still_active 3.0.0.rc6 → 3.1.0

data/lib/still_active/helpers/cvss_helper.rb

@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+require "cvss_suite"
+
+module StillActive
+  # Computes a CVSS base score from a vector string, across v2/v3/v4. deps.dev stores
+  # only CVSS 3.x, so a CVSS-4-only advisory (the flagship protobuf case) arrives with
+  # no numeric score; OSV carries the v4 vector, and this turns it into the number the
+  # SARIF security-severity and CycloneDX rating want.
+  #
+  # Returns the BASE score, not cvss-suite's overall_score: a vector carrying threat or
+  # environmental metrics folds those into overall_score (E:U alone turns a 9.3 into
+  # an 8.1), while NVD and GHSA publish the base score. The severity band still floors
+  # at the authoritative GHSA label (VulnerabilityHelper.advisory_severity) because
+  # labels are assigned by people and can sit off the FIRST band edge; the label drives
+  # gating and SARIF level, the number sharpens display. Fails safe: an absent or
+  # unparseable vector yields nil, never a crash.
+  module CvssHelper
+    extend self
+
+    def score(vector)
+      return if vector.nil? || vector.to_s.empty?
+
+      CvssSuite.parse(vector.to_s).base_score
+    rescue CvssSuite::Error
+      nil
+    end
+  end
+end

data/lib/{helpers → still_active/helpers}/cyclonedx_helper.rb

@@ -3,6 +3,8 @@
 require "json"
 require "digest"
 require "time"
+require_relative "activity_helper"
+require_relative "status_helper"
 require_relative "vulnerability_helper"
 
 module StillActive
@@ -27,7 +29,34 @@ module StillActive
       components = build_components(result, ruby_info)
       vulnerabilities = build_vulnerabilities(result)
 
-      document = {
+      document = envelope(components, spec_version, tool_version, now)
+      document["vulnerabilities"] = vulnerabilities unless vulnerabilities.empty?
+      JSON.pretty_generate(document)
+    end
+
+    # The cross-ecosystem sibling of `render`, for a --sbom audit. The one thing it
+    # must not do is rebuild PURLs: npm scopes, maven group:artifact and Go module
+    # paths are all easy to reconstruct subtly wrong, and the input SBOM already
+    # carries the authoritative one. So each component re-emits the PURL it arrived
+    # with, which means a consumer (Dependency-Track being the point of this) matches
+    # our output exactly as it matched the input, now annotated with the maintenance
+    # signals it had no way to compute.
+    def render_sbom(result:, tool_version:, spec_version: "1.6", now: Time.now.utc)
+      components = result.sort_by { |key, _| key.to_s }.map { |key, data| sbom_component(key.to_s, data) }
+      vulnerabilities = result.sort_by { |key, _| key.to_s }.flat_map do |key, data|
+        ref = sbom_ref(key.to_s, data)
+        (data[:vulnerabilities] || []).map { |advisory| vulnerability(advisory, ref) }
+      end
+
+      document = envelope(components, spec_version, tool_version, now)
+      document["vulnerabilities"] = vulnerabilities unless vulnerabilities.empty?
+      JSON.pretty_generate(document)
+    end
+
+    private
+
+    def envelope(components, spec_version, tool_version, now)
+      {
         "bomFormat" => "CycloneDX",
         "specVersion" => spec_version,
         "serialNumber" => deterministic_serial(components),
@@ -38,11 +67,30 @@ module StillActive
         },
         "components" => components
       }
-      document["vulnerabilities"] = vulnerabilities unless vulnerabilities.empty?
-      JSON.pretty_generate(document)
     end
 
-    private
+    # The input's own PURL identifies the component. It is always present for an
+    # assessed dependency (SbomReader routes a component with no PURL to
+    # `unassessable`, so it never reaches an assessment), but the composite result
+    # key stands in defensively rather than emitting a component with no identity.
+    def sbom_ref(key, data)
+      data[:purl] || key
+    end
+
+    def sbom_component(key, data)
+      ref = sbom_ref(key, data)
+      component = {"type" => "library", "name" => data[:name] || key}
+      component["version"] = data[:version_used] if data[:version_used]
+      component["bom-ref"] = ref
+      component["purl"] = data[:purl] if data[:purl]
+      component["licenses"] = licenses(data[:license]) if data[:license]
+      if data[:repository_url]
+        component["externalReferences"] = [{"type" => "vcs", "url" => data[:repository_url]}]
+      end
+      properties = sbom_properties(data)
+      component["properties"] = properties unless properties.empty?
+      component
+    end
 
     def build_components(result, ruby_info)
       components = result.sort_by { |name, _| name.to_s }.map { |name, data| gem_component(name.to_s, data) }
@@ -89,14 +137,44 @@ module StillActive
       license.split(", ").map { |id| {"license" => {"id" => id}} }
     end
 
-    def gem_properties(data)
+    # Signals both paths compute. `status` is the folded verdict a consumer would
+    # otherwise have to re-derive, which is the whole reason for emitting an
+    # enriched SBOM rather than the input one.
+    def shared_properties(data)
       {
+        "still_active:status" => StatusHelper.gem_status(data).to_s,
+        # The raw activity level alongside the folded verdict. `status` answers
+        # "what should I do about this"; activity_level answers "how dormant is
+        # it", and they deliberately disagree: a deprecated package that still
+        # ships releases is status deprecated but activity ok. A consumer
+        # thresholding on recency wants the second, not the first.
+        "still_active:activity_level" => ActivityHelper.activity_level(data).to_s,
         "still_active:archived" => boolean_property(data[:archived]),
+        "still_active:deprecated" => boolean_property(data[:deprecated]),
+        "still_active:deprecation_reason" => data[:deprecation_reason],
         "still_active:scorecard_score" => data[:scorecard_score]&.to_s,
         "still_active:libyear" => data[:libyear]&.to_s,
-        "still_active:last_commit_date" => iso8601(data[:last_commit_date]),
+        "still_active:last_commit_date" => iso8601(data[:last_commit_date])
+      }
+    end
+
+    def to_properties(hash)
+      hash.filter_map { |name, value| {"name" => name, "value" => value} unless value.nil? }
+    end
+
+    def gem_properties(data)
+      to_properties(shared_properties(data).merge(
         "still_active:version_yanked" => boolean_property(data[:version_yanked])
-      }.filter_map { |name, value| {"name" => name, "value" => value} unless value.nil? }
+      ))
+    end
+
+    # Cross-ecosystem extras: which ecosystem the package came from, and whether it
+    # is one the project declared (both meaningless on the Ruby-only native path).
+    def sbom_properties(data)
+      to_properties(shared_properties(data).merge(
+        "still_active:ecosystem" => data[:ecosystem]&.to_s,
+        "still_active:direct" => boolean_property(data[:direct])
+      ))
     end
 
     # The Ruby interpreter. CycloneDX's "platform" type fits semantically, but

data/lib/{helpers → still_active/helpers}/libyear_helper.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require_relative "../still_active/core_ext"
+require_relative "../core_ext"
 
 module StillActive
   module LibyearHelper

data/lib/{helpers → still_active/helpers}/markdown_helper.rb

@@ -118,6 +118,25 @@ module StillActive
       lines.join("\n")
     end
 
+    # Packages whose maintainer has declared them deprecated. Its own section
+    # rather than a table column because the message is the actionable part: it
+    # usually names the successor, and it is the maintainer speaking rather than
+    # anything still_active inferred.
+    def deprecated_section(result)
+      flagged = result.select { |_name, data| data[:deprecated] }
+      return "" if flagged.empty?
+
+      lines = ["", "**Deprecated by their maintainers** (no further fixes, including security patches):"]
+      flagged.sort_by { |name, _| name }.each do |name, data|
+        reason = data[:deprecation_reason]
+        # The message is registry-supplied free text in a bullet list, and commonly
+        # contains a URL, so it goes through the inline escaper.
+        note = reason ? ": #{MarkdownEscape.inline(reason)}" : ""
+        lines << "- #{MarkdownEscape.code_span(DependencyHelper.identity(name, data))}#{note}"
+      end
+      lines.join("\n")
+    end
+
     # A dormant dep that caps your tree below its latest major (the poison-pill
     # signal). Consistent with the other finding sections: worst caps + total, the
     # direct parent named for a transitive pill. The full cap list is in the JSON.

data/lib/{helpers → still_active/helpers}/sarif_helper.rb

@@ -3,7 +3,7 @@
 require "json"
 require "digest"
 require "time"
-require_relative "../still_active/sarif/rules"
+require_relative "../sarif/rules"
 require_relative "lockfile_indexer"
 require_relative "activity_helper"
 require_relative "dependency_helper"
@@ -188,6 +188,17 @@ module StillActive
         out << mark_suppressed(result("SA007", name, "#{display} #{version}: this version has been yanked from RubyGems.", location), display, :yanked)
       end
 
+      if data[:deprecated]
+        # Fires independently of the activity signals on purpose: a package
+        # deprecated last month with a release last week looks perfectly healthy by
+        # dates, which is exactly the case recency-based tooling cannot see. The
+        # maintainer's own message is carried through when they left one, since it
+        # usually names the successor.
+        reason = data[:deprecation_reason]
+        detail = reason ? " Maintainer's note: #{reason}" : ""
+        out << mark_suppressed(result("SA010", name, "#{display} #{version}: deprecated by its maintainer.#{detail}", location), display, :deprecated)
+      end
+
       if data[:poison] && !Array(data[:constraints]).empty?
         # Level tracks the poison tier (critical->error, ...); a plain majors-behind
         # tier change keeps the (rule_id, gem_name) fingerprint so it doesn't re-alert.
@@ -397,9 +408,13 @@ module StillActive
       Digest::SHA256.hexdigest(["v1", rule_id, gem_name, advisory_id].compact.join("|"))[0, 16]
     end
 
+    # EOL dates are calendar dates, not instants: endoflife.date publishes
+    # "2025-03-31" and Time.parse reads it as local midnight. Shifting that to UTC
+    # rewinds it a day for every user east of UTC, so render the date as parsed,
+    # matching the markdown and terminal output.
     def format_date(value)
       t = ActivityHelper.parse_time(value)
-      t ? t.utc.strftime("%Y-%m-%d") : value.to_s
+      t ? t.strftime("%Y-%m-%d") : value.to_s
     end
 
     def repo_suffix(data)

data/lib/still_active/helpers/sbom_graph.rb

@@ -0,0 +1,166 @@
+# frozen_string_literal: true
+
+module StillActive
+  # Direct-vs-transitive reasoning over a CycloneDX `dependencies` graph.
+  #
+  # The native Bundler audit knows which gems you declared and, for the rest, the
+  # shortest path back to the declared gem that pulls them in, which is what turns
+  # an un-actionable transitive finding into "replace your direct dep A". The SBOM
+  # path had no equivalent: every package read the same, whether you chose it or it
+  # arrived six levels down. CycloneDX carries the graph to answer this; still_active
+  # simply never read it.
+  #
+  # This works purely in bom-refs. Turning a ref into an `ecosystem/name` identity
+  # is the reader's job, so this stays a graph problem with no purl knowledge.
+  #
+  # Two real generator shapes have to work, both captured from actual output rather
+  # than assumed:
+  #
+  #   Trivy: `metadata.component` is an application, whose children are one
+  #          application per manifest found (Gemfile.lock, package-lock.json), whose
+  #          children are the libraries that manifest declares. bom-refs are UUIDs.
+  #   Syft:  `metadata.component` is a `file` that is not a graph node at all. The
+  #          scanned project appears instead as an ordinary library component with
+  #          no incoming edge. bom-refs are purls.
+  #
+  # So "direct" can be neither "child of metadata.component" nor "one hop from the
+  # root". What holds for both: start at the graph's entry points, descend through
+  # any non-library scaffolding, and the FIRST library reached on each path is a
+  # declared dependency.
+  module SbomGraph
+    extend self
+
+    # => { ref => {direct: bool, path: [ref, ...] | nil} }, or nil when this SBOM
+    # cannot answer the question. nil is not "nothing is direct": callers must omit
+    # the fields entirely, because emitting `direct: false` everywhere would be the
+    # positive claim "none of these are yours" about a document that never said.
+    def resolve(dependencies:, root_ref:, library_refs:)
+      edges = edges_from(dependencies)
+      return if edges.empty?
+
+      entries = entry_points(edges, root_ref)
+      return if entries.empty?
+
+      direct = direct_libraries(edges, entries, library_refs)
+      return if direct.empty?
+
+      paths = shortest_paths(edges, direct, library_refs)
+      resolved = {}
+      direct.each { |ref| resolved[ref] = {direct: true, path: nil} }
+      paths.each { |ref, path| resolved[ref] ||= {direct: false, path: path} }
+      resolved
+    end
+
+    # The library components that are the scanned project(s) rather than
+    # dependencies of one. A Syft SBOM lists the project as an ordinary library
+    # with a purl, indistinguishable from a dependency by shape alone, so
+    # still_active audited the user's own code and reported it as critically
+    # stale (it has no registry entry, so it looks abandoned).
+    #
+    # The graph tells them apart: the project is what nothing depends on. The rule
+    # is deliberately conservative on both halves. It requires an OUTGOING edge, so
+    # a dependency whose parent edge the generator simply failed to record stays a
+    # dependency rather than vanishing from the audit, and it only ever considers
+    # libraries, so Trivy's application-typed root and manifest nodes (never
+    # dependencies to begin with) are not reported here. A merged SBOM covering
+    # several projects yields all of them.
+    def project_refs(dependencies:, library_refs:)
+      edges = edges_from(dependencies)
+      return Set.new if edges.empty?
+
+      pointed_at = Set.new
+      edges.each_value { |children| pointed_at.merge(children) }
+
+      edges.each_with_object(Set.new) do |(ref, children), roots|
+        next unless library_refs.include?(ref)
+        next if pointed_at.include?(ref)
+        next if children.empty?
+
+        roots << ref
+      end
+    end
+
+    private
+
+    # {ref => [child refs]}, skipping anything malformed. A generator is free to
+    # emit an entry with no dependsOn; that is a leaf, not an error.
+    def edges_from(dependencies)
+      return {} unless dependencies.is_a?(Array)
+
+      dependencies.each_with_object({}) do |entry, edges|
+        next unless entry.is_a?(Hash)
+
+        ref = entry["ref"]
+        next unless ref.is_a?(String)
+
+        children = entry["dependsOn"]
+        edges[ref] = children.is_a?(Array) ? children.grep(String) : []
+      end
+    end
+
+    # Where a walk can start: the declared root when it is actually a node, plus
+    # every node nothing points at. The second clause is what rescues the Syft
+    # shape, where the declared root is a file that never appears in the graph and
+    # the project node is simply parentless.
+    def entry_points(edges, root_ref)
+      pointed_at = Set.new
+      edges.each_value { |children| pointed_at.merge(children) }
+
+      entries = edges.keys.reject { |ref| pointed_at.include?(ref) }
+      entries << root_ref if root_ref.is_a?(String) && edges.key?(root_ref) && !entries.include?(root_ref)
+      entries
+    end
+
+    # Descend from the entry points through non-library scaffolding (Trivy's
+    # per-manifest application nodes) and collect the first library on each path.
+    # The entry points themselves are never direct: they are the project, or a
+    # manifest, and in the Syft shape the project node IS a library.
+    def direct_libraries(edges, entries, library_refs)
+      direct = Set.new
+      seen = Set.new(entries)
+      queue = entries.dup
+
+      until queue.empty?
+        (edges[queue.shift] || []).each do |child|
+          next if seen.include?(child)
+
+          seen << child
+          if library_refs.include?(child)
+            direct << child
+          else
+            queue << child
+          end
+        end
+      end
+
+      direct
+    end
+
+    # BFS over library edges from the direct set, so each transitive package gets
+    # the shortest chain back to the declared dependency that pulls it in, head
+    # first. Same contract as the native path's dependency_path.
+    def shortest_paths(edges, direct, library_refs)
+      paths = {}
+      queue = []
+      direct.each do |ref|
+        paths[ref] = [ref]
+        queue << ref
+      end
+
+      until queue.empty?
+        ref = queue.shift
+        (edges[ref] || []).each do |child|
+          next unless library_refs.include?(child)
+          next if paths.key?(child)
+
+          paths[child] = paths[ref] + [child]
+          queue << child
+        end
+      end
+
+      # The direct set seeded this BFS, so drop it: a declared dependency carries
+      # no path, matching the native path's contract.
+      paths.except(*direct)
+    end
+  end
+end

data/lib/{helpers → still_active/helpers}/status_helper.rb

@@ -19,9 +19,14 @@ module StillActive
     # dormant or archived gem carrying an unpatched advisory is :dead (no one is
     # going to fix it, migrate). :unknown is least severe -- an absence, not a
     # finding -- so missing data never reads as :ok.
-    SEVERITY = [:unknown, :ok, :legacy, :stale, :archived, :vulnerable, :dead].freeze
+    # :deprecated sits above :archived and below :vulnerable. An archived repo is
+    # circumstantial (development may simply have moved), whereas a deprecation is
+    # the maintainer explicitly telling you to stop using the package, frequently
+    # naming the replacement. A live vulnerability is still the more urgent thing.
+    SEVERITY = [:unknown, :ok, :legacy, :stale, :archived, :deprecated, :vulnerable, :dead].freeze
 
-    # Returns :dead, :vulnerable, :archived, :legacy, :stale, :ok, or :unknown.
+    # Returns :dead, :vulnerable, :deprecated, :archived, :legacy, :stale, :ok,
+    # or :unknown.
     def gem_status(gem_data)
       vulnerable = gem_data[:vulnerability_count].to_i.positive?
 
@@ -33,13 +38,26 @@ module StillActive
       return :unknown if gem_data[:version_unresolved] && !vulnerable
 
       level = ActivityHelper.activity_level(gem_data)
+      # The maintainer's own declaration that this package should no longer be
+      # used. Unlike every other input here it is a stated fact rather than a date
+      # heuristic, so it is read before the activity level rather than blended
+      # with it.
+      deprecated = gem_data[:deprecated] == true
 
       if vulnerable
-        # A vulnerability in a dormant or archived gem won't be patched -> :dead;
-        # in an actively-released gem a fix is plausible -> :vulnerable.
-        return [:critical, :archived].include?(level) ? :dead : :vulnerable
+        # A vulnerability in a dormant, archived or deprecated gem won't be patched
+        # -> :dead; in an actively-released gem a fix is plausible -> :vulnerable.
+        # Deprecation counts even on a gem still shipping releases: the maintainer
+        # has said to stop using it, so waiting for the patch is not a plan.
+        return (deprecated || [:critical, :archived].include?(level)) ? :dead : :vulnerable
       end
 
+      # Deliberately ahead of the :critical -> :legacy branch below. :legacy means
+      # "long-dormant but done, low risk", and a deprecated package is the exact
+      # case that must not be filed there: left-pad is dormant AND clean AND its
+      # maintainer says to use String.prototype.padStart() instead.
+      return :deprecated if deprecated
+
       case level
       when :archived
         # archived != EOL: a repo archived while the gem still publishes recent

data/lib/{helpers → still_active/helpers}/terminal_helper.rb

@@ -160,9 +160,24 @@ module StillActive
       # A language-runtime ceiling is orthogonal to poison/alternatives (a gem can
       # be maintained yet still cap your Ruby), so it always gets its own line.
       lines << language_ceiling_line(data)
+      # So is a deprecation, and more so: it is the maintainer's own statement
+      # rather than anything derived from the row above it, and a deprecated gem
+      # can look entirely healthy in every other column.
+      lines << deprecation_line(data)
       lines.compact
     end
 
+    # "  ↳ deprecated by maintainer: <their message>". Red, because a deprecation
+    # is an instruction to stop using the package, and the message usually names
+    # the replacement, so it is the most actionable text on the row.
+    def deprecation_line(data)
+      return unless data[:deprecated]
+
+      reason = data[:deprecation_reason]
+      text = reason ? "deprecated by maintainer: #{reason}" : "deprecated by maintainer"
+      "  #{AnsiHelper.red("\u21B3 #{text}")}"
+    end
+
     # "  ↳ ruby ceiling: <receipt>" (or "python ceiling"), coloured by tier (red =
     # strands you on an EOL runtime, dim = an FYI cap below the latest stable).
     # Reuses poison_colour; the runtime name comes off the finding, not hardcoded.

data/lib/{helpers → still_active/helpers}/version_helper.rb

@@ -104,8 +104,20 @@ module StillActive
     # SPDX license identifier(s) from the RubyGems versions payload.
     # Comma-joined when a gem declares more than one. nil when unknown.
     def license(version_hash:)
-      licenses = version_hash&.dig("licenses")
-      return if licenses.nil? || licenses.empty?
+      format_licenses(version_hash&.dig("licenses"))
+    end
+
+    # The shared rendering both paths join through, so a licence reads the same
+    # whether it came from RubyGems (native) or deps.dev (--sbom). Both serve an
+    # array of SPDX strings, and a single element may itself be an expression
+    # ("Apache-2.0 OR MIT"), which passes through untouched. nil when unknown,
+    # never an empty string, so a missing licence can't render as a present blank.
+    def format_licenses(licenses)
+      # Array() so a drifted feed serving a bare string instead of an array can't
+      # raise here. This runs inside the per-dependency assessment, so an exception
+      # would cost that dependency its entire verdict over a cosmetic field.
+      licenses = Array(licenses)
+      return if licenses.empty?
 
       licenses.join(", ")
     end

data/lib/{helpers → still_active/helpers}/vulnerability_helper.rb

@@ -23,11 +23,10 @@ module StillActive
     # One advisory's severity label ("low".."critical"), or nil when genuinely unscored.
     # The authoritative GHSA/OSV label is a FLOOR: a real CVSS number sharpens precision
     # and can RAISE the band, but never lowers it below the label. This matters because
-    # the OSV-derived score is cvss-suite's overall_score, which folds in any
-    # threat/environmental metrics a vector carries (and can diverge from GHSA at a band
-    # edge) -- on a fail-closed, no-false-positive tool a computed number must not
-    # silently demote a GHSA-HIGH finding out of a severity gate. With only one of the
-    # two present, that one stands.
+    # GHSA labels are assigned by people and can sit off the FIRST band edge of the
+    # computed base score -- on a fail-closed, no-false-positive tool a computed
+    # number must not silently demote a GHSA-HIGH finding out of a severity gate.
+    # With only one of the two present, that one stands.
     def advisory_severity(vulnerability)
       from_score = (score = effective_score(vulnerability)) ? severity_label(score) : nil
       from_label = OSV_LABELS[vulnerability[:osv_severity].to_s.downcase]

data/lib/still_active/options.rb

@@ -1,9 +1,9 @@
 # frozen_string_literal: true
 
 require "optparse"
-require_relative "../helpers/constraint_helper"
-require_relative "../helpers/cyclonedx_helper"
-require_relative "../helpers/vulnerability_helper"
+require_relative "helpers/constraint_helper"
+require_relative "helpers/cyclonedx_helper"
+require_relative "helpers/vulnerability_helper"
 
 module StillActive
   class Options
@@ -147,6 +147,9 @@ module StillActive
       opts.on("--fail-if-critical", "Exit 1 if any gem has critical activity warning") do
         StillActive.config { |config| config.fail_if_critical = true }
       end
+      opts.on("--fail-if-deprecated", "Exit 1 if any dependency's maintainer has deprecated it") do
+        StillActive.config { |config| config.fail_if_deprecated = true }
+      end
       opts.on("--fail-if-warning", "Exit 1 if any gem has warning or critical activity warning") do
         StillActive.config { |config| config.fail_if_warning = true }
       end

data/lib/still_active/osv_client.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
-require_relative "../helpers/http_helper"
-require_relative "../helpers/cvss_helper"
+require_relative "helpers/http_helper"
+require_relative "helpers/cvss_helper"
 
 module StillActive
   # OSV (api.osv.dev) enrichment for advisories deps.dev has already discovered.

data/lib/still_active/poison_security_correlator.rb

@@ -1,8 +1,8 @@
 # frozen_string_literal: true
 
-require_relative "../helpers/vulnerability_helper"
-require_relative "../helpers/constraint_helper"
-require_relative "../helpers/semver_satisfaction"
+require_relative "helpers/vulnerability_helper"
+require_relative "helpers/constraint_helper"
+require_relative "helpers/semver_satisfaction"
 
 module StillActive
   # Whole-tree correlation, run once after the fan-out: a poison cap is far more

data/lib/still_active/pypi_client.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require_relative "../helpers/http_helper"
+require_relative "helpers/http_helper"
 require_relative "version"
 
 module StillActive

data/lib/still_active/sarif/rules.rb

@@ -168,6 +168,21 @@ module StillActive
           level: "note",
           security_severity: nil, # maintenance/compatibility, not a CVE (as SA002/SA004/SA005/SA008)
           tags: ["maintenance", "runtime", "external/cwe/cwe-1104"]
+        },
+        {
+          id: "SA010",
+          name: "DeprecatedPackage",
+          short: "Gem is deprecated by its maintainer",
+          full: "The maintainer has marked this gem deprecated in its registry. Unlike every other maintenance signal here, this is not inferred from dates or repository state: the person who publishes it has said to stop using it, and the deprecation message often names the replacement. A deprecated package can still look healthy by release recency, so this fires independently of the activity signals.",
+          help_text: "Read the deprecation message, which usually names the successor, and migrate to it. There will be no further fixes, including security patches.",
+          level: "error",
+          security_severity: "7.5",
+          tags: ["security", "supply-chain", "maintenance", "external/cwe/cwe-1104"],
+          neutral: {
+            short: "Package is deprecated by its maintainer",
+            full: "The maintainer has marked this package deprecated in its registry. Unlike every other maintenance signal here, this is not inferred from dates or repository state: the person who publishes it has said to stop using it, and the deprecation message often names the replacement. A deprecated package can still look healthy by release recency, so this fires independently of the activity signals.",
+            help_text: "Read the deprecation message, which usually names the successor, and migrate to it. There will be no further fixes, including security patches."
+          }
         }
       ].freeze