still_active 3.1.0 → 3.2.0

data/lib/still_active/helpers/markdown_helper.rb

@@ -294,7 +294,7 @@ module StillActive
 
     def format_vulns(data)
       count = data[:vulnerability_count]
-      return StillActive.config.unsure_emoji if count.nil?
+      return StillActive.config.unsure_emoji if count.nil? || (count.zero? && data[:vulnerabilities_checked] == false)
       return StillActive.config.success_emoji if count.zero?
 
       vulnerabilities = data[:vulnerabilities] || []

data/lib/still_active/helpers/repository_check.rb

@@ -0,0 +1,33 @@
+# frozen_string_literal: true
+
+require_relative "../assessment"
+
+module StillActive
+  # Reading a dependency's repository_check the same way everywhere: "answered",
+  # "failed" or "unknowable" (see RepositorySignals), or "not_applicable" for the
+  # Go toolchain, which is the language, not a package with a repository. A hash
+  # without the key never had its repository looked at, which is not an answer.
+  module RepositoryCheck
+    extend self
+
+    VALUES = Assessment::REPOSITORY_CHECKS
+    SETTLED = ["answered", "not_applicable"].freeze
+
+    def unanswered?(data) = !SETTLED.include?(data[:repository_check])
+
+    # A missing or unrecognised check means the repository step never ran (an
+    # assessment that raised part-way), so it counts as failed, as in tally.
+    def failed?(data) = !VALUES.include?(data[:repository_check]) || data[:repository_check] == "failed"
+
+    # {answered:, failed:, unknowable:} across dependencies.
+    def tally(dependencies)
+      counts = VALUES.to_h { [_1.to_sym, 0] }
+      dependencies.each { counts[(data_check(_1) || "failed").to_sym] += 1 }
+      counts
+    end
+
+    private
+
+    def data_check(data) = VALUES.include?(data[:repository_check]) ? data[:repository_check] : nil
+  end
+end

data/lib/still_active/helpers/status_helper.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require_relative "activity_helper"
+require_relative "repository_check"
 
 module StillActive
   # Collapses a gem's several maintenance signals into one categorical verdict,
@@ -28,6 +29,16 @@ module StillActive
     # Returns :dead, :vulnerable, :deprecated, :archived, :legacy, :stale, :ok,
     # or :unknown.
     def gem_status(gem_data)
+      status = lifecycle_status(gem_data)
+      # Advisories a source couldn't answer for are not "none", and a repository
+      # no source could read isn't "not archived", so a verdict that claims clean
+      # (:ok, and :legacy's "dormant but clean") reads :unknown. Verdicts that
+      # found a problem stand, since it's true either way.
+      unanswered = gem_data[:vulnerabilities_checked] == false || RepositoryCheck.unanswered?(gem_data)
+      ([:ok, :legacy].include?(status) && unanswered) ? :unknown : status
+    end
+
+    def lifecycle_status(gem_data)
       vulnerable = gem_data[:vulnerability_count].to_i.positive?
 
       # A pinned version the registry can't resolve (yanked, typo, or nonexistent)

data/lib/still_active/helpers/summary_helper.rb

@@ -2,6 +2,7 @@
 
 require_relative "activity_helper"
 require_relative "status_helper"
+require_relative "repository_check"
 
 module StillActive
   # Builds the JSON output's summary{} digest: the headline posture of the audit
@@ -16,7 +17,8 @@ module StillActive
 
     def summarize(result, ruby_info: nil)
       activity = ACTIVITY_LEVELS.to_h { |level| [level, 0] }
-      archived = up_to_date = outdated = vulnerable_gems = vulnerabilities = direct = 0
+      archived = up_to_date = outdated = vulnerable_gems = vulnerabilities = unchecked = direct = 0
+      repository_checks = RepositoryCheck.tally(result.values)
 
       result.each_value do |data|
         activity[ActivityHelper.activity_level(data)] += 1
@@ -24,6 +26,7 @@ module StillActive
         archived += 1 if data[:archived]
         up_to_date += 1 if data[:up_to_date] == true
         outdated += 1 if data[:up_to_date] == false
+        unchecked += 1 if data[:vulnerabilities_checked] == false
         count = data[:vulnerability_count].to_i
         next unless count.positive?
 
@@ -41,6 +44,8 @@ module StillActive
         outdated: outdated,
         vulnerable_gems: vulnerable_gems,
         vulnerabilities: vulnerabilities,
+        vulnerabilities_unchecked: unchecked,
+        repository_checks: repository_checks,
         # The single worst per-gem verdict (plus EOL Ruby), so a consumer reads
         # one project-level posture without scanning every gem's status.
         status: StatusHelper.project_status(result, ruby_info: ruby_info)

data/lib/still_active/helpers/terminal_helper.rb

@@ -8,6 +8,7 @@ require_relative "summary_helper"
 require_relative "libyear_helper"
 require_relative "version_helper"
 require_relative "vulnerability_helper"
+require_relative "repository_check"
 
 module StillActive
   module TerminalHelper
@@ -90,7 +91,8 @@ module StillActive
     def format_activity(data)
       case ActivityHelper.activity_level(data)
       when :archived then AnsiHelper.red("archived")
-      when :ok then AnsiHelper.green("ok")
+      # Recent releases, but the repository couldn't be read: it may be archived.
+      when :ok then RepositoryCheck.unanswered?(data) ? AnsiHelper.yellow("?") : AnsiHelper.green("ok")
       when :stale then AnsiHelper.yellow("stale")
       when :critical then AnsiHelper.red("critical")
       when :unknown then AnsiHelper.dim("-")
@@ -113,6 +115,8 @@ module StillActive
     def format_vulns(data)
       count = data[:vulnerability_count]
       return AnsiHelper.dim("-") if count.nil?
+      # No source answered, so a 0 here would read as clean.
+      return AnsiHelper.yellow("?") if count.zero? && data[:vulnerabilities_checked] == false
       return AnsiHelper.green("0") if count.zero?
 
       severity = VulnerabilityHelper.highest_severity(data[:vulnerabilities])
@@ -353,6 +357,10 @@ module StillActive
       activity << ", #{archived} archived" if archived > 0
       parts << activity
       parts << "#{summary[:vulnerabilities]} vulnerabilities"
+      parts.last << " (#{summary[:vulnerabilities_unchecked]} unchecked)" if summary[:vulnerabilities_unchecked] > 0
+      checks = summary[:repository_checks]
+      unchecked = checks[:failed] + checks[:unknowable]
+      parts << "#{unchecked} #{(unchecked == 1) ? "repository" : "repositories"} unchecked#{" (#{checks[:failed]} failed)" if checks[:failed] > 0}" if unchecked > 0
       poison_tiers = result.each_value.select { |data| data[:poison] }.map { |data| data[:poison_severity] }
       poison_part = tier_summary_part(poison_tiers, "#{poison_tiers.size} poison-#{(poison_tiers.size == 1) ? "pill" : "pills"}")
       parts << poison_part if poison_part

data/lib/still_active/options.rb

@@ -21,6 +21,7 @@ module StillActive
         add_output_options(opts)
         add_token_options(opts)
         add_parallelism_options(opts)
+        add_cache_option(opts)
         add_range_options(opts)
         add_exit_options(opts)
         add_emoji_options(opts)
@@ -120,6 +121,12 @@ module StillActive
       end
     end
 
+    def add_cache_option(opts)
+      opts.on("--no-cache", "Skip the on-disk cache of public sources' answers (advisories are kept at most an hour)") do
+        StillActive.config { |config| config.http_cache = false }
+      end
+    end
+
     def add_parallelism_options(opts)
       opts.on("--simultaneous-requests=QTY", Integer, "Number of simultaneous requests made") do |value|
         StillActive.config { |config| config.parallelism = value }

data/lib/still_active/osv_client.rb

@@ -81,6 +81,45 @@ module StillActive
       body = HttpHelper.get_json(BASE_URI, "/v1/vulns/#{encode(advisory_id)}")
       return unless body.is_a?(Hash)
 
+      parse_record(body)
+    end
+
+    # Every advisory OSV lists for this exact version, carrying the same OSV fields
+    # enrich adds, or nil when OSV could not answer completely. This is the discovery
+    # source for a package deps.dev can't serve per version (the Go toolchain), so
+    # nil must stay distinct from [] here too: the caller reads nil as "unknown",
+    # never as clean. The query returns whole records, so nothing is fetched per id.
+    def advisories(ecosystem:, name:, version:)
+      osv_ecosystem = ECOSYSTEM_NAMES[ecosystem]
+      return if osv_ecosystem.nil?
+
+      query = {version: version, package: {name: name, ecosystem: osv_ecosystem}}
+      body = HttpHelper.post_json(BASE_URI, "/v1/query", body: JSON.generate(query))
+      return unless body.is_a?(Hash) && identifiers_from(body)
+
+      Array(body["vulns"]).map do |vuln|
+        record = parse_record(vuln)
+        {
+          id: vuln["id"],
+          aliases: Array(vuln["aliases"]).grep(String),
+          title: vuln["summary"],
+          url: "https://osv.dev/vulnerability/#{vuln["id"]}",
+          source: "osv",
+          osv_severity: record[:severity_label],
+          osv_cvss_score: record[:cvss_score],
+          cvss_version: record[:cvss_version],
+          cvss_vector: record[:cvss_vector],
+          fixed_versions: fixed_versions(record, ecosystem: ecosystem, name: name)
+        }
+      end
+    rescue => e
+      warn("warning: OSV advisory lookup for #{name}@#{version} failed: #{e.class} (#{e.message})")
+      nil
+    end
+
+    private
+
+    def parse_record(body)
       cvss = best_cvss(body)
       {
         # OSV's own identity for the advisory, unioned into the match against a query
@@ -96,8 +135,6 @@ module StillActive
       }
     end
 
-    private
-
     # Applies one OSV record to one advisory, in place. Returns OSV's identifiers for
     # the advisory when it is eligible for the version confirmation below (only OSV
     # data may overrule OSV-derived data), or nil when it is not and must be kept

data/lib/still_active/repository_signals.rb

@@ -0,0 +1,113 @@
+# frozen_string_literal: true
+
+require_relative "errors"
+require_relative "github_client"
+require_relative "gitlab_client"
+require_relative "forgejo_client"
+require_relative "ecosystems_client"
+
+module StillActive
+  # One answer to "is this repository archived, and when was it last pushed?"
+  # for both audit paths, from whichever service can give it. The clients only
+  # report what their service said; which services to ask, in what order, and
+  # when to stop, is decided here once.
+  #
+  # Returns a hash whose :check says what came of it, always one of:
+  #   "answered"    a service said; :archived, :last_commit_date and :source
+  #                 (which service) come with it
+  #   "failed"      a service couldn't answer (a rate limit, an error, a refused
+  #                 token) and none other said; a rerun may help, so the activity
+  #                 gates fail closed on it
+  #   "unknowable"  no service can say: the host has no archived state we can
+  #                 read, there's no repository to ask about, or every service
+  #                 asked didn't know it (ecosyste.ms hasn't crawled it, the forge
+  #                 404s a private or deleted repository). A rerun won't change
+  #                 it, so it reads unknown without failing the gates.
+  #
+  # "Don't know" is never an answer: a 404 or an answer without the archived
+  # state moves on to the next service.
+  #
+  # A GitHub repository is asked of GitHub and of ecosyste.ms, which mirrors the
+  # same two fields: GitHub first with a token (freshest, 5000/hr), ecosyste.ms
+  # first without one (GitHub allows 60 anonymous requests an hour), each the
+  # other's fallback. ecosyste.ms sees the repository's name, so it is asked only
+  # when the dependency came from a public registry (`public:`), which is the
+  # privacy guard; after GitHub refused the token outright (401/403: a bad token,
+  # SSO, a suspended account) the chain also stops rather than guess.
+  module RepositorySignals
+    extend self
+
+    # A service in a chain: its label for `source`, and how to ask it.
+    Service = Data.define(:label, :ask)
+
+    def for(host:, owner:, name:, public:)
+      services = (host && owner && name) ? chain(host.downcase, public) : []
+      return {check: "unknowable"} if services.empty?
+
+      failed = false
+      services.each do |service|
+        signals = service.ask.call(owner, name)
+        next unless signals.key?(:archived)
+
+        return signals.merge(source: service.label, check: "answered")
+      rescue RepoAccessDenied
+        failed = true
+        break
+      rescue RepoSignalsUnavailable
+        failed = true
+      end
+
+      if failed
+        warn("warning: #{owner}/#{name}: no repository source could answer; archived status unknown")
+        {check: "failed"}
+      else
+        {check: "unknowable"}
+      end
+    end
+
+    # For a deps.dev project id (host/owner/name, host/group/.../name on
+    # GitLab). gopkg.in is a redirector with a fixed mapping onto GitHub
+    # (gopkg.in/pkg.v3 is github.com/go-pkg/pkg, gopkg.in/user/pkg.v3 is
+    # github.com/user/pkg), so it is asked about as that GitHub repository.
+    def for_project(project_id, public:)
+      host, *path = project_id.to_s.split("/")
+      host, path = gopkg_in(path) if host&.downcase == "gopkg.in"
+      return {check: "unknowable"} if host.nil? || path.size < 2
+
+      self.for(host: host, owner: path[0..-2].join("/"), name: path.last, public: public)
+    end
+
+    private
+
+    GOPKG_VERSIONED = /\A(?<name>.+)\.v\d+(?:-unstable)?\z/
+
+    # The version suffix marks the module: gopkg.in/pkg.vN[/sub...] or
+    # gopkg.in/user/pkg.vN[/sub...]; anything after it is a subpackage.
+    def gopkg_in(path)
+      if (match = path[0]&.match(GOPKG_VERSIONED))
+        ["github.com", ["go-#{match[:name]}", match[:name]]]
+      elsif (match = path[1]&.match(GOPKG_VERSIONED))
+        ["github.com", [path[0], match[:name]]]
+      else
+        [nil, []]
+      end
+    end
+
+    def chain(host, public)
+      case host
+      when "github.com" then github_chain(public)
+      when "gitlab.com" then [Service.new("gitlab", ->(owner, name) { GitlabClient.repo_signals(owner: owner, name: name) })]
+      when "codeberg.org" then [Service.new("codeberg", ->(owner, name) { ForgejoClient.repo_signals(owner: owner, name: name, host: host) })]
+      else []
+      end
+    end
+
+    def github_chain(public)
+      github = Service.new("github", ->(owner, name) { GithubClient.repo_signals(owner: owner, name: name) })
+      mirror = Service.new("ecosyste.ms", ->(owner, name) { EcosystemsClient.repo_signals(owner: owner, name: name) })
+      return [github] unless public
+
+      StillActive.config.github_oauth_token ? [github, mirror] : [mirror, github]
+    end
+  end
+end

data/lib/still_active/rubygems_client.rb

@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+
+require_relative "helpers/http_helper"
+
+module StillActive
+  # The RubyGems JSON API this tool reads, through HttpHelper so it gets the same
+  # timeouts, body cap and redirect rules as every other source. rubygems.org by
+  # default; Artifactory serves the same API under a repo path, with its own
+  # credentials, via `base:` and `headers:`.
+  module RubygemsClient
+    extend self
+
+    BASE_URI = URI("https://rubygems.org/")
+
+    # Every published version, newest first, as rubygems.org serves them; [] when
+    # the gem doesn't exist or the lookup failed (HttpHelper has warned).
+    def versions(gem_name, base: BASE_URI, headers: {})
+      body = HttpHelper.get_json(base, "#{base.path.chomp("/")}/api/v1/versions/#{encode(gem_name)}.json", headers: headers)
+      body.is_a?(Array) ? body : []
+    end
+
+    # The gem's metadata (homepage_uri, source_code_uri, downloads, ...), or nil.
+    def info(gem_name)
+      body = HttpHelper.get_json(BASE_URI, "/api/v1/gems/#{encode(gem_name)}.json")
+      body if body.is_a?(Hash)
+    end
+
+    private
+
+    def encode(value)
+      URI.encode_www_form_component(value.to_s)
+    end
+  end
+end

data/lib/still_active/sarif/rules.rb

@@ -180,7 +180,7 @@ module StillActive
           tags: ["security", "supply-chain", "maintenance", "external/cwe/cwe-1104"],
           neutral: {
             short: "Package is deprecated by its maintainer",
-            full: "The maintainer has marked this package deprecated in its registry. Unlike every other maintenance signal here, this is not inferred from dates or repository state: the person who publishes it has said to stop using it, and the deprecation message often names the replacement. A deprecated package can still look healthy by release recency, so this fires independently of the activity signals.",
+            full: "The maintainer has marked this package deprecated in its registry. Unlike every other maintenance signal here, this is not inferred from dates or repository state: the person who publishes it has said to stop using it, and the deprecation message often names the replacement. A deprecated package can still look healthy by release recency, so this fires independently of the activity signals. A language runtime counts too: when the Go team ends a Go release line, the toolchain on it is reported here.",
             help_text: "Read the deprecation message, which usually names the successor, and migrate to it. There will be no further fixes, including security patches."
           }
         }

data/lib/still_active/sbom_workflow.rb

@@ -1,6 +1,8 @@
 # frozen_string_literal: true
 
 require_relative "ecosystem_lens"
+require_relative "assessment"
+require_relative "source_health"
 require_relative "ceiling_reconciler"
 require_relative "poison_security_correlator"
 require_relative "helpers/python_helper"
@@ -30,7 +32,9 @@ module StillActive
     # rate-limited run read "all clear" while silently skipping deps.
     Outcome = Data.define(:assessed, :failures)
 
-    def call(sbom_result, &on_progress)
+    # `health` is the run's SourceHealth report: in an ecosystem it distrusts,
+    # deps.dev's advisories count as unchecked. The Go toolchain's come from OSV.
+    def call(sbom_result, health: SourceHealth::Report.healthy, &on_progress)
       dependencies = sbom_result.dependencies
       Async do
         # The language-runtime support windows, fetched once for the whole SBOM
@@ -42,6 +46,9 @@ module StillActive
           dotnet: safe_support_window(".NET") { DotnetHelper.supported_dotnet_range },
           dotnetfx: safe_support_window(".NET Framework") { DotnetHelper.supported_dotnetfx_range }
         }
+        # Every version record in one batch request, rather than one GET each; the
+        # Go toolchain's come from OSV and endoflife.date instead.
+        DepsDevClient.prefetch_versions(dependencies.filter_map { [_1[:ecosystem], _1[:name], _1[:version]] unless GoToolchain.toolchain?(_1[:ecosystem], _1[:name]) })
         barrier = Async::Barrier.new
         semaphore = Async::Semaphore.new(StillActive.config.parallelism, parent: barrier)
         result = {}
@@ -78,6 +85,11 @@ module StillActive
           end
         end
         barrier.wait
+        result.each_value do |data|
+          next if health.deps_dev_trusted?(data[:ecosystem]) || GoToolchain.toolchain?(data[:ecosystem], data[:name])
+
+          data[:vulnerabilities_checked] = false
+        end
         # Whole-tree correlation once every package's signals are in: a Python
         # ceiling's "upgrade to lift it" must not contradict a poison finding that
         # caps the same package below that upgrade (same guarantee as the native path).
@@ -87,10 +99,12 @@ module StillActive
         PoisonSecurityCorrelator.correlate(result)
         # Stable, diffable order regardless of async completion order.
         Outcome.new(
-          assessed: result.sort_by { |key, _| key }.to_h,
+          assessed: result.sort_by { |key, _| key }.to_h.transform_values { Assessment.from(_1) },
           failures: failures.sort_by { |failure| "#{failure[:ecosystem]}/#{failure[:name]}@#{failure[:version]}" }
         )
       end.wait
+    ensure
+      DepsDevClient.clear_prefetch
     end
 
     private

data/lib/still_active/source_health.rb

@@ -0,0 +1,88 @@
+# frozen_string_literal: true
+
+require "time"
+require_relative "deps_dev_client"
+
+module StillActive
+  # Whether deps.dev is answering in the shape we read and is current, checked once
+  # per run before the fan-out. deps.dev is an alpha API and it is the advisory
+  # source for everything but ruby-advisory-db and the Go toolchain, so when it
+  # isn't healthy its advisories count as unchecked rather than clean.
+  #
+  # Two checks. The advisory canary asks for a package with permanent advisories
+  # and expects them back (a renamed field reads as zero everywhere). The
+  # freshness canary asks, per ecosystem in the audit, for packages that publish
+  # often and expects one of them to have published in the last 30 days: a stalled index
+  # serves stale versions and misses new advisories without any error. Neither
+  # catches one stale package in a live index (deps.dev's Go stdlib was that).
+  module SourceHealth
+    extend self
+
+    # Packages that publish often; an ecosystem is fresh if ANY of its set has a
+    # version published in the window. Chosen by replaying two years of deps.dev
+    # publish dates (2026-09-24): the longest stretch with no version from the
+    # set is 10 days (nuget), 8.7 (npm), 7 (cargo, rubygems), 6.7 (pypi, maven),
+    # 6 (go), so 30 days is a 3x margin. Single canaries weren't enough:
+    # aws-sdk-core went 34 days and golang.org/x/net 35, which would have failed
+    # a healthy index closed. Recheck with each set's publishedAt history.
+    FRESHNESS_CANARIES = {
+      rubygems: ["aws-partitions", "aws-sdk-ec2"],
+      npm: ["next", "@types/node"],
+      pypi: ["boto3", "botocore"],
+      cargo: ["aws-sdk-ec2", "oxc_parser", "swc_core"],
+      go: ["cloud.google.com/go/storage", "github.com/aws/aws-sdk-go-v2/service/s3"],
+      maven: ["software.amazon.awssdk:s3", "software.amazon.awssdk:ec2"],
+      nuget: ["AWSSDK.S3", "AWSSDK.Core"]
+    }.freeze
+    FRESH_WITHIN_SECONDS = 30 * 24 * 60 * 60
+
+    Report = Data.define(:advisory_schema_ok, :stale_ecosystems) do
+      def self.healthy = new(advisory_schema_ok: true, stale_ecosystems: [])
+
+      # Whether deps.dev's advisories for this ecosystem count as an answer.
+      def deps_dev_trusted?(ecosystem)
+        advisory_schema_ok && !stale_ecosystems.include?(ecosystem)
+      end
+
+      def degraded? = !advisory_schema_ok || !stale_ecosystems.empty?
+
+      def as_json
+        {
+          status: degraded? ? "degraded" : "ok",
+          deps_dev_advisories: advisory_schema_ok ? "ok" : "failed",
+          deps_dev_stale_ecosystems: stale_ecosystems.map(&:to_s)
+        }
+      end
+
+      def warnings
+        lines = []
+        lines << "deps.dev's advisory check failed (its `advisoryKeys` field may have changed, or the API is unreachable); its advisories count as unchecked unless another source answers for them (ruby-advisory-db, OSV for the Go toolchain)" unless advisory_schema_ok
+        stale_ecosystems.each do |ecosystem|
+          lines << "deps.dev's #{ecosystem} index has nothing published by #{FRESHNESS_CANARIES[ecosystem].join(", ")} in 30 days (or couldn't be read), so it looks stale; its #{ecosystem} advisories count as unchecked unless another source answers for them, and its latest versions may be behind"
+        end
+        lines
+      end
+    end
+
+    def check(ecosystems:, now: Time.now)
+      Report.new(
+        advisory_schema_ok: DepsDevClient.advisory_schema_ok?,
+        stale_ecosystems: ecosystems.uniq.select { FRESHNESS_CANARIES.key?(_1) && !fresh?(_1, now) }
+      )
+    end
+
+    private
+
+    # Fresh when any canary has a version published in the window. One that can't
+    # be read (after the client's retry) just doesn't count; if none can, the check
+    # can't confirm freshness and reads stale.
+    def fresh?(ecosystem, now)
+      FRESHNESS_CANARIES[ecosystem].any? do |name|
+        date = DepsDevClient.newest_publish_date(name: name, system: ecosystem)
+        !date.nil? && now - Time.parse(date) < FRESH_WITHIN_SECONDS
+      rescue HttpHelper::Unavailable, ArgumentError, TypeError
+        false
+      end
+    end
+  end
+end

data/lib/still_active/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module StillActive
-  VERSION = "3.1.0"
+  VERSION = "3.2.0"
 end