?(?<host>github\.com|gitlab\.com|codeberg\.org)/(?<owner>[\w.-]+)/(?<name>[\w.-]+))}i
 
     extend self
 
@@ -22,12 +22,12 @@ module StillActive
 
     def url_with_owner_and_name(url:)
       match = url&.match(REPO_REGEX)
-      return { source: :unhandled, owner: nil, name: nil } unless match
+      return {source: :unhandled, owner: nil, name: nil} unless match
 
       clean_url = match[:url].delete_suffix(".git")
       name = match[:name].delete_suffix(".git")
 
-      { url: clean_url, source: SOURCE_BY_HOST.fetch(match[:host].downcase), owner: match[:owner], name: name }
+      {url: clean_url, source: SOURCE_BY_HOST.fetch(match[:host].downcase), owner: match[:owner], name: name}
     end
   end
 end

data/lib/still_active/sarif/rules.rb

@@ -60,8 +60,8 @@ module StillActive
           neutral: {
             short: "Package's source repository is archived",
             full: "The package's upstream repository has been marked archived. No further fixes, including security patches, should be expected.",
-            help_text: "Look for a maintained fork or alternative. If you must keep the package, vendor or fork it so you can apply patches yourself.",
-          },
+            help_text: "Look for a maintained fork or alternative. If you must keep the package, vendor or fork it so you can apply patches yourself."
+          }
         },
         {
           id: "SA002",
@@ -75,8 +75,8 @@ module StillActive
           neutral: {
             short: "Package has had no release for over 3 years",
             full: "The package's latest release is over 3 years old. Not formally archived, but a strong abandonment signal: a consumer cannot pull fixes that were never released. For a package with no releases at all (e.g. git-sourced), the last commit date is used instead.",
-            help_text: "Verify the package still works on your supported runtime and consider a maintained alternative.",
-          },
+            help_text: "Verify the package still works on your supported runtime and consider a maintained alternative."
+          }
         },
         {
           id: "SA003",
@@ -88,8 +88,8 @@ module StillActive
           security_severity: "7.0", # default; per-result override from CVSS
           tags: ["security", "vulnerability", "external/cwe/cwe-1104"],
           neutral: {
-            short: "Package has known vulnerabilities (via deps.dev / OSV)",
-          },
+            short: "Package has known vulnerabilities (via deps.dev / OSV)"
+          }
         },
         {
           id: "SA004",
@@ -102,8 +102,8 @@ module StillActive
           tags: ["maintenance", "libyear"],
           neutral: {
             short: "Package is significantly behind the latest release",
-            help_text: "Schedule an upgrade to the latest release.",
-          },
+            help_text: "Schedule an upgrade to the latest release."
+          }
         },
         {
           id: "SA005",
@@ -115,8 +115,8 @@ module StillActive
           security_severity: nil,
           tags: ["supply-chain", "openssf"],
           neutral: {
-            short: "Package's OpenSSF Scorecard is low",
-          },
+            short: "Package's OpenSSF Scorecard is low"
+          }
         },
         {
           id: "SA006",
@@ -127,7 +127,7 @@ module StillActive
           level: "error",
           security_severity: "8.5",
           tags: ["security", "runtime", "external/cwe/cwe-1104"],
-          native_only: true,
+          native_only: true
         },
         {
           id: "SA007",
@@ -141,8 +141,8 @@ module StillActive
           neutral: {
             short: "Resolved package version has been yanked from its registry",
             full: "The resolved version has been yanked by the package owner, typically for a serious bug or vulnerability.",
-            help_text: "Update to a non-yanked version immediately.",
-          },
+            help_text: "Update to a non-yanked version immediately."
+          }
         },
         {
           id: "SA008",
@@ -156,8 +156,8 @@ module StillActive
           neutral: {
             short: "Dormant package caps a dependency below its latest major",
             full: "A dormant (abandoned or archived) package declares a runtime constraint that caps one of its dependencies below that dependency's current latest major. Because nobody is shipping the package, the cap will never lift, and it grows more constraining as the capped dependency releases new majors: the tree is held below a ceiling no upstream release will raise.",
-            help_text: "Replace or fork the dormant package, or vendor a version that relaxes the constraint. For a transitive pill, target the direct dependency that pulls it in.",
-          },
+            help_text: "Replace or fork the dormant package, or vendor a version that relaxes the constraint. For a transitive pill, target the direct dependency that pulls it in."
+          }
         },
         {
           id: "SA009",
@@ -167,8 +167,8 @@ module StillActive
           help_text: "If a newer release of the package lifts the cap, upgrade it. Otherwise replace or fork the package, or contribute support for the newer runtime upstream.",
           level: "note",
           security_severity: nil, # maintenance/compatibility, not a CVE (as SA002/SA004/SA005/SA008)
-          tags: ["maintenance", "runtime", "external/cwe/cwe-1104"],
-        },
+          tags: ["maintenance", "runtime", "external/cwe/cwe-1104"]
+        }
       ].freeze
 
       # Builds a frozen catalog for one wording flavour. `:neutral` applies each
@@ -181,10 +181,10 @@ module StillActive
         neutral = flavour == :neutral
         rules = neutral ? RAW_RULES.reject { |r| r[:native_only] } : RAW_RULES
         rules.map do |r|
-          resolved = neutral && r[:neutral] ? r.merge(r[:neutral]) : r
+          resolved = (neutral && r[:neutral]) ? r.merge(r[:neutral]) : r
           resolved.except(:neutral, :native_only).merge(
             tags: r[:tags].dup.freeze,
-            help_markdown: "#{resolved[:help_text]}\n\nSee [#{r[:id]} docs](#{help_uri(r[:id])}) for full guidance.",
+            help_markdown: "#{resolved[:help_text]}\n\nSee [#{r[:id]} docs](#{help_uri(r[:id])}) for full guidance."
           ).freeze
         end.freeze
       end
@@ -194,7 +194,7 @@ module StillActive
 
       # flavour: :ruby (default, native Gemfile path) or :neutral (SBOM path).
       def all(flavour = :ruby)
-        flavour == :neutral ? NEUTRAL_CATALOG : CATALOG
+        (flavour == :neutral) ? NEUTRAL_CATALOG : CATALOG
       end
 
       def find(id, flavour = :ruby)

data/lib/still_active/sbom_reader.rb

@@ -32,7 +32,7 @@ module StillActive
       "cargo" => :cargo,
       "maven" => :maven,
       "golang" => :go,
-      "nuget" => :nuget,
+      "nuget" => :nuget
     }.freeze
 
     # PURL types that are not package dependencies: CI actions and opaque
@@ -100,7 +100,7 @@ module StillActive
 
       name = component["name"]
       purl = component["purl"]
-      return [:unassessable, { ecosystem: nil, name: name, reason: :no_purl }] unless purl.is_a?(String) && !purl.empty?
+      return [:unassessable, {ecosystem: nil, name: name, reason: :no_purl}] unless purl.is_a?(String) && !purl.empty?
 
       classify_purl(purl, name)
     end
@@ -121,7 +121,7 @@ module StillActive
       "repo1.maven.org",
       "repo.maven.apache.org",
       "api.nuget.org",
-      "proxy.golang.org",
+      "proxy.golang.org"
     ].freeze
 
     def classify_purl(purl, name)
@@ -130,7 +130,7 @@ module StillActive
       ecosystem = ECOSYSTEMS[type]
 
       if ecosystem
-        return [:unassessable, { ecosystem: type, name: name, reason: :no_version }] if parsed.version.to_s.empty?
+        return [:unassessable, {ecosystem: type, name: name, reason: :no_version}] if parsed.version.to_s.empty?
 
         full_name = build_name(ecosystem, parsed.namespace, parsed.name)
         repository_url = parsed.qualifiers&.dig("repository_url")
@@ -143,14 +143,14 @@ module StillActive
         # from a public one, so it is still assessed by name. Best-effort, not a
         # guarantee that every private package is caught.
         if repository_url && !public_registry?(repository_url)
-          return [:unassessable, { ecosystem: ecosystem, name: full_name, version: parsed.version, reason: :private_registry, repository_url: repository_url }]
+          return [:unassessable, {ecosystem: ecosystem, name: full_name, version: parsed.version, reason: :private_registry, repository_url: repository_url}]
         end
 
-        [:dependency, { ecosystem: ecosystem, name: full_name, version: parsed.version }]
+        [:dependency, {ecosystem: ecosystem, name: full_name, version: parsed.version}]
       elsif NOISE_TYPES.include?(type)
         nil # CI actions / opaque binaries: not a package dependency
       else
-        [:unassessable, { ecosystem: type, name: name, reason: :unsupported_ecosystem }]
+        [:unassessable, {ecosystem: type, name: name, reason: :unsupported_ecosystem}]
       end
     rescue ArgumentError
       # InvalidPackageURL is a subclass of ArgumentError, but PackageURL.parse also
@@ -158,7 +158,7 @@ module StillActive
       # or bad percent-encoding, both common in real Syft/Trivy output. Catch both so
       # one malformed component degrades to unassessable, never a backtrace that drops
       # every other dependency's verdict (SbomReader's documented "never raises").
-      [:unassessable, { ecosystem: nil, name: name, reason: :malformed_purl }]
+      [:unassessable, {ecosystem: nil, name: name, reason: :malformed_purl}]
     end
 
     # Whether a repository_url points at a known public registry. We only read the

data/lib/still_active/sbom_workflow.rb

@@ -40,7 +40,7 @@ module StillActive
         runtime_ranges = {
           python: safe_support_window("Python") { PythonHelper.supported_python_range },
           dotnet: safe_support_window(".NET") { DotnetHelper.supported_dotnet_range },
-          dotnetfx: safe_support_window(".NET Framework") { DotnetHelper.supported_dotnetfx_range },
+          dotnetfx: safe_support_window(".NET Framework") { DotnetHelper.supported_dotnetfx_range }
         }
         barrier = Async::Barrier.new
         semaphore = Async::Semaphore.new(StillActive.config.parallelism, parent: barrier)
@@ -63,15 +63,15 @@ module StillActive
             result["#{dep[:ecosystem]}/#{dep[:name]}@#{dep[:version]}"] =
               EcosystemLens.assess(ecosystem: dep[:ecosystem], name: dep[:name], version: dep[:version], constraint_cache: constraint_cache, runtime_ranges: runtime_ranges)
                 .merge(dep.slice(:production))
-          rescue StandardError => e
+          rescue => e
             # One dependency's failure must not abort the audit, but it must not
             # disappear either: record it as an unassessable entry (same shape as
             # the reader's, with a distinct reason) so it's counted and reported.
             # production rides along (when known, via slice) so a failed prod dep
             # stays distinguishable from a failed dev one.
-            failures << { ecosystem: dep[:ecosystem], name: dep[:name], version: dep[:version], reason: :assessment_error, error: "#{e.class}: #{e.message}" }
+            failures << {ecosystem: dep[:ecosystem], name: dep[:name], version: dep[:version], reason: :assessment_error, error: "#{e.class}: #{e.message}"}
               .merge(dep.slice(:production))
-            $stderr.puts("error assessing #{dep[:ecosystem]}/#{dep[:name]}@#{dep[:version]}: #{e.class}\n\t#{e.message}")
+            warn("error assessing #{dep[:ecosystem]}/#{dep[:name]}@#{dep[:version]}: #{e.class}\n\t#{e.message}")
           ensure
             completed += 1
             on_progress&.call(completed, total)
@@ -88,7 +88,7 @@ module StillActive
         # Stable, diffable order regardless of async completion order.
         Outcome.new(
           assessed: result.sort_by { |key, _| key }.to_h,
-          failures: failures.sort_by { |failure| "#{failure[:ecosystem]}/#{failure[:name]}@#{failure[:version]}" },
+          failures: failures.sort_by { |failure| "#{failure[:ecosystem]}/#{failure[:name]}@#{failure[:version]}" }
         )
       end.wait
     end
@@ -99,8 +99,8 @@ module StillActive
     # ceiling checks for that runtime) with a warning, never aborting the audit.
     def safe_support_window(label)
       yield
-    rescue StandardError => e
-      $stderr.puts("warning: #{label} support window lookup failed: #{e.class} (#{e.message}); skipping language-ceiling checks")
+    rescue => e
+      warn("warning: #{label} support window lookup failed: #{e.class} (#{e.message}); skipping language-ceiling checks")
       nil
     end
   end

data/lib/still_active/source_credentials.rb

@@ -0,0 +1,39 @@
+# frozen_string_literal: true
+
+require "bundler"
+require "cgi"
+require "uri"
+
+module StillActive
+  # Auth headers for a gem source, resolved the way Bundler itself does: from its
+  # per-host credential store (`bundle config` / the `BUNDLE_<HOST>` env var).
+  #
+  # The store is HOST-KEYED (`credentials_for` is `self[uri.to_s] || self[uri.host]`),
+  # which is the whole security property when a source URI comes from a lockfile: a
+  # host the user never configured resolves to no credential, so a malicious lockfile
+  # naming `attacker.example.com` cannot make still_active send another host's
+  # credential there. There is deliberately NO ambient/global fallback here; the only
+  # ambient token still_active holds (`--artifactory-token`) is guarded by an explicit
+  # host allowlist inside ArtifactoryClient, which is the sole caller that adds it.
+  module SourceCredentials
+    extend self
+
+    def headers_for(source_uri)
+      auth_header(Bundler.settings.credentials_for(URI(source_uri)))
+    end
+
+    # Turns a Bundler credential string into an Authorization header: `user:pass`
+    # becomes Basic (each half percent-decoded, since Bundler stores them encoded),
+    # a bare token becomes Bearer. Empty/nil yields no header.
+    def auth_header(credentials)
+      return {} if credentials.nil? || credentials.empty?
+
+      if credentials.include?(":")
+        user, pass = credentials.split(":", 2).map { |part| CGI.unescape(part) }
+        {"Authorization" => "Basic #{["#{user}:#{pass}"].pack("m0")}"}
+      else
+        {"Authorization" => "Bearer #{credentials}"}
+      end
+    end
+  end
+end

data/lib/still_active/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module StillActive
-  VERSION = "3.0.0.rc4"
+  VERSION = "3.0.0.rc5"
 end