still_active 3.0.0.rc4 → 3.0.0.rc6

data/lib/still_active/ecosystems_client.rb

@@ -26,7 +26,7 @@ module StillActive
     # carries per-version declared dependency constraints (the poison-pill input).
     PACKAGES_BASE_URI = URI("https://packages.ecosyste.ms/")
     # ecosyste.ms asks consumers to identify themselves for its "polite pool".
-    USER_AGENT = "still_active/#{StillActive::VERSION} (+https://github.com/SeanLF/still_active)"
+    USER_AGENT = "still_active/#{StillActive::VERSION} (+https://github.com/SeanLF/still_active)".freeze
 
     # archived + last-commit date from a single repository call. ecosyste.ms's
     # pushed_at mirrors GitHub's, so this returns the same shape as GithubClient.
@@ -35,13 +35,13 @@ module StillActive
       return {} if owner.nil? || name.nil?
 
       path = "/api/v1/hosts/GitHub/repositories/#{encode_repo(owner, name)}"
-      body = HttpHelper.get_json(BASE_URI, path, headers: { "User-Agent" => USER_AGENT }, params: politeness_params)
+      body = HttpHelper.get_json(BASE_URI, path, headers: {"User-Agent" => USER_AGENT}, params: politeness_params)
       # A non-Hash 200 body (error envelope rendered as an array, schema drift)
       # would otherwise raise on indexing and vanish the gem from the audit via
       # the workflow's rescue; degrade to "no signal" like any other read failure.
       return {} unless body.is_a?(Hash)
 
-      signals = { last_commit_date: parse_time(body["pushed_at"], owner, name) }
+      signals = {last_commit_date: parse_time(body["pushed_at"], owner, name)}
       # Only assert archived when the field is actually present. A missing field
       # must read as unknown, not be invented as false -- otherwise a partial
       # crawl could silently mask the most actionable verdict (gem is archived).
@@ -73,7 +73,7 @@ module StillActive
       return [] if name.nil? || version.nil?
 
       path = "/api/v1/registries/#{encode(registry)}/packages/#{encode(name)}/versions/#{encode(version)}"
-      body = HttpHelper.get_json(PACKAGES_BASE_URI, path, headers: { "User-Agent" => USER_AGENT }, params: politeness_params)
+      body = HttpHelper.get_json(PACKAGES_BASE_URI, path, headers: {"User-Agent" => USER_AGENT}, params: politeness_params)
       return [] unless body.is_a?(Hash)
 
       dependencies = body["dependencies"]
@@ -86,7 +86,7 @@ module StillActive
         requirements = dep["requirements"]
         next if package_name.nil? || requirements.nil?
 
-        { package_name: package_name, requirements: requirements }
+        {package_name: package_name, requirements: requirements}
       end
     end
 
@@ -98,7 +98,7 @@ module StillActive
     # lockfile and we don't attribute every user's traffic to one address.
     def politeness_params
       email = StillActive.config.ecosystems_email
-      email ? { mailto: email } : {}
+      email ? {mailto: email} : {}
     end
 
     # nil or a non-string (numeric/array from an off-spec payload) -> no date,
@@ -108,7 +108,7 @@ module StillActive
 
       Time.parse(value)
     rescue ArgumentError
-      $stderr.puts("warning: could not parse repo date for #{owner}/#{name}: #{value.inspect}")
+      warn("warning: could not parse repo date for #{owner}/#{name}: #{value.inspect}")
       nil
     end
 

data/lib/still_active/forgejo_client.rb

@@ -24,7 +24,7 @@ module StillActive
       body = HttpHelper.get_json(base_uri(host), "/api/v1/repos/#{owner}/#{name}", headers: auth_headers)
       return {} if body.nil?
 
-      { archived: body["archived"] == true, last_commit_date: parse_time(body["updated_at"], owner, name) }
+      {archived: body["archived"] == true, last_commit_date: parse_time(body["updated_at"], owner, name)}
     end
 
     private
@@ -34,7 +34,7 @@ module StillActive
 
       Time.parse(value)
     rescue ArgumentError
-      $stderr.puts("warning: could not parse repo date for #{owner}/#{name}: #{value.inspect}")
+      warn("warning: could not parse repo date for #{owner}/#{name}: #{value.inspect}")
       nil
     end
 
@@ -44,7 +44,7 @@ module StillActive
 
     def auth_headers
       token = StillActive.config.forgejo_token
-      token ? { "Authorization" => "token #{token}" } : {}
+      token ? {"Authorization" => "token #{token}"} : {}
     end
   end
 end

data/lib/still_active/github_client.rb

@@ -29,9 +29,9 @@ module StillActive
       end
       return {} unless repo
 
-      { archived: repo.archived, last_commit_date: as_time(repo.pushed_at, owner, name) }
+      {archived: repo.archived, last_commit_date: as_time(repo.pushed_at, owner, name)}
     rescue Octokit::Error, Faraday::Error => e
-      $stderr.puts("warning: repo signals failed for #{owner}/#{name}: #{e.class}")
+      warn("warning: repo signals failed for #{owner}/#{name}: #{e.class}")
       {}
     end
 
@@ -54,7 +54,7 @@ module StillActive
       end
       nil
     rescue Octokit::Error, Faraday::Error => e
-      $stderr.puts("warning: unreleased-commits check failed for #{owner}/#{name}: #{e.class}")
+      warn("warning: unreleased-commits check failed for #{owner}/#{name}: #{e.class}")
       nil
     end
 
@@ -75,12 +75,12 @@ module StillActive
           # Hourly-limit exhaustion (or a far reset): not worth auto-waiting.
           # Surface the one actionable hint rather than a generic class name,
           # then return nil so this signal is simply absent for the gem.
-          $stderr.puts("rate limited on #{label}; set GITHUB_TOKEN to raise your limit, or run less often")
+          warn("rate limited on #{label}; set GITHUB_TOKEN to raise your limit, or run less often")
           return
         end
 
         retried = true
-        $stderr.puts("rate limited on #{label}; waiting #{wait}s for reset")
+        warn("rate limited on #{label}; waiting #{wait}s for reset")
         sleep(wait)
         retry
       end
@@ -119,7 +119,7 @@ module StillActive
 
       Time.parse(value)
     rescue ArgumentError
-      $stderr.puts("warning: could not parse repo date for #{owner}/#{name}: #{value.inspect}")
+      warn("warning: could not parse repo date for #{owner}/#{name}: #{value.inspect}")
       nil
     end
   end

data/lib/still_active/gitlab_client.rb

@@ -20,7 +20,7 @@ module StillActive
       body = HttpHelper.get_json(BASE_URI, path, headers: auth_headers)
       return {} if body.nil?
 
-      { archived: body["archived"] == true, last_commit_date: parse_time(body["last_activity_at"], owner, name) }
+      {archived: body["archived"] == true, last_commit_date: parse_time(body["last_activity_at"], owner, name)}
     end
 
     private
@@ -30,13 +30,13 @@ module StillActive
 
       Time.parse(value)
     rescue ArgumentError
-      $stderr.puts("warning: could not parse repo date for #{owner}/#{name}: #{value.inspect}")
+      warn("warning: could not parse repo date for #{owner}/#{name}: #{value.inspect}")
       nil
     end
 
     def auth_headers
       token = StillActive.config.gitlab_token
-      token ? { "PRIVATE-TOKEN" => token } : {}
+      token ? {"PRIVATE-TOKEN" => token} : {}
     end
 
     def encode_project(owner, name)

data/lib/still_active/options.rb

@@ -57,7 +57,7 @@ module StillActive
       opts.on("--gems=GEM,GEM2,...", Array, "Gem(s)") do |value|
         options[:provided_gems] = true
         # Explicitly named gems are direct by definition (the user chose them).
-        StillActive.config { |config| config.gems = value.map { |g| { name: g, direct: true } } }
+        StillActive.config { |config| config.gems = value.map { |g| {name: g, direct: true} } }
       end
     end
 
@@ -130,14 +130,14 @@ module StillActive
       opts.on(
         "--safe-range-end=YEARS",
         Float,
-        "maximum years since last release considered safe, no warning (default 1.5; fractional allowed)",
+        "maximum years since last release considered safe, no warning (default 1.5; fractional allowed)"
       ) do |value|
         StillActive.config { |config| config.no_warning_range_end = value }
       end
       opts.on(
         "--warning-range-end=YEARS",
         Float,
-        "maximum years since last release that triggers a warning, beyond this is critical (default 3)",
+        "maximum years since last release that triggers a warning, beyond this is critical (default 3)"
       ) do |value|
         StillActive.config { |config| config.warning_range_end = value }
       end
@@ -181,7 +181,7 @@ module StillActive
           # Ceiling findings are only ever :critical or :note, so =warning can't
           # match anything the bare (=critical) default doesn't already catch.
           if value == "warning"
-            $stderr.puts("warning: --fail-if-language-ceiling=warning has no effect (runtime ceilings are only critical or note); behaves as =critical")
+            warn("warning: --fail-if-language-ceiling=warning has no effect (runtime ceilings are only critical or note); behaves as =critical")
           end
           StillActive.config { |config| config.fail_if_language_ceiling = value.to_sym }
         else

data/lib/still_active/osv_client.rb

@@ -15,8 +15,13 @@ module StillActive
   # poison cap's ceiling.
   #
   # Enrichment is best-effort: any failure (missing record, transport error, odd
-  # shape) leaves the advisory exactly as deps.dev produced it. It must never drop
-  # an advisory the audit already found, so it only ever ADDS fields.
+  # shape) leaves the advisory exactly as deps.dev produced it.
+  #
+  # OSV is also the ARBITER of whether a deps.dev-discovered advisory really applies
+  # to the audited version (see reject_unaffected), which is the one place this module
+  # removes rather than adds. That direction is the dangerous one -- a wrongly dropped
+  # advisory reads a vulnerable dependency as clean -- so every degrade path here must
+  # resolve to "keep", and only an unambiguous OSV contradiction may drop.
   module OsvClient
     extend self
 
@@ -34,36 +39,35 @@ module StillActive
       cargo: "crates.io",
       maven: "Maven",
       go: "Go",
-      nuget: "NuGet",
+      nuget: "NuGet"
     }.freeze
 
     # Prefer the newest CVSS version a record carries (v4 is the whole point: it's the
     # one deps.dev can't score). `severity[].score` is the vector STRING, oddly named.
-    CVSS_PRIORITY = { "CVSS_V4" => 3, "CVSS_V3" => 2, "CVSS_V2" => 1 }.freeze
+    CVSS_PRIORITY = {"CVSS_V4" => 3, "CVSS_V3" => 2, "CVSS_V2" => 1}.freeze
     # A v2 vector has no `CVSS:X.Y` prefix, so the version can't be read from the
     # string; fall back to the entry type so the CycloneDX rating method labels it v2.
-    TYPE_VERSIONS = { "CVSS_V4" => "4.0", "CVSS_V3" => "3.1", "CVSS_V2" => "2.0" }.freeze
+    TYPE_VERSIONS = {"CVSS_V4" => "4.0", "CVSS_V3" => "3.1", "CVSS_V2" => "2.0"}.freeze
 
     # Enrich each advisory in place with the OSV severity label and the fixed
-    # versions for the audited package. A missing/failed lookup is a no-op on that
-    # advisory (it keeps whatever deps.dev gave it), never a raise.
-    def enrich(advisories, ecosystem:, name:)
-      advisories.each do |advisory|
-        record = detail(advisory_id: advisory[:id])
-        next if record.nil?
-
-        advisory[:osv_severity] = record[:severity_label]
-        advisory[:osv_cvss_score] = record[:cvss_score]
-        advisory[:cvss_version] = record[:cvss_version]
-        advisory[:cvss_vector] = record[:cvss_vector]
-        advisory[:fixed_versions] = fixed_versions(record, ecosystem: ecosystem, name: name)
-      rescue StandardError => e
-        # Enrichment is additive and best-effort. An unexpected OSV shape must never
-        # raise out through the workflow's per-gem rescue, which would DROP the whole
-        # gem and read a known-vulnerable dependency as clean. Leave the advisory
-        # exactly as deps.dev produced it.
-        $stderr.puts("warning: OSV enrichment for #{advisory[:id]} failed: #{e.class} (#{e.message}); leaving advisory unchanged")
+    # versions for the audited package, and return the advisories that survive
+    # version confirmation (see reject_unaffected). A missing/failed lookup is a
+    # no-op on that advisory (it keeps whatever deps.dev gave it), never a raise.
+    def enrich(advisories, ecosystem:, name:, version: nil)
+      # Each eligible advisory is paired with OSV's own identifiers for it, which the
+      # confirmation match needs alongside deps.dev's (see detail).
+      backed = advisories.filter_map do |advisory|
+        osv_ids = apply_record(advisory, ecosystem: ecosystem, name: name)
+        [advisory, osv_ids] if osv_ids
       end
+      reject_unaffected(advisories, backed, ecosystem: ecosystem, name: name, version: version)
+    rescue => e
+      # The confirmation pass runs outside apply_record's per-advisory rescue, and an
+      # escape from here would hit the workflow's per-gem rescue and strip the gem of
+      # ALL its signals -- reading a known-vulnerable dependency as clean, the very
+      # thing this module exists to prevent. Keep every advisory instead.
+      warn("warning: OSV version confirmation for #{name} failed: #{e.class} (#{e.message}); keeping every advisory")
+      advisories
     end
 
     # Fetch and parse one OSV record by advisory id (GHSA/CVE). Returns
@@ -79,16 +83,173 @@ module StillActive
 
       cvss = best_cvss(body)
       {
+        # OSV's own identity for the advisory, unioned into the match against a query
+        # result. Asking for a CVE returns the GHSA record (OSV resolves aliases), so
+        # deps.dev's id alone can miss the id the query answers with, and reading a
+        # listed advisory as absent would drop a real finding.
+        identifiers: [body["id"], *Array(body["aliases"])].grep(String),
         severity_label: body.dig("database_specific", "severity"),
         cvss_score: cvss[:score],
         cvss_version: cvss[:version],
         cvss_vector: cvss[:vector],
-        affected: Array(body["affected"]).filter_map { |entry| parse_affected(entry) },
+        affected: Array(body["affected"]).filter_map { |entry| parse_affected(entry) }
       }
     end
 
     private
 
+    # Applies one OSV record to one advisory, in place. Returns OSV's identifiers for
+    # the advisory when it is eligible for the version confirmation below (only OSV
+    # data may overrule OSV-derived data), or nil when it is not and must be kept
+    # whatever the query says.
+    def apply_record(advisory, ecosystem:, name:)
+      record = detail(advisory_id: advisory[:id])
+      return if record.nil?
+
+      advisory[:osv_severity] = record[:severity_label]
+      advisory[:osv_cvss_score] = record[:cvss_score]
+      advisory[:cvss_version] = record[:cvss_version]
+      advisory[:cvss_vector] = record[:cvss_vector]
+      advisory[:fixed_versions] = fixed_versions(record, ecosystem: ecosystem, name: name)
+      record[:identifiers] if names_package?(record, ecosystem: ecosystem, name: name)
+    rescue => e
+      # Enrichment is additive and best-effort. An unexpected OSV shape must never
+      # raise out through the workflow's per-gem rescue, which would DROP the whole
+      # gem and read a known-vulnerable dependency as clean. Leave the advisory
+      # exactly as deps.dev produced it, and hold it (nil) rather than risk
+      # dropping it on a record we couldn't read.
+      warn("warning: OSV enrichment for #{advisory[:id]} failed: #{e.class} (#{e.message}); leaving advisory unchanged")
+      nil
+    end
+
+    # Drops the advisories that OSV's own version matching says don't apply to the
+    # audited version. deps.dev is the discovery source, but it MIRRORS OSV/GHSA data
+    # with an ingestion lag, and advisories get AMENDED after publication: the usual
+    # shape is a CVE published with a fix on the current release line, then backports
+    # to the older supported lines, then an amendment adding those branch ranges. Until
+    # deps.dev re-ingests, it keeps serving the pre-amendment record, whose broader
+    # range still covers versions the amendment has since marked patched.
+    #
+    # Receipt (2026-07-31): GHSA-mh99-v99m-4gvg was published 07-24 with a single
+    # range, introduced 0 / fixed 5.0.8. Backports 3.0.3, 2.1.3 and 1.1.17 shipped
+    # 07-27 to 07-29, and the advisory was amended 07-31 19:39Z to carry all four
+    # branches. Hours later deps.dev still answered from the 07-24 record, reporting
+    # the patched 1.1.17/1.1.18/2.1.3/2.1.4/3.0.3 as vulnerable.
+    #
+    # This is lag, NOT a parsing defect: 341 multi-branch advisories across
+    # npm/rubygems/pypi/cargo were compared against OSV over 589 version checks, and
+    # every one agreed. So the correction has to be a live re-check, not a local range
+    # fix. We
+    # ask OSV's /v1/query, deps.dev's own upstream, which applies the declared ranges
+    # under each ecosystem's semantics and reflects an amendment immediately. It also
+    # saves reimplementing cross-ecosystem version ordering.
+    #
+    # The window reopens with every backported fix, so this is structural, not a
+    # one-off worth waiting out.
+    #
+    # Removing a finding is the one direction this tool must never get wrong, so a drop
+    # needs positive contradiction on every count: the advisory came from deps.dev ALONE
+    # (ruby-advisory-db does its own version matching and is the Ruby authority, so its
+    # verdict stands), OSV served a record for it that names this package under this
+    # ecosystem and spelling, and the query for this exact version succeeded without
+    # listing it. Anything unknown -- no version, unmapped ecosystem, failed query --
+    # keeps the advisory.
+    def reject_unaffected(advisories, backed, ecosystem:, name:, version:)
+      candidates = backed.select { |advisory, _osv_ids| advisory[:source] == "deps.dev" }
+      return advisories if candidates.empty? || version.to_s.empty?
+
+      affected = affected_identifiers(ecosystem: ecosystem, name: name, version: version)
+      return advisories if affected.nil?
+
+      unaffected = candidates
+        .reject { |advisory, osv_ids| (identifiers(advisory) | osv_ids).intersect?(affected) }
+        .map(&:first)
+      # Say so when a finding is removed. This is the only path that can turn a red run
+      # green, and a silent drop leaves no way to tell "OSV cleared it" from "the audit
+      # missed it". Matches the per-gem stderr notes the severity gates already emit.
+      unaffected.each { |advisory| warn("still_active: #{name}@#{version} is not affected by #{advisory[:id]} per OSV; deps.dev listed it, dropping") }
+      advisories - unaffected
+    end
+
+    # Every advisory identifier OSV reports as affecting this exact package version,
+    # or nil when the question can't be asked or answered (unmapped ecosystem, failed
+    # request, unusable body). An EMPTY array is a real answer -- "nothing affects this
+    # version" -- and must stay distinct from the nil, which means "we don't know".
+    #
+    # That distinction is the whole safety of the drop, so an empty array is only ever
+    # returned for a body that positively IS an empty OSV result. OSV's genuine all-clear
+    # is a bare `{}` (verified live, and identical to what an unknown package name
+    # returns), which gives a malformed or truncated body no distinguishing marker of
+    # its own: read loosely, every unparseable 200 would fabricate an all-clear.
+    def affected_identifiers(ecosystem:, name:, version:)
+      osv_ecosystem = ECOSYSTEM_NAMES[ecosystem || :rubygems]
+      return if osv_ecosystem.nil?
+
+      query = {version: version, package: {name: name, ecosystem: osv_ecosystem}}
+      body = HttpHelper.post_json(BASE_URI, "/v1/query", body: JSON.generate(query))
+      return unless body.is_a?(Hash)
+
+      identifiers_from(body)
+    rescue => e
+      warn("warning: OSV version confirmation for #{name}@#{version} failed: #{e.class} (#{e.message}); keeping every advisory")
+      nil
+    end
+
+    # The identifiers in one /v1/query body, or nil when the body isn't a complete,
+    # readable answer. A truncated answer is not an answer: OSV paginates past 1000
+    # vulnerabilities OR once a query exceeds 20 seconds, and documents that a page can
+    # carry ONLY a next_page_token. That second trigger is latency, not package size, so
+    # it can land on any package on a slow day; reading it as "nothing affects this
+    # version" would drop real findings at random. We decline to filter rather than
+    # walk the pages, since the pass only ever removes false positives.
+    def identifiers_from(body)
+      return if body["next_page_token"] || body["nextPageToken"]
+      # A bare `{}` is OSV's genuine "nothing affects this version" (verified live). It
+      # has to be matched exactly, not as "no vulns key": an error envelope served with a
+      # 200 (`{"code":3,"message":...}`) has no vulns key either, and reading that as an
+      # all-clear would drop every advisory on the package.
+      return [] if body.empty?
+
+      vulns = body["vulns"]
+      return unless vulns.is_a?(Array)
+      # EVERY entry has to be readable, not just one of them. Skipping the unreadable
+      # ones would silently shorten the list, and a short list is indistinguishable from
+      # OSV not listing that advisory at all: the one it named but we couldn't parse
+      # would be dropped as unaffected. `all?` holds on an empty array, so OSV's other
+      # genuine all-clear shape, `{"vulns": []}`, still answers.
+      return unless vulns.all? { |vuln| vuln.is_a?(Hash) && vuln["id"].is_a?(String) }
+
+      vulns.flat_map { |vuln| [vuln["id"], *vuln["aliases"]] }.grep(String)
+    end
+
+    # An advisory's own id plus its aliases, mirroring VulnerabilityHelper's merge
+    # identity: OSV keys a record by GHSA while deps.dev may hand us the CVE (or the
+    # reverse), so matching on the primary id alone would read a listed advisory as
+    # absent and drop a real finding.
+    def identifiers(advisory)
+      [advisory[:id], *advisory[:aliases]].compact.map(&:to_s)
+    end
+
+    # Does this record carry version data for the audited package, under the exact
+    # ecosystem and spelling we're querying with? Both halves guard a fabricated
+    # all-clear, because OSV answers an unknown package and a patched version with the
+    # same bare `{}`:
+    #
+    # NAME -- registry name normalization differs by ecosystem (PyPI folds case and
+    # -/_/.), so a spelling mismatch would turn a missed lookup into "not affected".
+    # Exact equality is stricter than OSV's own matching, which costs us the fix on a
+    # case-divergent name; that's the safe direction to be wrong in.
+    #
+    # VERSIONED -- an affected entry with no ranges and no version list (or one whose
+    # window lives somewhere /v1/query can't match on, like a GIT range) is OSV having
+    # no opinion on versions at all. The query can then never return that record for
+    # ANY version, so treating its silence as contradiction would drop the advisory
+    # permanently, for every user, while deps.dev still asserts the version is affected.
+    def names_package?(record, ecosystem:, name:)
+      osv_ecosystem = ECOSYSTEM_NAMES[ecosystem || :rubygems]
+      record[:affected].any? { |a| a[:name] == name && a[:ecosystem] == osv_ecosystem && a[:versioned] }
+    end
+
     # The highest-version CVSS vector the record carries, as { score:, version:,
     # vector: } (a computed base score, the "3.1"/"4.0" version, and the raw string),
     # or all-nil. deps.dev has no v4 score, so this is what gives a CVSS-4-only
@@ -100,7 +261,7 @@ module StillActive
       return {} if entry.nil?
 
       vector = entry["score"]
-      { score: CvssHelper.score(vector), version: cvss_version(vector) || TYPE_VERSIONS[entry["type"]], vector: vector }
+      {score: CvssHelper.score(vector), version: cvss_version(vector) || TYPE_VERSIONS[entry["type"]], vector: vector}
     end
 
     # The X.Y version from a "CVSS:X.Y/..." vector prefix, or nil.
@@ -132,12 +293,21 @@ module StillActive
       package = entry["package"]
       return unless package.is_a?(Hash) && package["name"]
 
-      fixed = Array(entry["ranges"]).flat_map do |range|
-        next [] unless range.is_a?(Hash)
+      ranges = Array(entry["ranges"]).select { |range| range.is_a?(Hash) }
+      fixed = ranges.flat_map { |range| Array(range["events"]).filter_map { |event| event["fixed"] if event.is_a?(Hash) } }
+      {ecosystem: package["ecosystem"], name: package["name"], fixed: fixed, versioned: version_matchable?(entry, ranges)}
+    end
 
-        Array(range["events"]).filter_map { |event| event["fixed"] if event.is_a?(Hash) }
-      end
-      { ecosystem: package["ecosystem"], name: package["name"], fixed: fixed }
+    # Range types /v1/query can resolve a VERSION against. A GIT range is commit-graph
+    # data a version query never matches, so a record carrying only those has no version
+    # opinion to contradict deps.dev with. A range missing its type reads the same way.
+    VERSION_RANGE_TYPES = ["SEMVER", "ECOSYSTEM"].freeze
+
+    # Does this affected entry hold data a version query could match on -- an explicit
+    # version list, or a version-ordered range? See names_package? for why the absence
+    # of it has to block a drop rather than permit one.
+    def version_matchable?(entry, ranges)
+      !Array(entry["versions"]).empty? || ranges.any? { |range| VERSION_RANGE_TYPES.include?(range["type"]) }
     end
 
     def encode(value)

data/lib/still_active/poison_security_correlator.rb

@@ -73,7 +73,7 @@ module StillActive
         next unless data[:vulnerability_count].to_i.positive?
 
         name = data[:name] || key
-        map["#{data[:ecosystem]}/#{name}"] = { vulns: hashes(data[:vulnerabilities]), used_version: data[:version_used] }
+        map["#{data[:ecosystem]}/#{name}"] = {vulns: hashes(data[:vulnerabilities]), used_version: data[:version_used]}
       end
     end
 
@@ -85,7 +85,7 @@ module StillActive
     def copy_index(result_object)
       result_object.each_with_object({}) do |(key, data), map|
         name = data[:name] || key
-        (map["#{data[:ecosystem]}/#{name}"] ||= []) << { version: data[:version_used], vulns: hashes(data[:vulnerabilities]) }
+        (map["#{data[:ecosystem]}/#{name}"] ||= []) << {version: data[:version_used], vulns: hashes(data[:vulnerabilities])}
       end
     end
 
@@ -148,7 +148,7 @@ module StillActive
         capped_dep_vulnerable: true,
         capped_below_fix: true,
         below_fix_advisory: receipt[:id],
-        below_fix_fixed_in: nearest_fix(receipt, oldest),
+        below_fix_fixed_in: nearest_fix(receipt, oldest)
       }
     end
 

data/lib/still_active/pypi_client.rb

@@ -20,7 +20,7 @@ module StillActive
 
     BASE_URI = URI("https://pypi.org/")
     # Polite identification, matching EcosystemsClient's convention.
-    USER_AGENT = "still_active/#{StillActive::VERSION} (+https://github.com/SeanLF/still_active)"
+    USER_AGENT = "still_active/#{StillActive::VERSION} (+https://github.com/SeanLF/still_active)".freeze
 
     # The PEP 440 `requires_python` specifier a release declares (e.g.
     # ">=3.8,<3.13"), or nil when the version is unreadable or declares none.
@@ -30,7 +30,7 @@ module StillActive
       return if name.nil? || version.nil?
 
       path = "/pypi/#{encode(name)}/#{encode(version)}/json"
-      body = HttpHelper.get_json(BASE_URI, path, headers: { "User-Agent" => USER_AGENT })
+      body = HttpHelper.get_json(BASE_URI, path, headers: {"User-Agent" => USER_AGENT})
       return unless body.is_a?(Hash)
 
       # Guard the nested read: a non-Hash `info` (schema drift) would make

data/lib/still_active/repository.rb

@@ -8,9 +8,9 @@ module StillActive
     SOURCE_BY_HOST = {
       "github.com" => :github,
       "gitlab.com" => :gitlab,
-      "codeberg.org" => :forgejo,
+      "codeberg.org" => :forgejo
     }.freeze
-    REPO_REGEX = %r{(?<url>https?://(?:www\.)?(?<host>github\.com|gitlab\.com|codeberg\.org)/(?<owner>[\w.\-]+)/(?<name>[\w.\-]+))}i
+    REPO_REGEX = %r{(?<url>https?://(?:www\.)?(?<host>github\.com|gitlab\.com|codeberg\.org)/(?<owner>[\w.-]+)/(?<name>[\w.-]+))}i
 
     extend self
 
@@ -22,12 +22,12 @@ module StillActive
 
     def url_with_owner_and_name(url:)
       match = url&.match(REPO_REGEX)
-      return { source: :unhandled, owner: nil, name: nil } unless match
+      return {source: :unhandled, owner: nil, name: nil} unless match
 
       clean_url = match[:url].delete_suffix(".git")
       name = match[:name].delete_suffix(".git")
 
-      { url: clean_url, source: SOURCE_BY_HOST.fetch(match[:host].downcase), owner: match[:owner], name: name }
+      {url: clean_url, source: SOURCE_BY_HOST.fetch(match[:host].downcase), owner: match[:owner], name: name}
     end
   end
 end