still_active 3.0.0 → 3.2.0

data/lib/still_active/sarif/rules.rb

@@ -180,7 +180,7 @@ module StillActive
           tags: ["security", "supply-chain", "maintenance", "external/cwe/cwe-1104"],
           neutral: {
             short: "Package is deprecated by its maintainer",
-            full: "The maintainer has marked this package deprecated in its registry. Unlike every other maintenance signal here, this is not inferred from dates or repository state: the person who publishes it has said to stop using it, and the deprecation message often names the replacement. A deprecated package can still look healthy by release recency, so this fires independently of the activity signals.",
+            full: "The maintainer has marked this package deprecated in its registry. Unlike every other maintenance signal here, this is not inferred from dates or repository state: the person who publishes it has said to stop using it, and the deprecation message often names the replacement. A deprecated package can still look healthy by release recency, so this fires independently of the activity signals. A language runtime counts too: when the Go team ends a Go release line, the toolchain on it is reported here.",
             help_text: "Read the deprecation message, which usually names the successor, and migrate to it. There will be no further fixes, including security patches."
           }
         }

data/lib/still_active/sbom_workflow.rb

@@ -1,6 +1,8 @@
 # frozen_string_literal: true
 
 require_relative "ecosystem_lens"
+require_relative "assessment"
+require_relative "source_health"
 require_relative "ceiling_reconciler"
 require_relative "poison_security_correlator"
 require_relative "helpers/python_helper"
@@ -30,7 +32,9 @@ module StillActive
     # rate-limited run read "all clear" while silently skipping deps.
     Outcome = Data.define(:assessed, :failures)
 
-    def call(sbom_result, &on_progress)
+    # `health` is the run's SourceHealth report: in an ecosystem it distrusts,
+    # deps.dev's advisories count as unchecked. The Go toolchain's come from OSV.
+    def call(sbom_result, health: SourceHealth::Report.healthy, &on_progress)
       dependencies = sbom_result.dependencies
       Async do
         # The language-runtime support windows, fetched once for the whole SBOM
@@ -42,6 +46,9 @@ module StillActive
           dotnet: safe_support_window(".NET") { DotnetHelper.supported_dotnet_range },
           dotnetfx: safe_support_window(".NET Framework") { DotnetHelper.supported_dotnetfx_range }
         }
+        # Every version record in one batch request, rather than one GET each; the
+        # Go toolchain's come from OSV and endoflife.date instead.
+        DepsDevClient.prefetch_versions(dependencies.filter_map { [_1[:ecosystem], _1[:name], _1[:version]] unless GoToolchain.toolchain?(_1[:ecosystem], _1[:name]) })
         barrier = Async::Barrier.new
         semaphore = Async::Semaphore.new(StillActive.config.parallelism, parent: barrier)
         result = {}
@@ -78,6 +85,11 @@ module StillActive
           end
         end
         barrier.wait
+        result.each_value do |data|
+          next if health.deps_dev_trusted?(data[:ecosystem]) || GoToolchain.toolchain?(data[:ecosystem], data[:name])
+
+          data[:vulnerabilities_checked] = false
+        end
         # Whole-tree correlation once every package's signals are in: a Python
         # ceiling's "upgrade to lift it" must not contradict a poison finding that
         # caps the same package below that upgrade (same guarantee as the native path).
@@ -87,10 +99,12 @@ module StillActive
         PoisonSecurityCorrelator.correlate(result)
         # Stable, diffable order regardless of async completion order.
         Outcome.new(
-          assessed: result.sort_by { |key, _| key }.to_h,
+          assessed: result.sort_by { |key, _| key }.to_h.transform_values { Assessment.from(_1) },
           failures: failures.sort_by { |failure| "#{failure[:ecosystem]}/#{failure[:name]}@#{failure[:version]}" }
         )
       end.wait
+    ensure
+      DepsDevClient.clear_prefetch
     end
 
     private

data/lib/still_active/source_health.rb

@@ -0,0 +1,88 @@
+# frozen_string_literal: true
+
+require "time"
+require_relative "deps_dev_client"
+
+module StillActive
+  # Whether deps.dev is answering in the shape we read and is current, checked once
+  # per run before the fan-out. deps.dev is an alpha API and it is the advisory
+  # source for everything but ruby-advisory-db and the Go toolchain, so when it
+  # isn't healthy its advisories count as unchecked rather than clean.
+  #
+  # Two checks. The advisory canary asks for a package with permanent advisories
+  # and expects them back (a renamed field reads as zero everywhere). The
+  # freshness canary asks, per ecosystem in the audit, for packages that publish
+  # often and expects one of them to have published in the last 30 days: a stalled index
+  # serves stale versions and misses new advisories without any error. Neither
+  # catches one stale package in a live index (deps.dev's Go stdlib was that).
+  module SourceHealth
+    extend self
+
+    # Packages that publish often; an ecosystem is fresh if ANY of its set has a
+    # version published in the window. Chosen by replaying two years of deps.dev
+    # publish dates (2026-09-24): the longest stretch with no version from the
+    # set is 10 days (nuget), 8.7 (npm), 7 (cargo, rubygems), 6.7 (pypi, maven),
+    # 6 (go), so 30 days is a 3x margin. Single canaries weren't enough:
+    # aws-sdk-core went 34 days and golang.org/x/net 35, which would have failed
+    # a healthy index closed. Recheck with each set's publishedAt history.
+    FRESHNESS_CANARIES = {
+      rubygems: ["aws-partitions", "aws-sdk-ec2"],
+      npm: ["next", "@types/node"],
+      pypi: ["boto3", "botocore"],
+      cargo: ["aws-sdk-ec2", "oxc_parser", "swc_core"],
+      go: ["cloud.google.com/go/storage", "github.com/aws/aws-sdk-go-v2/service/s3"],
+      maven: ["software.amazon.awssdk:s3", "software.amazon.awssdk:ec2"],
+      nuget: ["AWSSDK.S3", "AWSSDK.Core"]
+    }.freeze
+    FRESH_WITHIN_SECONDS = 30 * 24 * 60 * 60
+
+    Report = Data.define(:advisory_schema_ok, :stale_ecosystems) do
+      def self.healthy = new(advisory_schema_ok: true, stale_ecosystems: [])
+
+      # Whether deps.dev's advisories for this ecosystem count as an answer.
+      def deps_dev_trusted?(ecosystem)
+        advisory_schema_ok && !stale_ecosystems.include?(ecosystem)
+      end
+
+      def degraded? = !advisory_schema_ok || !stale_ecosystems.empty?
+
+      def as_json
+        {
+          status: degraded? ? "degraded" : "ok",
+          deps_dev_advisories: advisory_schema_ok ? "ok" : "failed",
+          deps_dev_stale_ecosystems: stale_ecosystems.map(&:to_s)
+        }
+      end
+
+      def warnings
+        lines = []
+        lines << "deps.dev's advisory check failed (its `advisoryKeys` field may have changed, or the API is unreachable); its advisories count as unchecked unless another source answers for them (ruby-advisory-db, OSV for the Go toolchain)" unless advisory_schema_ok
+        stale_ecosystems.each do |ecosystem|
+          lines << "deps.dev's #{ecosystem} index has nothing published by #{FRESHNESS_CANARIES[ecosystem].join(", ")} in 30 days (or couldn't be read), so it looks stale; its #{ecosystem} advisories count as unchecked unless another source answers for them, and its latest versions may be behind"
+        end
+        lines
+      end
+    end
+
+    def check(ecosystems:, now: Time.now)
+      Report.new(
+        advisory_schema_ok: DepsDevClient.advisory_schema_ok?,
+        stale_ecosystems: ecosystems.uniq.select { FRESHNESS_CANARIES.key?(_1) && !fresh?(_1, now) }
+      )
+    end
+
+    private
+
+    # Fresh when any canary has a version published in the window. One that can't
+    # be read (after the client's retry) just doesn't count; if none can, the check
+    # can't confirm freshness and reads stale.
+    def fresh?(ecosystem, now)
+      FRESHNESS_CANARIES[ecosystem].any? do |name|
+        date = DepsDevClient.newest_publish_date(name: name, system: ecosystem)
+        !date.nil? && now - Time.parse(date) < FRESH_WITHIN_SECONDS
+      rescue HttpHelper::Unavailable, ArgumentError, TypeError
+        false
+      end
+    end
+  end
+end

data/lib/still_active/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module StillActive
-  VERSION = "3.0.0"
+  VERSION = "3.2.0"
 end

data/lib/still_active/workflow.rb

@@ -4,6 +4,9 @@ require_relative "artifactory_client"
 require_relative "compact_index_client"
 require_relative "source_credentials"
 require_relative "ceiling_reconciler"
+require_relative "errors"
+require_relative "assessment"
+require_relative "repository_signals"
 require_relative "deps_dev_client"
 require_relative "osv_client"
 require_relative "poison_security_correlator"
@@ -19,6 +22,7 @@ require_relative "helpers/constraint_helper"
 require_relative "helpers/http_helper"
 require_relative "helpers/libyear_helper"
 require_relative "helpers/ruby_advisory_db"
+require_relative "source_health"
 require_relative "helpers/ruby_helper"
 require_relative "helpers/runtime_ceiling_helper"
 require_relative "helpers/version_helper"
@@ -27,13 +31,16 @@ require "async"
 require "async/barrier"
 require "async/semaphore"
 require "cgi"
-require "gems"
+require_relative "rubygems_client"
 
 module StillActive
   module Workflow
     extend self
 
-    def call(&on_progress)
+    # `health` is the run's SourceHealth report: when it distrusts deps.dev for
+    # rubygems, deps.dev's advisories count as unchecked unless ruby-advisory-db
+    # answered for them.
+    def call(health: SourceHealth::Report.healthy, &on_progress)
       task = Async do
         # Load the optional ruby-advisory-db once, before the fan-out, so the
         # read-only Database is shared across fibers rather than reloaded per gem.
@@ -53,11 +60,14 @@ module StillActive
             nil
           end
         # Resolve the GitHub token once here, single-fibered, before the fan-out:
-        # provider_for reads it per gem across fibers and gh_cli_token shells out,
+        # RepositorySignals reads it per gem across fibers and gh_cli_token shells out,
         # so resolving eagerly keeps that off the concurrent path and guarantees
         # every fiber sees one consistent value (token -> live GitHub, incl. private
         # repos; only a genuinely absent token falls back to ecosyste.ms).
         StillActive.config.github_oauth_token
+        # Every pinned gem's deps.dev version record in one batch request, rather
+        # than one GET each. The same names the per-gem lookups already send.
+        DepsDevClient.prefetch_versions(StillActive.config.gems.filter_map { [:rubygems, _1[:name], _1[:version]] if _1[:version] })
         barrier = Async::Barrier.new
         semaphore = Async::Semaphore.new(StillActive.config.parallelism, parent: barrier)
         result_object = {}
@@ -83,18 +93,20 @@ module StillActive
               constraint_cache: constraint_cache,
               ruby_range: ruby_range
             )
-          rescue Octokit::TooManyRequests
-            $stderr.print("\r\e[K") if on_progress
-            warn("rate limited checking #{gem[:name]}: set GITHUB_TOKEN to increase your limit")
           rescue => e
             $stderr.print("\r\e[K") if on_progress
             warn("error occurred for #{gem[:name]}: #{e.class}\n\t#{e.message}")
           ensure
+            # An assessment that raised part-way is left without its answers;
+            # Assessment.from reads those as unchecked and failed.
             completed += 1
             on_progress&.call(completed, total)
           end
         end
         barrier.wait
+        unless health.deps_dev_trusted?(:rubygems) || advisory_db
+          result_object.each_value { |data| data[:vulnerabilities_checked] = false }
+        end
         # Whole-tree correlation, once every gem's signals are in: a ceiling's
         # "upgrade to lift it" must not contradict a poison finding that caps the
         # same gem below that upgrade.
@@ -105,9 +117,13 @@ module StillActive
         # Gems are inserted as their async tasks finish, so the natural order is
         # nondeterministic completion order. Sort by name once here so every
         # consumer (JSON, SARIF, the baseline diff) gets a stable, diffable order.
-        result_object.sort_by { |name, _| name }.to_h
+        # Every pass over the hashes is done; from here on consumers read the
+        # finished Assessment.
+        result_object.sort_by { |name, _| name }.to_h.transform_values { Assessment.from(_1) }
       end
       task.wait
+    ensure
+      DepsDevClient.clear_prefetch
     end
 
     def ruby_freshness
@@ -150,7 +166,8 @@ module StillActive
       signals = repo_signals(
         source: repo_info[:source],
         repository_owner: repo_info[:owner],
-        repository_name: repo_info[:name]
+        repository_name: repo_info[:name],
+        public: public_source?(source_uri)
       )
       commit_date = signals[:last_commit_date]
       archived = signals[:archived]
@@ -174,6 +191,7 @@ module StillActive
         repository_url: repo_info[:url],
         last_commit_date: commit_date,
         archived: archived,
+        **repository_availability(signals),
         **deps_dev
       })
 
@@ -286,7 +304,8 @@ module StillActive
     def gem_info_non_rubygems(gem_name:, gem_version:, result_object:, source_uri: nil, advisory_db: nil)
       repo_info = repository_info_for_non_rubygems(gem_name: gem_name, source_uri: source_uri)
       source, owner, name = repo_info.values_at(:source, :owner, :name)
-      deps_dev = gem_version ? fetch_deps_dev_info(gem_name: gem_name, version: gem_version, advisory_db: advisory_db) : {}
+      # With no version there is nothing to look advisories up by.
+      deps_dev = gem_version ? fetch_deps_dev_info(gem_name: gem_name, version: gem_version, advisory_db: advisory_db) : {vulnerabilities_checked: false}
 
       # Fall back to repo-derived project_id for scorecard when deps.dev doesn't
       # have the version. Use ||= so a maintained score already found via the
@@ -303,6 +322,7 @@ module StillActive
         repository_url: repo_info[:url],
         last_commit_date: signals[:last_commit_date],
         archived: signals[:archived],
+        **repository_availability(signals),
         **deps_dev
       })
     end
@@ -371,7 +391,16 @@ module StillActive
     end
 
     def fetch_deps_dev_info(gem_name:, version:, advisory_db: nil)
-      info = DepsDevClient.version_info(gem_name: gem_name, version: version)
+      # deps.dev failing to answer leaves the advisories unchecked, unless
+      # ruby-advisory-db, the Ruby authority, is loaded and answers for them.
+      # No version (the latest-version lookup failed too) means nothing was asked.
+      checked = !version.nil?
+      info = begin
+        DepsDevClient.version_info(gem_name: gem_name, version: version)
+      rescue HttpHelper::Unavailable
+        checked = !advisory_db.nil?
+        nil
+      end
       scorecard = DepsDevClient.project_scorecard(project_id: info&.dig(:project_id))
       advisory_keys = info&.dig(:advisory_keys) || []
       # The keys ARE the evidence the version is vulnerable; the detail fetch only
@@ -397,6 +426,7 @@ module StillActive
         deprecated: info&.dig(:deprecated) == true,
         deprecation_reason: info&.dig(:deprecation_reason),
         vulnerability_count: vulnerabilities.length,
+        vulnerabilities_checked: checked,
         vulnerabilities: vulnerabilities
       }
     end
@@ -409,20 +439,8 @@ module StillActive
       elsif unqueryable_private_source?(source_uri)
         private_source_versions(gem_name: gem_name, source_uri: source_uri)
       else
-        Gems.versions(gem_name)
+        RubygemsClient.versions(gem_name)
       end
-    rescue Gems::NotFound
-      []
-    # Gems::GemError is the `gems` library's catch-all for any non-success,
-    # non-404 response -- crucially a 429 rate-limit or a 5xx. Left unrescued it
-    # escapes to the per-gem rescue in #call and strips the gem of ALL its signals
-    # (not just versions), blaming a generic "error occurred". The poison-pill
-    # enrichment adds extra version lookups that make a 429 likelier, so a
-    # best-effort feature must not be able to degrade an unrelated gem's core data:
-    # degrade to "no versions known" here, exactly like Gems::NotFound.
-    rescue Gems::GemError, *HttpHelper::TRANSPORT_ERRORS => e
-      warn("warning: rubygems.org versions lookup failed for #{gem_name}: #{e.class} (#{e.message})")
-      []
     end
 
     def github_packages_uri?(uri)
@@ -433,7 +451,7 @@ module StillActive
 
     # A rubygems-type source that isn't public rubygems.org and that we have no
     # client for (Gemfury, Gemstash, geminabox, a private mirror). We must NOT
-    # fall through to Gems.versions, which always hits public rubygems.org: that
+    # fall through to RubygemsClient.versions, which always hits public rubygems.org: that
     # would silently report a public name-collision's data, or blanks, as if it
     # were the private gem's. github_packages/artifactory are handled above, so
     # anything left with a non-rubygems.org host is unqueryable. Refs #43.
@@ -501,7 +519,8 @@ module StillActive
       repo.merge(project_id: deps_dev_project_id(repo))
     end
 
-    # deps.dev scorecards index github.com and gitlab.com only. A Forgejo/Codeberg
+    # Of the forges Repository recognizes, deps.dev indexes github.com and
+    # gitlab.com (DepsDevClient::PROJECT_HOSTS). A Forgejo/Codeberg
     # repo has no deps.dev project, so leave its project_id nil rather than minting
     # a bogus github.com/owner/name that would fetch the wrong (or no) scorecard.
     DEPS_DEV_HOST_BY_SOURCE = {github: "github.com", gitlab: "gitlab.com"}.freeze
@@ -522,7 +541,7 @@ module StillActive
     end
 
     # Locally-installed gem metadata and the gem's own version payload are
-    # source-accurate. This public rubygems.org Gems.info lookup is the last
+    # source-accurate. This public rubygems.org info lookup is the last
     # resort, and is skipped for an unqueryable private source: otherwise a
     # public name-collision's repo/archived/last-commit data would stand in for
     # the private gem, the same substitution #43 prevents for versions.
@@ -549,46 +568,38 @@ module StillActive
     end
 
     def rubygems_gem_repository_url(gem_name:)
-      info = Gems.info(gem_name)
+      info = RubygemsClient.info(gem_name)
       return [] if info.nil?
 
       [
         info["homepage_uri"],
         info["source_code_uri"]
       ].compact.uniq
-    rescue Gems::NotFound
-      []
     end
 
-    # The repo-signal provider for a source, or nil for an unhandled host. Every
-    # provider answers archived/last_commit_date; richer signals (e.g.
-    # commits_since_release) are duck-typed and dispatched by respond_to?, so a
-    # provider opts into them by defining the method, with no base class and no
-    # assumption that every source supports every signal.
-    def provider_for(source)
-      case source
-      # Without a GitHub token, the live API caps at 60 req/hr -- unusable past a
-      # handful of gems. Fall back to ecosyste.ms (5000 anonymous) so a large
-      # Gemfile still resolves. With a token, the live API stays primary (freshest,
-      # and it carries commits_since_release, which ecosyste.ms doesn't).
-      when :github then StillActive.config.github_oauth_token ? GithubClient : EcosystemsClient
-      when :gitlab then GitlabClient
-      when :forgejo then ForgejoClient
-      end
+    # archived + last-activity date, and which service answered, from
+    # RepositorySignals. `public:` says the gem came from a public registry, so
+    # its repository's name may go to ecosyste.ms.
+    def repo_signals(source:, repository_owner:, repository_name:, public: false)
+      host = Repository::SOURCE_BY_HOST.key(source)
+      RepositorySignals.for(host: host, owner: repository_owner, name: repository_name, public: public)
+    end
+
+    # rubygems.org, as opposed to a private registry the lockfile names.
+    def public_source?(source_uri)
+      !(github_packages_uri?(source_uri) || ArtifactoryClient.artifactory_uri?(source_uri) || unqueryable_private_source?(source_uri))
     end
 
-    # One provider call yields both archived and the last-activity date (the
-    # repo object carries both), so a gem's repo signals cost a single request
-    # instead of two. Returns {} for an unhandled host.
-    def repo_signals(source:, repository_owner:, repository_name:)
-      provider_for(source)&.repo_signals(owner: repository_owner, name: repository_name) || {}
+    def repository_availability(signals)
+      {repository_check: signals[:check], **(signals[:source] ? {repository_source: signals[:source]} : {})}
     end
 
+    # GitHub's compare endpoint, and only with a token: it's a per-gem call, and
+    # 60 anonymous requests an hour would starve the repository lookups.
     def unreleased_commits(source:, repository_owner:, repository_name:, version:)
-      provider = provider_for(source)
-      return unless provider.respond_to?(:commits_since_release)
+      return unless source == :github && StillActive.config.github_oauth_token
 
-      provider.commits_since_release(owner: repository_owner, name: repository_name, version: version)
+      GithubClient.commits_since_release(owner: repository_owner, name: repository_name, version: version)
     end
   end
 end

data/lib/still_active.rb

@@ -4,6 +4,7 @@ require_relative "still_active/version"
 require_relative "still_active/errors"
 require_relative "still_active/config"
 require_relative "still_active/sbom_reader"
+require_relative "still_active/source_health"
 require_relative "still_active/ecosystem_lens"
 require_relative "still_active/sbom_workflow"
 require_relative "still_active/cli"

data/still_active.gemspec

@@ -55,14 +55,13 @@ Gem::Specification.new do |spec|
   # carry an artificial floor.
   spec.add_runtime_dependency("async", ">= 2.2")
   spec.add_runtime_dependency("bundler", ">= 2.0")
-  # cvss-suite (CVSS v4.0 base-score from an OSV vector, for the CVSS-4-only advisory
-  # deps.dev can't score) is an OPTIONAL dependency, NOT declared here: it exact-pins
-  # bundler and caps bigdecimal, the poison-pill pattern still_active flags, so we
-  # won't force it on users or trip our own audit. CvssHelper soft-requires it; absent,
-  # the OSV/GHSA severity label still carries gating + level and the number is skipped.
-  # Install cvss-suite (or run the distribution that bundles it) to light up the number.
+  # CVSS base score from an OSV vector, for the CVSS-4-only advisory deps.dev can't
+  # score. 5.0 is the floor because it is the first release without the poison-pill
+  # constraints (a Ruby 2.6 floor, a bigdecimal cap, an exact bundler pin) that kept
+  # it optional through 3.0; 5.0 also adds base_score on CVSS 4.0, which is the API
+  # CvssHelper reads.
+  spec.add_runtime_dependency("cvss-suite", ">= 5.0")
   spec.add_runtime_dependency("faraday-retry")
-  spec.add_runtime_dependency("gems")
   spec.add_runtime_dependency("octokit")
   # Spec-compliant package-URL parsing for SBOM ingestion (decodes npm scopes,
   # maven group:artifact, qualifiers). 0.1 is the verified floor; the official

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: still_active
 version: !ruby/object:Gem::Version
-  version: 3.0.0
+  version: 3.2.0
 platform: ruby
 authors:
 - Sean Floyd
@@ -38,21 +38,21 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '2.0'
 - !ruby/object:Gem::Dependency
-  name: faraday-retry
+  name: cvss-suite
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0'
+        version: '5.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0'
+        version: '5.0'
 - !ruby/object:Gem::Dependency
-  name: gems
+  name: faraday-retry
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
@@ -135,6 +135,7 @@ files:
 - bin/still_active
 - lib/still_active.rb
 - lib/still_active/artifactory_client.rb
+- lib/still_active/assessment.rb
 - lib/still_active/ceiling_reconciler.rb
 - lib/still_active/cli.rb
 - lib/still_active/compact_index_client.rb
@@ -149,6 +150,7 @@ files:
 - lib/still_active/forgejo_client.rb
 - lib/still_active/github_client.rb
 - lib/still_active/gitlab_client.rb
+- lib/still_active/go_toolchain.rb
 - lib/still_active/helpers/activity_helper.rb
 - lib/still_active/helpers/alternatives_helper.rb
 - lib/still_active/helpers/ansi_helper.rb
@@ -163,6 +165,7 @@ files:
 - lib/still_active/helpers/dotnet_helper.rb
 - lib/still_active/helpers/emoji_helper.rb
 - lib/still_active/helpers/endoflife_helper.rb
+- lib/still_active/helpers/http_cache.rb
 - lib/still_active/helpers/http_helper.rb
 - lib/still_active/helpers/libyear_helper.rb
 - lib/still_active/helpers/lockfile_dependency_parser.rb
@@ -171,6 +174,7 @@ files:
 - lib/still_active/helpers/markdown_helper.rb
 - lib/still_active/helpers/pep440_helper.rb
 - lib/still_active/helpers/python_helper.rb
+- lib/still_active/helpers/repository_check.rb
 - lib/still_active/helpers/ruby_advisory_db.rb
 - lib/still_active/helpers/ruby_helper.rb
 - lib/still_active/helpers/runtime_ceiling_helper.rb
@@ -187,10 +191,13 @@ files:
 - lib/still_active/poison_security_correlator.rb
 - lib/still_active/pypi_client.rb
 - lib/still_active/repository.rb
+- lib/still_active/repository_signals.rb
+- lib/still_active/rubygems_client.rb
 - lib/still_active/sarif/rules.rb
 - lib/still_active/sbom_reader.rb
 - lib/still_active/sbom_workflow.rb
 - lib/still_active/source_credentials.rb
+- lib/still_active/source_health.rb
 - lib/still_active/suppressions.rb
 - lib/still_active/version.rb
 - lib/still_active/workflow.rb
@@ -219,7 +226,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: 3.2.3
 requirements: []
-rubygems_version: 4.0.16
+rubygems_version: 4.0.20
 specification_version: 4
 summary: Audit your dependencies for maintenance health, abandonment, and below-the-fix
   vulnerabilities. Ruby gems natively; npm, PyPI, Cargo, Go, Maven, and NuGet via