still_active 3.0.0.rc4 → 3.0.0.rc6

data/lib/still_active/sarif/rules.rb

@@ -60,8 +60,8 @@ module StillActive
           neutral: {
             short: "Package's source repository is archived",
             full: "The package's upstream repository has been marked archived. No further fixes, including security patches, should be expected.",
-            help_text: "Look for a maintained fork or alternative. If you must keep the package, vendor or fork it so you can apply patches yourself.",
-          },
+            help_text: "Look for a maintained fork or alternative. If you must keep the package, vendor or fork it so you can apply patches yourself."
+          }
         },
         {
           id: "SA002",
@@ -75,8 +75,8 @@ module StillActive
           neutral: {
             short: "Package has had no release for over 3 years",
             full: "The package's latest release is over 3 years old. Not formally archived, but a strong abandonment signal: a consumer cannot pull fixes that were never released. For a package with no releases at all (e.g. git-sourced), the last commit date is used instead.",
-            help_text: "Verify the package still works on your supported runtime and consider a maintained alternative.",
-          },
+            help_text: "Verify the package still works on your supported runtime and consider a maintained alternative."
+          }
         },
         {
           id: "SA003",
@@ -88,8 +88,8 @@ module StillActive
           security_severity: "7.0", # default; per-result override from CVSS
           tags: ["security", "vulnerability", "external/cwe/cwe-1104"],
           neutral: {
-            short: "Package has known vulnerabilities (via deps.dev / OSV)",
-          },
+            short: "Package has known vulnerabilities (via deps.dev / OSV)"
+          }
         },
         {
           id: "SA004",
@@ -102,8 +102,8 @@ module StillActive
           tags: ["maintenance", "libyear"],
           neutral: {
             short: "Package is significantly behind the latest release",
-            help_text: "Schedule an upgrade to the latest release.",
-          },
+            help_text: "Schedule an upgrade to the latest release."
+          }
         },
         {
           id: "SA005",
@@ -115,8 +115,8 @@ module StillActive
           security_severity: nil,
           tags: ["supply-chain", "openssf"],
           neutral: {
-            short: "Package's OpenSSF Scorecard is low",
-          },
+            short: "Package's OpenSSF Scorecard is low"
+          }
         },
         {
           id: "SA006",
@@ -127,7 +127,7 @@ module StillActive
           level: "error",
           security_severity: "8.5",
           tags: ["security", "runtime", "external/cwe/cwe-1104"],
-          native_only: true,
+          native_only: true
         },
         {
           id: "SA007",
@@ -141,8 +141,8 @@ module StillActive
           neutral: {
             short: "Resolved package version has been yanked from its registry",
             full: "The resolved version has been yanked by the package owner, typically for a serious bug or vulnerability.",
-            help_text: "Update to a non-yanked version immediately.",
-          },
+            help_text: "Update to a non-yanked version immediately."
+          }
         },
         {
           id: "SA008",
@@ -156,8 +156,8 @@ module StillActive
           neutral: {
             short: "Dormant package caps a dependency below its latest major",
             full: "A dormant (abandoned or archived) package declares a runtime constraint that caps one of its dependencies below that dependency's current latest major. Because nobody is shipping the package, the cap will never lift, and it grows more constraining as the capped dependency releases new majors: the tree is held below a ceiling no upstream release will raise.",
-            help_text: "Replace or fork the dormant package, or vendor a version that relaxes the constraint. For a transitive pill, target the direct dependency that pulls it in.",
-          },
+            help_text: "Replace or fork the dormant package, or vendor a version that relaxes the constraint. For a transitive pill, target the direct dependency that pulls it in."
+          }
         },
         {
           id: "SA009",
@@ -167,8 +167,8 @@ module StillActive
           help_text: "If a newer release of the package lifts the cap, upgrade it. Otherwise replace or fork the package, or contribute support for the newer runtime upstream.",
           level: "note",
           security_severity: nil, # maintenance/compatibility, not a CVE (as SA002/SA004/SA005/SA008)
-          tags: ["maintenance", "runtime", "external/cwe/cwe-1104"],
-        },
+          tags: ["maintenance", "runtime", "external/cwe/cwe-1104"]
+        }
       ].freeze
 
       # Builds a frozen catalog for one wording flavour. `:neutral` applies each
@@ -181,10 +181,10 @@ module StillActive
         neutral = flavour == :neutral
         rules = neutral ? RAW_RULES.reject { |r| r[:native_only] } : RAW_RULES
         rules.map do |r|
-          resolved = neutral && r[:neutral] ? r.merge(r[:neutral]) : r
+          resolved = (neutral && r[:neutral]) ? r.merge(r[:neutral]) : r
           resolved.except(:neutral, :native_only).merge(
             tags: r[:tags].dup.freeze,
-            help_markdown: "#{resolved[:help_text]}\n\nSee [#{r[:id]} docs](#{help_uri(r[:id])}) for full guidance.",
+            help_markdown: "#{resolved[:help_text]}\n\nSee [#{r[:id]} docs](#{help_uri(r[:id])}) for full guidance."
           ).freeze
         end.freeze
       end
@@ -194,7 +194,7 @@ module StillActive
 
       # flavour: :ruby (default, native Gemfile path) or :neutral (SBOM path).
       def all(flavour = :ruby)
-        flavour == :neutral ? NEUTRAL_CATALOG : CATALOG
+        (flavour == :neutral) ? NEUTRAL_CATALOG : CATALOG
       end
 
       def find(id, flavour = :ruby)

data/lib/still_active/sbom_reader.rb

@@ -32,7 +32,7 @@ module StillActive
       "cargo" => :cargo,
       "maven" => :maven,
       "golang" => :go,
-      "nuget" => :nuget,
+      "nuget" => :nuget
     }.freeze
 
     # PURL types that are not package dependencies: CI actions and opaque
@@ -100,7 +100,7 @@ module StillActive
 
       name = component["name"]
       purl = component["purl"]
-      return [:unassessable, { ecosystem: nil, name: name, reason: :no_purl }] unless purl.is_a?(String) && !purl.empty?
+      return [:unassessable, {ecosystem: nil, name: name, reason: :no_purl}] unless purl.is_a?(String) && !purl.empty?
 
       classify_purl(purl, name)
     end
@@ -121,7 +121,7 @@ module StillActive
       "repo1.maven.org",
       "repo.maven.apache.org",
       "api.nuget.org",
-      "proxy.golang.org",
+      "proxy.golang.org"
     ].freeze
 
     def classify_purl(purl, name)
@@ -130,7 +130,7 @@ module StillActive
       ecosystem = ECOSYSTEMS[type]
 
       if ecosystem
-        return [:unassessable, { ecosystem: type, name: name, reason: :no_version }] if parsed.version.to_s.empty?
+        return [:unassessable, {ecosystem: type, name: name, reason: :no_version}] if parsed.version.to_s.empty?
 
         full_name = build_name(ecosystem, parsed.namespace, parsed.name)
         repository_url = parsed.qualifiers&.dig("repository_url")
@@ -143,14 +143,14 @@ module StillActive
         # from a public one, so it is still assessed by name. Best-effort, not a
         # guarantee that every private package is caught.
         if repository_url && !public_registry?(repository_url)
-          return [:unassessable, { ecosystem: ecosystem, name: full_name, version: parsed.version, reason: :private_registry, repository_url: repository_url }]
+          return [:unassessable, {ecosystem: ecosystem, name: full_name, version: parsed.version, reason: :private_registry, repository_url: repository_url}]
         end
 
-        [:dependency, { ecosystem: ecosystem, name: full_name, version: parsed.version }]
+        [:dependency, {ecosystem: ecosystem, name: full_name, version: parsed.version}]
       elsif NOISE_TYPES.include?(type)
         nil # CI actions / opaque binaries: not a package dependency
       else
-        [:unassessable, { ecosystem: type, name: name, reason: :unsupported_ecosystem }]
+        [:unassessable, {ecosystem: type, name: name, reason: :unsupported_ecosystem}]
       end
     rescue ArgumentError
       # InvalidPackageURL is a subclass of ArgumentError, but PackageURL.parse also
@@ -158,7 +158,7 @@ module StillActive
       # or bad percent-encoding, both common in real Syft/Trivy output. Catch both so
       # one malformed component degrades to unassessable, never a backtrace that drops
       # every other dependency's verdict (SbomReader's documented "never raises").
-      [:unassessable, { ecosystem: nil, name: name, reason: :malformed_purl }]
+      [:unassessable, {ecosystem: nil, name: name, reason: :malformed_purl}]
     end
 
     # Whether a repository_url points at a known public registry. We only read the

data/lib/still_active/sbom_workflow.rb

@@ -40,7 +40,7 @@ module StillActive
         runtime_ranges = {
           python: safe_support_window("Python") { PythonHelper.supported_python_range },
           dotnet: safe_support_window(".NET") { DotnetHelper.supported_dotnet_range },
-          dotnetfx: safe_support_window(".NET Framework") { DotnetHelper.supported_dotnetfx_range },
+          dotnetfx: safe_support_window(".NET Framework") { DotnetHelper.supported_dotnetfx_range }
         }
         barrier = Async::Barrier.new
         semaphore = Async::Semaphore.new(StillActive.config.parallelism, parent: barrier)
@@ -63,15 +63,15 @@ module StillActive
             result["#{dep[:ecosystem]}/#{dep[:name]}@#{dep[:version]}"] =
               EcosystemLens.assess(ecosystem: dep[:ecosystem], name: dep[:name], version: dep[:version], constraint_cache: constraint_cache, runtime_ranges: runtime_ranges)
                 .merge(dep.slice(:production))
-          rescue StandardError => e
+          rescue => e
             # One dependency's failure must not abort the audit, but it must not
             # disappear either: record it as an unassessable entry (same shape as
             # the reader's, with a distinct reason) so it's counted and reported.
             # production rides along (when known, via slice) so a failed prod dep
             # stays distinguishable from a failed dev one.
-            failures << { ecosystem: dep[:ecosystem], name: dep[:name], version: dep[:version], reason: :assessment_error, error: "#{e.class}: #{e.message}" }
+            failures << {ecosystem: dep[:ecosystem], name: dep[:name], version: dep[:version], reason: :assessment_error, error: "#{e.class}: #{e.message}"}
               .merge(dep.slice(:production))
-            $stderr.puts("error assessing #{dep[:ecosystem]}/#{dep[:name]}@#{dep[:version]}: #{e.class}\n\t#{e.message}")
+            warn("error assessing #{dep[:ecosystem]}/#{dep[:name]}@#{dep[:version]}: #{e.class}\n\t#{e.message}")
           ensure
             completed += 1
             on_progress&.call(completed, total)
@@ -88,7 +88,7 @@ module StillActive
         # Stable, diffable order regardless of async completion order.
         Outcome.new(
           assessed: result.sort_by { |key, _| key }.to_h,
-          failures: failures.sort_by { |failure| "#{failure[:ecosystem]}/#{failure[:name]}@#{failure[:version]}" },
+          failures: failures.sort_by { |failure| "#{failure[:ecosystem]}/#{failure[:name]}@#{failure[:version]}" }
         )
       end.wait
     end
@@ -99,8 +99,8 @@ module StillActive
     # ceiling checks for that runtime) with a warning, never aborting the audit.
     def safe_support_window(label)
       yield
-    rescue StandardError => e
-      $stderr.puts("warning: #{label} support window lookup failed: #{e.class} (#{e.message}); skipping language-ceiling checks")
+    rescue => e
+      warn("warning: #{label} support window lookup failed: #{e.class} (#{e.message}); skipping language-ceiling checks")
       nil
     end
   end

data/lib/still_active/source_credentials.rb

@@ -0,0 +1,39 @@
+# frozen_string_literal: true
+
+require "bundler"
+require "cgi"
+require "uri"
+
+module StillActive
+  # Auth headers for a gem source, resolved the way Bundler itself does: from its
+  # per-host credential store (`bundle config` / the `BUNDLE_<HOST>` env var).
+  #
+  # The store is HOST-KEYED (`credentials_for` is `self[uri.to_s] || self[uri.host]`),
+  # which is the whole security property when a source URI comes from a lockfile: a
+  # host the user never configured resolves to no credential, so a malicious lockfile
+  # naming `attacker.example.com` cannot make still_active send another host's
+  # credential there. There is deliberately NO ambient/global fallback here; the only
+  # ambient token still_active holds (`--artifactory-token`) is guarded by an explicit
+  # host allowlist inside ArtifactoryClient, which is the sole caller that adds it.
+  module SourceCredentials
+    extend self
+
+    def headers_for(source_uri)
+      auth_header(Bundler.settings.credentials_for(URI(source_uri)))
+    end
+
+    # Turns a Bundler credential string into an Authorization header: `user:pass`
+    # becomes Basic (each half percent-decoded, since Bundler stores them encoded),
+    # a bare token becomes Bearer. Empty/nil yields no header.
+    def auth_header(credentials)
+      return {} if credentials.nil? || credentials.empty?
+
+      if credentials.include?(":")
+        user, pass = credentials.split(":", 2).map { |part| CGI.unescape(part) }
+        {"Authorization" => "Basic #{["#{user}:#{pass}"].pack("m0")}"}
+      else
+        {"Authorization" => "Bearer #{credentials}"}
+      end
+    end
+  end
+end

data/lib/still_active/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module StillActive
-  VERSION = "3.0.0.rc4"
+  VERSION = "3.0.0.rc6"
 end

data/lib/still_active/workflow.rb

@@ -1,6 +1,8 @@
 # frozen_string_literal: true
 
 require_relative "artifactory_client"
+require_relative "compact_index_client"
+require_relative "source_credentials"
 require_relative "ceiling_reconciler"
 require_relative "deps_dev_client"
 require_relative "osv_client"
@@ -46,8 +48,8 @@ module StillActive
         ruby_range =
           begin
             RubyHelper.supported_ruby_range
-          rescue StandardError => e
-            $stderr.puts("warning: Ruby support window lookup failed: #{e.class} (#{e.message}); skipping language-ceiling checks")
+          rescue => e
+            warn("warning: Ruby support window lookup failed: #{e.class} (#{e.message}); skipping language-ceiling checks")
             nil
           end
         # Resolve the GitHub token once here, single-fibered, before the fan-out:
@@ -79,14 +81,14 @@ module StillActive
               advisory_db: advisory_db,
               catalog: catalog,
               constraint_cache: constraint_cache,
-              ruby_range: ruby_range,
+              ruby_range: ruby_range
             )
           rescue Octokit::TooManyRequests
             $stderr.print("\r\e[K") if on_progress
-            $stderr.puts("rate limited checking #{gem[:name]}: set GITHUB_TOKEN to increase your limit")
-          rescue StandardError => e
+            warn("rate limited checking #{gem[:name]}: set GITHUB_TOKEN to increase your limit")
+          rescue => e
             $stderr.print("\r\e[K") if on_progress
-            $stderr.puts("error occurred for #{gem[:name]}: #{e.class}\n\t#{e.message}")
+            warn("error occurred for #{gem[:name]}: #{e.class}\n\t#{e.message}")
           ensure
             completed += 1
             on_progress&.call(completed, total)
@@ -115,7 +117,7 @@ module StillActive
     private
 
     def gem_info(gem_name:, result_object:, gem_version: nil, source_type: :rubygems, source_uri: nil, direct: true, dependency_path: nil, advisory_db: nil, catalog: nil, constraint_cache: {}, ruby_range: nil)
-      result_object[gem_name] = { source_type: source_type, direct: direct }
+      result_object[gem_name] = {source_type: source_type, direct: direct}
       result_object[gem_name][:dependency_path] = dependency_path if dependency_path
       result_object[gem_name][:version_used] = gem_version if gem_version
 
@@ -129,7 +131,7 @@ module StillActive
           result_object: result_object,
           source_uri: source_uri,
           advisory_db: advisory_db,
-          ruby_range: ruby_range,
+          ruby_range: ruby_range
         )
       end
 
@@ -148,19 +150,19 @@ module StillActive
       signals = repo_signals(
         source: repo_info[:source],
         repository_owner: repo_info[:owner],
-        repository_name: repo_info[:name],
+        repository_name: repo_info[:name]
       )
       commit_date = signals[:last_commit_date]
       archived = signals[:archived]
       last_release = VersionHelper.find_version(versions: vs, pre_release: false)
       last_pre_release = VersionHelper.upcoming_pre_release(
         pre_release: VersionHelper.find_version(versions: vs, pre_release: true),
-        release: last_release,
+        release: last_release
       )
       deps_dev = fetch_deps_dev_info(
         gem_name: gem_name,
         version: gem_version || VersionHelper.gem_version(version_hash: last_release),
-        advisory_db: advisory_db,
+        advisory_db: advisory_db
       )
       result_object[gem_name].merge!({
         latest_version: VersionHelper.gem_version(version_hash: last_release),
@@ -172,10 +174,14 @@ module StillActive
         repository_url: repo_info[:url],
         last_commit_date: commit_date,
         archived: archived,
-        **deps_dev,
+        **deps_dev
       })
 
-      unless vs.empty?
+      # Only a gem that actually lives on public rubygems.org gets a rubygems.org
+      # page link. For a private source, rubygems.org/gems/<name> is a public
+      # name collision (for sidekiq-pro, the 0.0.3 squat-warning decoy), not the
+      # gem the user resolves -- the same #43 substitution the repo-URL guard blocks.
+      unless vs.empty? || unqueryable_private_source?(source_uri)
         result_object[gem_name][:ruby_gems_url] = "https://rubygems.org/gems/#{gem_name}"
       end
 
@@ -184,7 +190,7 @@ module StillActive
           source: repo_info[:source],
           repository_owner: repo_info[:owner],
           repository_name: repo_info[:name],
-          version: VersionHelper.gem_version(version_hash: last_release),
+          version: VersionHelper.gem_version(version_hash: last_release)
         )
       end
 
@@ -194,7 +200,7 @@ module StillActive
           up_to_date: VersionHelper.up_to_date(
             version_used: version_used,
             latest_version: last_release,
-            latest_pre_release_version: last_pre_release,
+            latest_pre_release_version: last_pre_release
           ),
 
           version_used_release_date: VersionHelper.release_date(version_hash: version_used),
@@ -202,8 +208,8 @@ module StillActive
           license: VersionHelper.license(version_hash: version_used),
           libyear: LibyearHelper.gem_libyear(
             version_used_release_date: VersionHelper.release_date(version_hash: version_used),
-            latest_version_release_date: VersionHelper.release_date(version_hash: last_release),
-          ),
+            latest_version_release_date: VersionHelper.release_date(version_hash: last_release)
+          )
         })
       end
 
@@ -218,7 +224,7 @@ module StillActive
           used_ruby_requirement: canonical_ruby_requirement(vs, version_used),
           latest_ruby_requirement: canonical_ruby_requirement(vs, last_release),
           pinned: !version_used.nil?,
-          ruby_range: ruby_range,
+          ruby_range: ruby_range
         )
       end
     end
@@ -297,7 +303,7 @@ module StillActive
         repository_url: repo_info[:url],
         last_commit_date: signals[:last_commit_date],
         archived: signals[:archived],
-        **deps_dev,
+        **deps_dev
       })
     end
 
@@ -311,7 +317,7 @@ module StillActive
 
       leads = AlternativesHelper.leads_for(gem_name: gem_name, index: catalog)
       result_object[gem_name][:alternatives] = leads unless leads.empty?
-    rescue StandardError
+    rescue
       nil # cosmetic best-effort: lead-fetching must never break the core audit
     end
 
@@ -373,18 +379,19 @@ module StillActive
       # drop the advisory and read a known-vulnerable gem as clean, so an
       # un-enriched key still contributes a minimal advisory (mirrors EcosystemLens;
       # ruby-advisory-db then fills the score on merge when it also carries it).
-      deps_dev_vulns = advisory_keys.map { |id| DepsDevClient.advisory_detail(advisory_id: id) || { id: id, source: "deps.dev" } }
+      deps_dev_vulns = advisory_keys.map { |id| DepsDevClient.advisory_detail(advisory_id: id) || {id: id, source: "deps.dev"} }
       radb_vulns = RubyAdvisoryDb.advisories_for(database: advisory_db, gem_name: gem_name, version: version)
       vulnerabilities = VulnerabilityHelper.merge_advisories(deps_dev: deps_dev_vulns, ruby_advisory_db: radb_vulns)
       # Enrich with OSV: a real GHSA severity label (deps.dev can't score a CVSS-4-only
       # advisory) and the fixed-version ranges the "capped below the fix" signal needs.
-      # Native path is rubygems.
-      OsvClient.enrich(vulnerabilities, ecosystem: :rubygems, name: gem_name)
+      # Native path is rubygems. The version also lets OSV confirm a deps.dev-only
+      # advisory applies to it; a ruby-advisory-db verdict is never overruled.
+      vulnerabilities = OsvClient.enrich(vulnerabilities, ecosystem: :rubygems, name: gem_name, version: version)
       {
         scorecard_score: scorecard&.dig(:score),
         scorecard_maintained: scorecard&.dig(:maintained),
         vulnerability_count: vulnerabilities.length,
-        vulnerabilities: vulnerabilities,
+        vulnerabilities: vulnerabilities
       }
     end
 
@@ -394,8 +401,7 @@ module StillActive
       elsif ArtifactoryClient.artifactory_uri?(source_uri)
         ArtifactoryClient.versions(gem_name: gem_name, source_uri: source_uri)
       elsif unqueryable_private_source?(source_uri)
-        warn_unqueryable_private_source(gem_name: gem_name, source_uri: source_uri)
-        []
+        private_source_versions(gem_name: gem_name, source_uri: source_uri)
       else
         Gems.versions(gem_name)
       end
@@ -409,7 +415,7 @@ module StillActive
     # best-effort feature must not be able to degrade an unrelated gem's core data:
     # degrade to "no versions known" here, exactly like Gems::NotFound.
     rescue Gems::GemError, *HttpHelper::TRANSPORT_ERRORS => e
-      $stderr.puts("warning: rubygems.org versions lookup failed for #{gem_name}: #{e.class} (#{e.message})")
+      warn("warning: rubygems.org versions lookup failed for #{gem_name}: #{e.class} (#{e.message})")
       []
     end
 
@@ -437,11 +443,32 @@ module StillActive
       false
     end
 
+    # Any Bundler-compatible private host (Contribsys, Gemstash, Gemfury, a private
+    # mirror) serves the RubyGems compact index, since that is how `bundle install`
+    # resolves from it. So try that agnostic rail before declaring the source
+    # unqueryable: it covers the whole class with no per-host client, and falls
+    # through to the same warning when a host does not serve it. Auth is Bundler's
+    # own host-keyed credential only; still_active's ambient --artifactory-token is
+    # never sent to a lockfile-derived host this way (that stays ArtifactoryClient's,
+    # behind its host allowlist). The repo-signal path is untouched, so #43 still
+    # blocks a public name-collision's repo data from standing in for the private gem.
+    def private_source_versions(gem_name:, source_uri:)
+      versions = CompactIndexClient.versions(
+        gem_name: gem_name,
+        source_uri: source_uri,
+        headers: SourceCredentials.headers_for(source_uri)
+      )
+      return versions unless versions.empty?
+
+      warn_unqueryable_private_source(gem_name: gem_name, source_uri: source_uri)
+      []
+    end
+
     def warn_unqueryable_private_source(gem_name:, source_uri:)
       host = URI(source_uri).host
-      $stderr.puts(
+      warn(
         "warning: #{gem_name} resolves from a private source (#{host}) still_active cannot query; " \
-          "reporting no version/latest/libyear data for it rather than substituting public rubygems.org data",
+          "reporting no version/latest/libyear data for it rather than substituting public rubygems.org data"
       )
     end
 
@@ -450,7 +477,7 @@ module StillActive
       namespace_path = base.path
       path = "#{namespace_path}/api/v1/gems/#{CGI.escape(gem_name)}/versions.json"
       token = StillActive.config.github_oauth_token
-      headers = token ? { "Authorization" => "Bearer #{token}" } : {}
+      headers = token ? {"Authorization" => "Bearer #{token}"} : {}
       HttpHelper.get_json(base, path, headers: headers) || []
     end
 
@@ -471,7 +498,7 @@ module StillActive
     # deps.dev scorecards index github.com and gitlab.com only. A Forgejo/Codeberg
     # repo has no deps.dev project, so leave its project_id nil rather than minting
     # a bogus github.com/owner/name that would fetch the wrong (or no) scorecard.
-    DEPS_DEV_HOST_BY_SOURCE = { github: "github.com", gitlab: "gitlab.com" }.freeze
+    DEPS_DEV_HOST_BY_SOURCE = {github: "github.com", gitlab: "gitlab.com"}.freeze
 
     def deps_dev_project_id(repo)
       host = DEPS_DEV_HOST_BY_SOURCE[repo[:source]]
@@ -505,7 +532,7 @@ module StillActive
 
       [
         info.metadata&.dig("source_code_uri"),
-        info.homepage,
+        info.homepage
       ].compact.uniq
     end
 
@@ -521,7 +548,7 @@ module StillActive
 
       [
         info["homepage_uri"],
-        info["source_code_uri"],
+        info["source_code_uri"]
       ].compact.uniq
     rescue Gems::NotFound
       []

data/still_active.gemspec

@@ -3,14 +3,14 @@
 require_relative "lib/still_active/version"
 
 Gem::Specification.new do |spec|
-  spec.name          = "still_active"
-  spec.version       = StillActive::VERSION
-  spec.authors       = ["Sean Floyd"]
-  spec.email         = ["contact@seanfloyd.dev"]
+  spec.name = "still_active"
+  spec.version = StillActive::VERSION
+  spec.authors = ["Sean Floyd"]
+  spec.email = ["contact@seanfloyd.dev"]
 
-  spec.summary       = "Audit your dependencies for maintenance health, abandonment, and below-the-fix vulnerabilities. " \
+  spec.summary = "Audit your dependencies for maintenance health, abandonment, and below-the-fix vulnerabilities. " \
     "Ruby gems natively; npm, PyPI, Cargo, Go, Maven, and NuGet via a CycloneDX SBOM."
-  spec.description   = "Analyses your Gemfile.lock for dependency health across the full transitive graph: " \
+  spec.description = "Analyses your Gemfile.lock for dependency health across the full transitive graph: " \
     "whether each gem is actively maintained (last activity on GitHub, GitLab, or Codeberg/Forgejo, plus " \
     "release recency), outdated versions, archived repos, OpenSSF Scorecard scores, known vulnerabilities " \
     "(deps.dev and OSV, merged with ruby-advisory-db, flagging advisories with no fix and pins that sit below " \
@@ -24,9 +24,14 @@ Gem::Specification.new do |spec|
     "with granular, committed suppression via .still_active.yml. " \
     "Complements bundle outdated, bundler-audit, and libyear-bundler by adding the maintenance signal they " \
     "don't, and folds their version, CVE, and libyear checks into one report."
-  spec.homepage      = "https://github.com/SeanLF/still_active"
-  spec.license       = "MIT"
+  spec.homepage = "https://github.com/SeanLF/still_active"
+  spec.license = "MIT"
   spec.required_ruby_version = ">= 3.3.0"
+  # Gem::Resolver::APISet::GemParser, which parses the RubyGems compact index for
+  # the Artifactory client, first shipped in RubyGems 3.2.3. Ruby 3.3.0 bundles
+  # 3.5.3, so this is documentation of the real dependency rather than a bound
+  # anyone can trip.
+  spec.required_rubygems_version = ">= 3.2.3"
 
   spec.metadata["homepage_uri"] = spec.homepage
   spec.metadata["source_code_uri"] = spec.homepage
@@ -36,23 +41,14 @@ Gem::Specification.new do |spec|
   spec.metadata["rubygems_mfa_required"] = "true"
 
   spec.files = Dir.chdir(File.expand_path(__dir__)) do
-    %x(git ls-files -z).split("\x0").select do |f|
+    `git ls-files -z`.split("\x0").select do |f|
       f.start_with?("lib/", "bin/still_active") || f.match?(/\A(LICENSE|README|CHANGELOG|still_active\.gemspec)\b/)
     end
   end
-  spec.bindir        = "bin"
-  spec.executables   = spec.files.grep(%r{\Abin/still_active}) { |f| File.basename(f) }
+  spec.bindir = "bin"
+  spec.executables = spec.files.grep(%r{\Abin/still_active}) { |f| File.basename(f) }
   spec.require_paths = ["lib"]
 
-  spec.add_development_dependency("bundler-audit")
-  spec.add_development_dependency("debug")
-  spec.add_development_dependency("faker")
-  spec.add_development_dependency("json_schemer")
-  spec.add_development_dependency("rubocop")
-  spec.add_development_dependency("rubocop-performance")
-  spec.add_development_dependency("rubocop-rspec")
-  spec.add_development_dependency("rubocop-shopify")
-
   # 2.0/2.1 ship a scheduler that breaks our fan-out (io_read); 2.2 is the
   # verified floor (checked against Ruby 3.3 in Docker). octokit/faraday-retry/
   # gems work down to ancient versions, so they stay unpinned rather than