still_active 3.0.0 → 3.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f3351319b0427ef0043ecb5a150350499a25b7cb3228814184d3908d09497bc5
-  data.tar.gz: ffbc01c085040a9ed570095f133407dce101e4aa9a22689bfe423bc32996cdb3
+  metadata.gz: 1b366f37d158cbf7b8e13c552ead6eefec0ec98270b9f8c511505d39a6299631
+  data.tar.gz: efb7a1a7cb3b12a9a8ec8e8aed8b955ec600ef8a35f455d2fe9185611a41ce6a
 SHA512:
-  metadata.gz: 14f7e5c50c8df5291bd1239496f5016d11a2336bf6517a58887ab1a1ac3857dbb7cc3de99767f95f986b0620e3c07b448b081ce41dbb86b1d1c102ed404c3b56
-  data.tar.gz: 58624fb08295567a415a9e58a1cefda2e0663144133bd38b6b8563588eb3958971ed52fef07884b4c03ad16fb97b685f661d3a45a240d09d116cd199d699985a
+  metadata.gz: 1dac0f642b896d150070c5d63172cf1102d6a978b6605d45a6e44b80ee548c9ec77e3f3922c1c6865cefee2a2ae576e2059bbee919bf69399709ad09a69b3963
+  data.tar.gz: f76ad2676b526b1819d97051f31da33d690f032d5eb23f352074e6d086668fc9223a460402220f73698023dfd0de10ae2288a222fb88fd2c3981b9a9c11d5b89

data/CHANGELOG.md

@@ -2,6 +2,13 @@
 
 ## [Unreleased]
 
+## [3.1.0] - 2026-09-07
+
+### Changed
+
+- **`cvss-suite` is now a REQUIRED runtime dependency** (`>= 5.0`), no longer opt-in. Its 5.0 release dropped the constraints that kept it optional through 3.0 (a Ruby 2.6 floor, a `bigdecimal` cap, an exact `bundler` pin), so it now passes the same audit still_active runs on your own lockfile. It resolves automatically on `gem install`; the Ruby floor is unchanged. The `cvss-suite` input on the GitHub Action becomes a no-op.
+- **CVSS-4-only advisories are always scored now**, and the number is the **base score** (what NVD and GHSA publish), not cvss-suite's `overall_score`, which folds threat metrics into the vector when present. Under `--fail-if-vulnerable=<severity>` an advisory that used to fail closed as unscored gets a real number, so a previously red run can go green when that number sits below your threshold. The GHSA label still floors the band, so a HIGH never demotes.
+
 ## [3.0.0] - 2026-08-21
 
 The maintenance lens goes cross-ecosystem. In one line each:

data/README.md

@@ -219,7 +219,7 @@ Full semantics, thresholds, and transitive behaviour: [`docs/configuration.md`](
 
 ## Data sources
 
-Release dates and licenses from [RubyGems](https://rubygems.org) / [GitHub Packages](https://docs.github.com/en/packages) / [Artifactory](https://jfrog.com/artifactory/); repo activity from the [GitHub](https://docs.github.com/en/rest) / [GitLab](https://docs.gitlab.com/ee/api/) / [Codeberg](https://forgejo.org/docs/latest/user/api-usage/) API, or [ecosyste.ms](https://ecosyste.ms) tokenless ([CC-BY-SA 4.0](https://creativecommons.org/licenses/by-sa/4.0/)); OpenSSF Scorecard and CVSS from [deps.dev](https://deps.dev); advisory severities and fixed-version ranges from [OSV](https://osv.dev) (CVSS-4 scoring needs the optional [`cvss-suite`](https://rubygems.org/gems/cvss-suite)); extra advisories from [ruby-advisory-db](https://github.com/rubysec/ruby-advisory-db); runtime EOL from [endoflife.date](https://endoflife.date).
+Release dates and licenses from [RubyGems](https://rubygems.org) / [GitHub Packages](https://docs.github.com/en/packages) / [Artifactory](https://jfrog.com/artifactory/); repo activity from the [GitHub](https://docs.github.com/en/rest) / [GitLab](https://docs.gitlab.com/ee/api/) / [Codeberg](https://forgejo.org/docs/latest/user/api-usage/) API, or [ecosyste.ms](https://ecosyste.ms) tokenless ([CC-BY-SA 4.0](https://creativecommons.org/licenses/by-sa/4.0/)); OpenSSF Scorecard and CVSS from [deps.dev](https://deps.dev); advisory severities and fixed-version ranges from [OSV](https://osv.dev), scored with [`cvss-suite`](https://rubygems.org/gems/cvss-suite) when deps.dev has no number (CVSS 4.0); extra advisories from [ruby-advisory-db](https://github.com/rubysec/ruby-advisory-db); runtime EOL from [endoflife.date](https://endoflife.date).
 
 ## Development
 

data/lib/still_active/helpers/cvss_helper.rb

@@ -1,63 +1,29 @@
 # frozen_string_literal: true
 
+require "cvss_suite"
+
 module StillActive
-  # Computes a CVSS score from a vector string, across v2/v3/v4. deps.dev stores only
-  # CVSS 3.x, so a CVSS-4-only advisory (the flagship protobuf case) arrives with no
-  # numeric score; OSV carries the v4 vector, and this turns it into the number the
+  # Computes a CVSS base score from a vector string, across v2/v3/v4. deps.dev stores
+  # only CVSS 3.x, so a CVSS-4-only advisory (the flagship protobuf case) arrives with
+  # no numeric score; OSV carries the v4 vector, and this turns it into the number the
   # SARIF security-severity and CycloneDX rating want.
   #
-  # cvss-suite is an OPTIONAL, undeclared dependency: it over-constrains its own deps
-  # (an exact `bundler` pin, a `bigdecimal ~> 3.1` cap), the poison-pill pattern
-  # still_active itself flags, so hard-requiring it would force that liability on every
-  # user and trip our own audit. CvssHelper soft-requires it; install cvss-suite (or run
-  # the distribution that bundles it) to light it up.
-  #
-  # Returns cvss-suite's `overall_score`: for the base-only vectors OSV publishes that
-  # IS the base score, but a vector carrying threat/environmental metrics would fold
-  # those in -- which is why the severity band floors at the authoritative GHSA label
-  # (VulnerabilityHelper.advisory_severity) and this number never lowers it: the label
-  # drives gating and SARIF level, the number only sharpens display. Fails safe: an
-  # absent gem or an absent/unparseable vector yields nil, never a crash.
+  # Returns the BASE score, not cvss-suite's overall_score: a vector carrying threat or
+  # environmental metrics folds those into overall_score (E:U alone turns a 9.3 into
+  # an 8.1), while NVD and GHSA publish the base score. The severity band still floors
+  # at the authoritative GHSA label (VulnerabilityHelper.advisory_severity) because
+  # labels are assigned by people and can sit off the FIRST band edge; the label drives
+  # gating and SARIF level, the number sharpens display. Fails safe: an absent or
+  # unparseable vector yields nil, never a crash.
   module CvssHelper
     extend self
 
     def score(vector)
-      return unless available?
       return if vector.nil? || vector.to_s.empty?
 
-      cvss = CvssSuite.new(vector.to_s)
-      cvss.valid? ? cvss.overall_score : nil
-    rescue => e
-      # We only reach here with cvss-suite loaded (available?), so a raise is the
-      # installed gem failing this call site -- an incompatible version, a renamed
-      # `overall_score` -- not a bad vector, which cvss-suite reports via valid?.
-      # Fail safe to nil (the number is display-only, never gates), but don't
-      # swallow it: an opted-in-but-broken scorer that emitted nothing would read
-      # as "no advisories are scored". Warn once per run (not per advisory),
-      # matching OsvClient.enrich rather than staying silent.
-      warn_scorer_failed(e)
+      CvssSuite.parse(vector.to_s).base_score
+    rescue CvssSuite::Error
       nil
     end
-
-    # Memoized soft-require: true once cvss-suite loads, false when it isn't installed.
-    def available?
-      return @available unless @available.nil?
-
-      @available = begin
-        require "cvss_suite"
-        true
-      rescue LoadError
-        false
-      end
-    end
-
-    private
-
-    def warn_scorer_failed(error)
-      return if @warned
-
-      @warned = true
-      warn("warning: cvss-suite scoring failed: #{error.class} (#{error.message}); CVSS numbers unavailable this run, check your cvss-suite version")
-    end
   end
 end

data/lib/still_active/helpers/vulnerability_helper.rb

@@ -23,11 +23,10 @@ module StillActive
     # One advisory's severity label ("low".."critical"), or nil when genuinely unscored.
     # The authoritative GHSA/OSV label is a FLOOR: a real CVSS number sharpens precision
     # and can RAISE the band, but never lowers it below the label. This matters because
-    # the OSV-derived score is cvss-suite's overall_score, which folds in any
-    # threat/environmental metrics a vector carries (and can diverge from GHSA at a band
-    # edge) -- on a fail-closed, no-false-positive tool a computed number must not
-    # silently demote a GHSA-HIGH finding out of a severity gate. With only one of the
-    # two present, that one stands.
+    # GHSA labels are assigned by people and can sit off the FIRST band edge of the
+    # computed base score -- on a fail-closed, no-false-positive tool a computed
+    # number must not silently demote a GHSA-HIGH finding out of a severity gate.
+    # With only one of the two present, that one stands.
     def advisory_severity(vulnerability)
       from_score = (score = effective_score(vulnerability)) ? severity_label(score) : nil
       from_label = OSV_LABELS[vulnerability[:osv_severity].to_s.downcase]

data/lib/still_active/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module StillActive
-  VERSION = "3.0.0"
+  VERSION = "3.1.0"
 end

data/still_active.gemspec

@@ -55,12 +55,12 @@ Gem::Specification.new do |spec|
   # carry an artificial floor.
   spec.add_runtime_dependency("async", ">= 2.2")
   spec.add_runtime_dependency("bundler", ">= 2.0")
-  # cvss-suite (CVSS v4.0 base-score from an OSV vector, for the CVSS-4-only advisory
-  # deps.dev can't score) is an OPTIONAL dependency, NOT declared here: it exact-pins
-  # bundler and caps bigdecimal, the poison-pill pattern still_active flags, so we
-  # won't force it on users or trip our own audit. CvssHelper soft-requires it; absent,
-  # the OSV/GHSA severity label still carries gating + level and the number is skipped.
-  # Install cvss-suite (or run the distribution that bundles it) to light up the number.
+  # CVSS base score from an OSV vector, for the CVSS-4-only advisory deps.dev can't
+  # score. 5.0 is the floor because it is the first release without the poison-pill
+  # constraints (a Ruby 2.6 floor, a bigdecimal cap, an exact bundler pin) that kept
+  # it optional through 3.0; 5.0 also adds base_score on CVSS 4.0, which is the API
+  # CvssHelper reads.
+  spec.add_runtime_dependency("cvss-suite", ">= 5.0")
   spec.add_runtime_dependency("faraday-retry")
   spec.add_runtime_dependency("gems")
   spec.add_runtime_dependency("octokit")

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: still_active
 version: !ruby/object:Gem::Version
-  version: 3.0.0
+  version: 3.1.0
 platform: ruby
 authors:
 - Sean Floyd
@@ -37,6 +37,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '2.0'
+- !ruby/object:Gem::Dependency
+  name: cvss-suite
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '5.0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '5.0'
 - !ruby/object:Gem::Dependency
   name: faraday-retry
   requirement: !ruby/object:Gem::Requirement