still_active 3.0.0.rc5 → 3.0.0

data/lib/still_active/osv_client.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
-require_relative "../helpers/http_helper"
-require_relative "../helpers/cvss_helper"
+require_relative "helpers/http_helper"
+require_relative "helpers/cvss_helper"
 
 module StillActive
   # OSV (api.osv.dev) enrichment for advisories deps.dev has already discovered.
@@ -15,8 +15,13 @@ module StillActive
   # poison cap's ceiling.
   #
   # Enrichment is best-effort: any failure (missing record, transport error, odd
-  # shape) leaves the advisory exactly as deps.dev produced it. It must never drop
-  # an advisory the audit already found, so it only ever ADDS fields.
+  # shape) leaves the advisory exactly as deps.dev produced it.
+  #
+  # OSV is also the ARBITER of whether a deps.dev-discovered advisory really applies
+  # to the audited version (see reject_unaffected), which is the one place this module
+  # removes rather than adds. That direction is the dangerous one -- a wrongly dropped
+  # advisory reads a vulnerable dependency as clean -- so every degrade path here must
+  # resolve to "keep", and only an unambiguous OSV contradiction may drop.
   module OsvClient
     extend self
 
@@ -45,25 +50,24 @@ module StillActive
     TYPE_VERSIONS = {"CVSS_V4" => "4.0", "CVSS_V3" => "3.1", "CVSS_V2" => "2.0"}.freeze
 
     # Enrich each advisory in place with the OSV severity label and the fixed
-    # versions for the audited package. A missing/failed lookup is a no-op on that
-    # advisory (it keeps whatever deps.dev gave it), never a raise.
-    def enrich(advisories, ecosystem:, name:)
-      advisories.each do |advisory|
-        record = detail(advisory_id: advisory[:id])
-        next if record.nil?
-
-        advisory[:osv_severity] = record[:severity_label]
-        advisory[:osv_cvss_score] = record[:cvss_score]
-        advisory[:cvss_version] = record[:cvss_version]
-        advisory[:cvss_vector] = record[:cvss_vector]
-        advisory[:fixed_versions] = fixed_versions(record, ecosystem: ecosystem, name: name)
-      rescue => e
-        # Enrichment is additive and best-effort. An unexpected OSV shape must never
-        # raise out through the workflow's per-gem rescue, which would DROP the whole
-        # gem and read a known-vulnerable dependency as clean. Leave the advisory
-        # exactly as deps.dev produced it.
-        warn("warning: OSV enrichment for #{advisory[:id]} failed: #{e.class} (#{e.message}); leaving advisory unchanged")
+    # versions for the audited package, and return the advisories that survive
+    # version confirmation (see reject_unaffected). A missing/failed lookup is a
+    # no-op on that advisory (it keeps whatever deps.dev gave it), never a raise.
+    def enrich(advisories, ecosystem:, name:, version: nil)
+      # Each eligible advisory is paired with OSV's own identifiers for it, which the
+      # confirmation match needs alongside deps.dev's (see detail).
+      backed = advisories.filter_map do |advisory|
+        osv_ids = apply_record(advisory, ecosystem: ecosystem, name: name)
+        [advisory, osv_ids] if osv_ids
       end
+      reject_unaffected(advisories, backed, ecosystem: ecosystem, name: name, version: version)
+    rescue => e
+      # The confirmation pass runs outside apply_record's per-advisory rescue, and an
+      # escape from here would hit the workflow's per-gem rescue and strip the gem of
+      # ALL its signals -- reading a known-vulnerable dependency as clean, the very
+      # thing this module exists to prevent. Keep every advisory instead.
+      warn("warning: OSV version confirmation for #{name} failed: #{e.class} (#{e.message}); keeping every advisory")
+      advisories
     end
 
     # Fetch and parse one OSV record by advisory id (GHSA/CVE). Returns
@@ -79,6 +83,11 @@ module StillActive
 
       cvss = best_cvss(body)
       {
+        # OSV's own identity for the advisory, unioned into the match against a query
+        # result. Asking for a CVE returns the GHSA record (OSV resolves aliases), so
+        # deps.dev's id alone can miss the id the query answers with, and reading a
+        # listed advisory as absent would drop a real finding.
+        identifiers: [body["id"], *Array(body["aliases"])].grep(String),
         severity_label: body.dig("database_specific", "severity"),
         cvss_score: cvss[:score],
         cvss_version: cvss[:version],
@@ -89,6 +98,158 @@ module StillActive
 
     private
 
+    # Applies one OSV record to one advisory, in place. Returns OSV's identifiers for
+    # the advisory when it is eligible for the version confirmation below (only OSV
+    # data may overrule OSV-derived data), or nil when it is not and must be kept
+    # whatever the query says.
+    def apply_record(advisory, ecosystem:, name:)
+      record = detail(advisory_id: advisory[:id])
+      return if record.nil?
+
+      advisory[:osv_severity] = record[:severity_label]
+      advisory[:osv_cvss_score] = record[:cvss_score]
+      advisory[:cvss_version] = record[:cvss_version]
+      advisory[:cvss_vector] = record[:cvss_vector]
+      advisory[:fixed_versions] = fixed_versions(record, ecosystem: ecosystem, name: name)
+      record[:identifiers] if names_package?(record, ecosystem: ecosystem, name: name)
+    rescue => e
+      # Enrichment is additive and best-effort. An unexpected OSV shape must never
+      # raise out through the workflow's per-gem rescue, which would DROP the whole
+      # gem and read a known-vulnerable dependency as clean. Leave the advisory
+      # exactly as deps.dev produced it, and hold it (nil) rather than risk
+      # dropping it on a record we couldn't read.
+      warn("warning: OSV enrichment for #{advisory[:id]} failed: #{e.class} (#{e.message}); leaving advisory unchanged")
+      nil
+    end
+
+    # Drops the advisories that OSV's own version matching says don't apply to the
+    # audited version. deps.dev is the discovery source, but it MIRRORS OSV/GHSA data
+    # with an ingestion lag, and advisories get AMENDED after publication: the usual
+    # shape is a CVE published with a fix on the current release line, then backports
+    # to the older supported lines, then an amendment adding those branch ranges. Until
+    # deps.dev re-ingests, it keeps serving the pre-amendment record, whose broader
+    # range still covers versions the amendment has since marked patched.
+    #
+    # Receipt (2026-07-31): GHSA-mh99-v99m-4gvg was published 07-24 with a single
+    # range, introduced 0 / fixed 5.0.8. Backports 3.0.3, 2.1.3 and 1.1.17 shipped
+    # 07-27 to 07-29, and the advisory was amended 07-31 19:39Z to carry all four
+    # branches. Hours later deps.dev still answered from the 07-24 record, reporting
+    # the patched 1.1.17/1.1.18/2.1.3/2.1.4/3.0.3 as vulnerable.
+    #
+    # This is lag, NOT a parsing defect: 341 multi-branch advisories across
+    # npm/rubygems/pypi/cargo were compared against OSV over 589 version checks, and
+    # every one agreed. So the correction has to be a live re-check, not a local range
+    # fix. We
+    # ask OSV's /v1/query, deps.dev's own upstream, which applies the declared ranges
+    # under each ecosystem's semantics and reflects an amendment immediately. It also
+    # saves reimplementing cross-ecosystem version ordering.
+    #
+    # The window reopens with every backported fix, so this is structural, not a
+    # one-off worth waiting out.
+    #
+    # Removing a finding is the one direction this tool must never get wrong, so a drop
+    # needs positive contradiction on every count: the advisory came from deps.dev ALONE
+    # (ruby-advisory-db does its own version matching and is the Ruby authority, so its
+    # verdict stands), OSV served a record for it that names this package under this
+    # ecosystem and spelling, and the query for this exact version succeeded without
+    # listing it. Anything unknown -- no version, unmapped ecosystem, failed query --
+    # keeps the advisory.
+    def reject_unaffected(advisories, backed, ecosystem:, name:, version:)
+      candidates = backed.select { |advisory, _osv_ids| advisory[:source] == "deps.dev" }
+      return advisories if candidates.empty? || version.to_s.empty?
+
+      affected = affected_identifiers(ecosystem: ecosystem, name: name, version: version)
+      return advisories if affected.nil?
+
+      unaffected = candidates
+        .reject { |advisory, osv_ids| (identifiers(advisory) | osv_ids).intersect?(affected) }
+        .map(&:first)
+      # Say so when a finding is removed. This is the only path that can turn a red run
+      # green, and a silent drop leaves no way to tell "OSV cleared it" from "the audit
+      # missed it". Matches the per-gem stderr notes the severity gates already emit.
+      unaffected.each { |advisory| warn("still_active: #{name}@#{version} is not affected by #{advisory[:id]} per OSV; deps.dev listed it, dropping") }
+      advisories - unaffected
+    end
+
+    # Every advisory identifier OSV reports as affecting this exact package version,
+    # or nil when the question can't be asked or answered (unmapped ecosystem, failed
+    # request, unusable body). An EMPTY array is a real answer -- "nothing affects this
+    # version" -- and must stay distinct from the nil, which means "we don't know".
+    #
+    # That distinction is the whole safety of the drop, so an empty array is only ever
+    # returned for a body that positively IS an empty OSV result. OSV's genuine all-clear
+    # is a bare `{}` (verified live, and identical to what an unknown package name
+    # returns), which gives a malformed or truncated body no distinguishing marker of
+    # its own: read loosely, every unparseable 200 would fabricate an all-clear.
+    def affected_identifiers(ecosystem:, name:, version:)
+      osv_ecosystem = ECOSYSTEM_NAMES[ecosystem || :rubygems]
+      return if osv_ecosystem.nil?
+
+      query = {version: version, package: {name: name, ecosystem: osv_ecosystem}}
+      body = HttpHelper.post_json(BASE_URI, "/v1/query", body: JSON.generate(query))
+      return unless body.is_a?(Hash)
+
+      identifiers_from(body)
+    rescue => e
+      warn("warning: OSV version confirmation for #{name}@#{version} failed: #{e.class} (#{e.message}); keeping every advisory")
+      nil
+    end
+
+    # The identifiers in one /v1/query body, or nil when the body isn't a complete,
+    # readable answer. A truncated answer is not an answer: OSV paginates past 1000
+    # vulnerabilities OR once a query exceeds 20 seconds, and documents that a page can
+    # carry ONLY a next_page_token. That second trigger is latency, not package size, so
+    # it can land on any package on a slow day; reading it as "nothing affects this
+    # version" would drop real findings at random. We decline to filter rather than
+    # walk the pages, since the pass only ever removes false positives.
+    def identifiers_from(body)
+      return if body["next_page_token"] || body["nextPageToken"]
+      # A bare `{}` is OSV's genuine "nothing affects this version" (verified live). It
+      # has to be matched exactly, not as "no vulns key": an error envelope served with a
+      # 200 (`{"code":3,"message":...}`) has no vulns key either, and reading that as an
+      # all-clear would drop every advisory on the package.
+      return [] if body.empty?
+
+      vulns = body["vulns"]
+      return unless vulns.is_a?(Array)
+      # EVERY entry has to be readable, not just one of them. Skipping the unreadable
+      # ones would silently shorten the list, and a short list is indistinguishable from
+      # OSV not listing that advisory at all: the one it named but we couldn't parse
+      # would be dropped as unaffected. `all?` holds on an empty array, so OSV's other
+      # genuine all-clear shape, `{"vulns": []}`, still answers.
+      return unless vulns.all? { |vuln| vuln.is_a?(Hash) && vuln["id"].is_a?(String) }
+
+      vulns.flat_map { |vuln| [vuln["id"], *vuln["aliases"]] }.grep(String)
+    end
+
+    # An advisory's own id plus its aliases, mirroring VulnerabilityHelper's merge
+    # identity: OSV keys a record by GHSA while deps.dev may hand us the CVE (or the
+    # reverse), so matching on the primary id alone would read a listed advisory as
+    # absent and drop a real finding.
+    def identifiers(advisory)
+      [advisory[:id], *advisory[:aliases]].compact.map(&:to_s)
+    end
+
+    # Does this record carry version data for the audited package, under the exact
+    # ecosystem and spelling we're querying with? Both halves guard a fabricated
+    # all-clear, because OSV answers an unknown package and a patched version with the
+    # same bare `{}`:
+    #
+    # NAME -- registry name normalization differs by ecosystem (PyPI folds case and
+    # -/_/.), so a spelling mismatch would turn a missed lookup into "not affected".
+    # Exact equality is stricter than OSV's own matching, which costs us the fix on a
+    # case-divergent name; that's the safe direction to be wrong in.
+    #
+    # VERSIONED -- an affected entry with no ranges and no version list (or one whose
+    # window lives somewhere /v1/query can't match on, like a GIT range) is OSV having
+    # no opinion on versions at all. The query can then never return that record for
+    # ANY version, so treating its silence as contradiction would drop the advisory
+    # permanently, for every user, while deps.dev still asserts the version is affected.
+    def names_package?(record, ecosystem:, name:)
+      osv_ecosystem = ECOSYSTEM_NAMES[ecosystem || :rubygems]
+      record[:affected].any? { |a| a[:name] == name && a[:ecosystem] == osv_ecosystem && a[:versioned] }
+    end
+
     # The highest-version CVSS vector the record carries, as { score:, version:,
     # vector: } (a computed base score, the "3.1"/"4.0" version, and the raw string),
     # or all-nil. deps.dev has no v4 score, so this is what gives a CVSS-4-only
@@ -132,12 +293,21 @@ module StillActive
       package = entry["package"]
       return unless package.is_a?(Hash) && package["name"]
 
-      fixed = Array(entry["ranges"]).flat_map do |range|
-        next [] unless range.is_a?(Hash)
+      ranges = Array(entry["ranges"]).select { |range| range.is_a?(Hash) }
+      fixed = ranges.flat_map { |range| Array(range["events"]).filter_map { |event| event["fixed"] if event.is_a?(Hash) } }
+      {ecosystem: package["ecosystem"], name: package["name"], fixed: fixed, versioned: version_matchable?(entry, ranges)}
+    end
 
-        Array(range["events"]).filter_map { |event| event["fixed"] if event.is_a?(Hash) }
-      end
-      {ecosystem: package["ecosystem"], name: package["name"], fixed: fixed}
+    # Range types /v1/query can resolve a VERSION against. A GIT range is commit-graph
+    # data a version query never matches, so a record carrying only those has no version
+    # opinion to contradict deps.dev with. A range missing its type reads the same way.
+    VERSION_RANGE_TYPES = ["SEMVER", "ECOSYSTEM"].freeze
+
+    # Does this affected entry hold data a version query could match on -- an explicit
+    # version list, or a version-ordered range? See names_package? for why the absence
+    # of it has to block a drop rather than permit one.
+    def version_matchable?(entry, ranges)
+      !Array(entry["versions"]).empty? || ranges.any? { |range| VERSION_RANGE_TYPES.include?(range["type"]) }
     end
 
     def encode(value)

data/lib/still_active/poison_security_correlator.rb

@@ -1,8 +1,8 @@
 # frozen_string_literal: true
 
-require_relative "../helpers/vulnerability_helper"
-require_relative "../helpers/constraint_helper"
-require_relative "../helpers/semver_satisfaction"
+require_relative "helpers/vulnerability_helper"
+require_relative "helpers/constraint_helper"
+require_relative "helpers/semver_satisfaction"
 
 module StillActive
   # Whole-tree correlation, run once after the fan-out: a poison cap is far more

data/lib/still_active/pypi_client.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require_relative "../helpers/http_helper"
+require_relative "helpers/http_helper"
 require_relative "version"
 
 module StillActive

data/lib/still_active/sarif/rules.rb

@@ -168,6 +168,21 @@ module StillActive
           level: "note",
           security_severity: nil, # maintenance/compatibility, not a CVE (as SA002/SA004/SA005/SA008)
           tags: ["maintenance", "runtime", "external/cwe/cwe-1104"]
+        },
+        {
+          id: "SA010",
+          name: "DeprecatedPackage",
+          short: "Gem is deprecated by its maintainer",
+          full: "The maintainer has marked this gem deprecated in its registry. Unlike every other maintenance signal here, this is not inferred from dates or repository state: the person who publishes it has said to stop using it, and the deprecation message often names the replacement. A deprecated package can still look healthy by release recency, so this fires independently of the activity signals.",
+          help_text: "Read the deprecation message, which usually names the successor, and migrate to it. There will be no further fixes, including security patches.",
+          level: "error",
+          security_severity: "7.5",
+          tags: ["security", "supply-chain", "maintenance", "external/cwe/cwe-1104"],
+          neutral: {
+            short: "Package is deprecated by its maintainer",
+            full: "The maintainer has marked this package deprecated in its registry. Unlike every other maintenance signal here, this is not inferred from dates or repository state: the person who publishes it has said to stop using it, and the deprecation message often names the replacement. A deprecated package can still look healthy by release recency, so this fires independently of the activity signals.",
+            help_text: "Read the deprecation message, which usually names the successor, and migrate to it. There will be no further fixes, including security patches."
+          }
         }
       ].freeze
 

data/lib/still_active/sbom_reader.rb

@@ -4,6 +4,8 @@ require "json"
 require "uri"
 require "package_url"
 
+require_relative "helpers/sbom_graph"
+
 module StillActive
   # Reads a CycloneDX SBOM (e.g. produced by Syft) into a clean, normalized
   # dependency set -- the breadth input for non-Ruby ecosystems, where the
@@ -63,12 +65,19 @@ module StillActive
 
       deps = []
       unassessable = []
+      entries_by_ref = {}
       components.each do |component|
         kind, entry = classify(component)
         entry[:production] = !dev_signal?(component) if kind == :dependency && marks_dev
-        deps << entry if kind == :dependency
+        if kind == :dependency
+          ref = component["bom-ref"]
+          entries_by_ref[ref] = entry if ref.is_a?(String)
+          deps << entry
+        end
         unassessable << entry if kind == :unassessable
       end
+      drop_project_components(doc, deps, entries_by_ref)
+      attach_dependency_graph(doc, deps, entries_by_ref)
       # uniq collapses a package that a generator lists more than once (e.g. Syft's
       # per-location entries); `production` is derived from each component's own
       # signal, so duplicates of the same name+version dedup cleanly unless a
@@ -80,6 +89,92 @@ module StillActive
 
     private
 
+    # A Syft SBOM lists the scanned project as an ordinary library component with a
+    # purl, so it was classified as one of its own dependencies and assessed: no
+    # registry entry, therefore no releases, therefore reported as critically stale.
+    # That is a confident false verdict about the user's own code, on the workflow
+    # the README recommends, and it trips --fail-if-critical.
+    #
+    # The project is dropped rather than surfaced as unassessable: it is not a
+    # dependency we failed to assess, it is not a dependency, which is the same
+    # treatment CI actions and opaque binaries already get. Nothing changes for an
+    # SBOM with no dependency graph, and the rule needs the project to actually
+    # depend on something, so a dependency with a missing parent edge is never
+    # dropped for looking parentless.
+    def drop_project_components(doc, deps, entries_by_ref)
+      return if entries_by_ref.empty?
+
+      roots = SbomGraph.project_refs(dependencies: doc["dependencies"], library_refs: entries_by_ref.keys.to_set)
+      return if roots.empty?
+
+      # Compared by identity, not value: two components can classify to equal
+      # hashes, and only the one the graph named as a root should be dropped.
+      dropped = roots.filter_map { |ref| entries_by_ref.delete(ref)&.object_id }.to_set
+      deps.reject! { |entry| dropped.include?(entry.object_id) }
+    end
+
+    # Place each package in the CycloneDX dependency graph, so a cross-ecosystem
+    # audit can say which packages you actually declared and, for the rest, the
+    # declared package that pulls each one in. Same contract as the native path:
+    # `direct` is a boolean, and `dependency_path` is present only for a transitive
+    # package, head-first so it names the dependency a maintainer can act on.
+    #
+    # Both fields are attached ONLY to packages the graph actually places. A
+    # generator can emit a near-empty graph (a Syft directory scan of a Ruby project
+    # produced one edge across 789 components), and stamping `direct: false` on
+    # everything it failed to mention would be the positive claim "none of these are
+    # yours" about a document that never said. Absent means unknown, which the
+    # renderers already treat correctly: they test `direct == false`, not falsiness.
+    def attach_dependency_graph(doc, deps, entries_by_ref)
+      return if entries_by_ref.empty?
+
+      placements = SbomGraph.resolve(
+        dependencies: doc["dependencies"],
+        root_ref: doc.dig("metadata", "component", "bom-ref"),
+        library_refs: entries_by_ref.keys.to_set
+      )
+      return if placements.nil?
+
+      identities = entries_by_ref.transform_values { |entry| "#{entry[:ecosystem]}/#{entry[:name]}" }
+      # Fold per package identity first. A generator may list one package under
+      # several bom-refs (Syft emits a component per location), and those copies are
+      # collapsed by `uniq` below; if they carried different placements they would
+      # stop being equal and the package would appear twice in the audit.
+      best = {}
+      entries_by_ref.each do |ref, entry|
+        placement = placements[ref]
+        next if placement.nil?
+
+        key = identity_key(entry)
+        best[key] = better_placement(best[key], placement)
+      end
+
+      deps.each do |entry|
+        placement = best[identity_key(entry)]
+        next if placement.nil?
+
+        entry[:direct] = placement[:direct]
+        next if placement[:direct]
+
+        path = Array(placement[:path]).filter_map { |ref| identities[ref] }
+        entry[:dependency_path] = path unless path.empty?
+      end
+    end
+
+    def identity_key(entry)
+      [entry[:ecosystem], entry[:name], entry[:version]]
+    end
+
+    # Declared beats pulled-in (you can act on it directly), and among transitive
+    # placements the shorter path wins, matching the native path's shortest-path BFS.
+    def better_placement(current, candidate)
+      return candidate if current.nil?
+      return current if current[:direct]
+      return candidate if candidate[:direct]
+
+      (Array(candidate[:path]).length < Array(current[:path]).length) ? candidate : current
+    end
+
     # Whether a component is marked dev/test-only. CycloneDX `scope` (excluded =
     # not part of the product, optional = not needed at runtime) is the standard;
     # tools that don't set scope may instead emit a property (cyclonedx-npm's
@@ -146,7 +241,12 @@ module StillActive
           return [:unassessable, {ecosystem: ecosystem, name: full_name, version: parsed.version, reason: :private_registry, repository_url: repository_url}]
         end
 
-        [:dependency, {ecosystem: ecosystem, name: full_name, version: parsed.version}]
+        # The input's own PURL, kept verbatim rather than parsed-and-rebuilt. An
+        # enriched SBOM re-emits it unchanged, so whatever a consumer matched on
+        # the input it matches on our output, and no per-ecosystem PURL
+        # reconstruction (npm scopes, maven group:artifact, go module paths) can
+        # get it subtly wrong.
+        [:dependency, {ecosystem: ecosystem, name: full_name, version: parsed.version, purl: preserved_purl(purl)}]
       elsif NOISE_TYPES.include?(type)
         nil # CI actions / opaque binaries: not a package dependency
       else
@@ -161,6 +261,21 @@ module StillActive
       [:unassessable, {ecosystem: nil, name: name, reason: :malformed_purl}]
     end
 
+    # The input's PURL, kept for re-emission in an enriched SBOM, with Syft's
+    # `package-id` qualifier removed. That qualifier is Syft's internal per-location
+    # bookkeeping rather than part of the package's identity, and it is why the same
+    # package can appear twice under two different PURLs; dropping it is what lets
+    # those copies still collapse. Everything else is left byte-identical rather than
+    # re-serialized through PackageURL, so a consumer that matched the input PURL
+    # matches ours, with no chance of a normalization changing the encoding.
+    def preserved_purl(purl)
+      base, separator, query = purl.partition("?")
+      return purl if separator.empty?
+
+      kept = query.split("&").reject { |pair| pair.start_with?("package-id=") }
+      kept.empty? ? base : "#{base}?#{kept.join("&")}"
+    end
+
     # Whether a repository_url points at a known public registry. We only read the
     # host; we never connect to it (a lockfile/SBOM-derived URL is untrusted). An
     # unparseable or non-public host reads as private, failing safe.

data/lib/still_active/sbom_workflow.rb

@@ -3,8 +3,8 @@
 require_relative "ecosystem_lens"
 require_relative "ceiling_reconciler"
 require_relative "poison_security_correlator"
-require_relative "../helpers/python_helper"
-require_relative "../helpers/dotnet_helper"
+require_relative "helpers/python_helper"
+require_relative "helpers/dotnet_helper"
 require "async"
 require "async/barrier"
 require "async/semaphore"
@@ -62,7 +62,7 @@ module StillActive
             # otherwise): absent stays "unknown", never a false that reads as test-only.
             result["#{dep[:ecosystem]}/#{dep[:name]}@#{dep[:version]}"] =
               EcosystemLens.assess(ecosystem: dep[:ecosystem], name: dep[:name], version: dep[:version], constraint_cache: constraint_cache, runtime_ranges: runtime_ranges)
-                .merge(dep.slice(:production))
+                .merge(dep.slice(:production, :direct, :dependency_path, :purl))
           rescue => e
             # One dependency's failure must not abort the audit, but it must not
             # disappear either: record it as an unassessable entry (same shape as
@@ -70,7 +70,7 @@ module StillActive
             # production rides along (when known, via slice) so a failed prod dep
             # stays distinguishable from a failed dev one.
             failures << {ecosystem: dep[:ecosystem], name: dep[:name], version: dep[:version], reason: :assessment_error, error: "#{e.class}: #{e.message}"}
-              .merge(dep.slice(:production))
+              .merge(dep.slice(:production, :direct, :dependency_path, :purl))
             warn("error assessing #{dep[:ecosystem]}/#{dep[:name]}@#{dep[:version]}: #{e.class}\n\t#{e.message}")
           ensure
             completed += 1

data/lib/still_active/suppressions.rb

@@ -16,7 +16,7 @@ module StillActive
   # name an explicit advisory id, so a newly disclosed CVE on the same gem is
   # never pre-silenced.
   class Suppressions
-    GATEABLE_SIGNALS = [:activity, :vulnerability, :libyear, :poison, :language_ceiling].freeze
+    GATEABLE_SIGNALS = [:activity, :vulnerability, :libyear, :poison, :language_ceiling, :deprecated].freeze
 
     Entry = Struct.new(:gem, :advisory, :signal, :reason, :expires, keyword_init: true) do
       def whole_gem?
@@ -76,14 +76,16 @@ module StillActive
           return false
         end
         if signal && !GATEABLE_SIGNALS.include?(signal)
-          warnings << "ignoring suppression for #{label}: unknown signal #{signal.inspect} (expected activity, vulnerability, libyear, or poison)"
+          # Listed from the constant rather than spelled out: the hand-written
+          # version had already drifted (it never mentioned language_ceiling).
+          warnings << "ignoring suppression for #{label}: unknown signal #{signal.inspect} (expected #{GATEABLE_SIGNALS.join(", ")})"
           return false
         end
         if signal == :vulnerability && advisory.nil?
           warnings << "ignoring vulnerability suppression for #{label}: must name an advisory id so newly disclosed advisories still surface"
           return false
         end
-        if [:activity, :libyear, :poison].include?(signal) && gem.nil?
+        if [:activity, :libyear, :poison, :deprecated].include?(signal) && gem.nil?
           warnings << "ignoring #{signal} suppression: must name a gem"
           return false
         end

data/lib/still_active/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module StillActive
-  VERSION = "3.0.0.rc5"
+  VERSION = "3.0.0"
 end

data/lib/still_active/workflow.rb

@@ -12,17 +12,17 @@ require_relative "forgejo_client"
 require_relative "github_client"
 require_relative "gitlab_client"
 require_relative "repository"
-require_relative "../helpers/activity_helper"
-require_relative "../helpers/alternatives_helper"
-require_relative "../helpers/catalog_index"
-require_relative "../helpers/constraint_helper"
-require_relative "../helpers/http_helper"
-require_relative "../helpers/libyear_helper"
-require_relative "../helpers/ruby_advisory_db"
-require_relative "../helpers/ruby_helper"
-require_relative "../helpers/runtime_ceiling_helper"
-require_relative "../helpers/version_helper"
-require_relative "../helpers/vulnerability_helper"
+require_relative "helpers/activity_helper"
+require_relative "helpers/alternatives_helper"
+require_relative "helpers/catalog_index"
+require_relative "helpers/constraint_helper"
+require_relative "helpers/http_helper"
+require_relative "helpers/libyear_helper"
+require_relative "helpers/ruby_advisory_db"
+require_relative "helpers/ruby_helper"
+require_relative "helpers/runtime_ceiling_helper"
+require_relative "helpers/version_helper"
+require_relative "helpers/vulnerability_helper"
 require "async"
 require "async/barrier"
 require "async/semaphore"
@@ -384,11 +384,18 @@ module StillActive
       vulnerabilities = VulnerabilityHelper.merge_advisories(deps_dev: deps_dev_vulns, ruby_advisory_db: radb_vulns)
       # Enrich with OSV: a real GHSA severity label (deps.dev can't score a CVSS-4-only
       # advisory) and the fixed-version ranges the "capped below the fix" signal needs.
-      # Native path is rubygems.
-      OsvClient.enrich(vulnerabilities, ecosystem: :rubygems, name: gem_name)
+      # Native path is rubygems. The version also lets OSV confirm a deps.dev-only
+      # advisory applies to it; a ruby-advisory-db verdict is never overruled.
+      vulnerabilities = OsvClient.enrich(vulnerabilities, ecosystem: :rubygems, name: gem_name, version: version)
       {
         scorecard_score: scorecard&.dig(:score),
         scorecard_maintained: scorecard&.dig(:maintained),
+        # The maintainer's own "stop using this" declaration, from the same
+        # response as the advisories. RubyGems has no deprecation mechanism, so
+        # this is effectively always false for gems today; it is threaded anyway
+        # so the field means the same thing on both paths.
+        deprecated: info&.dig(:deprecated) == true,
+        deprecation_reason: info&.dig(:deprecation_reason),
         vulnerability_count: vulnerabilities.length,
         vulnerabilities: vulnerabilities
       }