still_active 3.0.0.rc5 → 3.0.0.rc6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 23f5514e3d64b78d82b0812eece16e13325045841fdd0b253acff4f7c5e31dae
-  data.tar.gz: b9d8907b6699755744639cc00e31135cf45991416c222990dc79247ae4c2d88f
+  metadata.gz: 56cc5a97641e59d9c11683f736609c52de9818aa90c8eeebec4c64909cbc1981
+  data.tar.gz: c50ae5f85c0e258f0a3620159c05c4aaf131e9c25556ed940494d1fd90b829db
 SHA512:
-  metadata.gz: 4d571b1a3788960da4f6ae9fb04466c00ab6c3c6dcd1bd2051b4d6244aaf8e14248aeb3acc1c4d2179db33d8d18f98e320182ab0cb15635290e1be795c5509f9
-  data.tar.gz: 7071c08ca0bb94ff85edee290d6d55d47247093863f5599a8c56c2899871ef80e424daac09142e2c9978e0efbd5020d493c88abadc28c5a3bd5b303ffcea6003
+  metadata.gz: a067ca8d8e55a0d796efd76d88f95e1081ab520cbd6bd7496aec1791d2bf85e621a82edaca2bb458a758c82a04acdc9c4e6e4f2c2dd3456adf61386cec41652a
+  data.tar.gz: bb99f7070a1c9c0c938df5deb1573ea400f608e4cf9a680cb06879c873a67589fcd3b2fda0a33d5cee14d8191515451bff37c6c0b72a6341a318919b9b3c80f1

data/CHANGELOG.md

@@ -34,6 +34,7 @@ The new `--fail-if-poison[=TIER]` and `--fail-if-language-ceiling[=TIER]` gates
 
 ### Fixed
 
+- **A patched version is no longer reported vulnerable while an advisory's backport fixes are still propagating.** deps.dev's per-version `advisoryKeys`, the discovery source for every cross-ecosystem advisory (and the second source on the native Ruby path), mirrors OSV/GHSA data with an ingestion lag. Advisories are routinely *amended* after publication: a CVE lands with a fix on the current release line, maintainers backport to the older supported lines, and the advisory is then amended to carry those branch ranges. Until deps.dev re-ingests, it keeps serving the pre-amendment record, whose broader range still covers versions the amendment has since marked patched. Live receipt: `GHSA-mh99-v99m-4gvg` was published 2026-07-24 as a single `introduced 0 / fixed 5.0.8` range and amended 2026-07-31 to carry the 1.1.17, 2.1.3 and 3.0.3 branches; hours after the amendment deps.dev still answered from the old record, so `--sbom` reported the fully patched `brace-expansion` 1.1.18 and 2.1.4 as `status: "vulnerable"` where `npm audit` correctly reported none. still_active now confirms each deps.dev-discovered advisory against OSV's own `/v1/query`, deps.dev's upstream, which applies the declared ranges per ecosystem and reflects an amendment immediately, and drops the ones OSV says do not apply to the audited version. The window reopens with every backported fix, so this is a standing correction rather than a workaround for one stale record. A dropped advisory is named on stderr, so the one path that can turn a red run green always leaves a trace. (It is lag, not a parsing defect on deps.dev's part: 341 multi-branch advisories across npm/rubygems/pypi/cargo were compared against OSV over 589 version checks, and every one agreed.) Dropping a finding is the one direction this tool must never get wrong, so it needs positive contradiction on every count: the advisory came from deps.dev alone (a ruby-advisory-db verdict is never overruled, it matches versions itself and is the Ruby authority), OSV served a record for it that names the package under that exact ecosystem and spelling, and the query for that exact version succeeded without listing it. A failed query, an unmapped ecosystem, a name OSV spells differently, a record holding no version data for the package, or an answer that isn't readable end to end all keep the advisory. That last one matters more than it sounds: OSV's genuine all-clear is a bare `{}` with no positive marker of its own, and OSV paginates once a query exceeds 20 seconds (a latency trigger, so it can land on any package under load), so a truncated page is treated as "we don't know", never as "clean". Costs one request per advisory-bearing package.
 - **A private-source gem is no longer linked to the public rubygems.org page.** `ruby_gems_url` was set to `rubygems.org/gems/<name>` for any gem with versions, including one resolving from a private source, where that URL is a public name collision (for `sidekiq-pro`, the `0.0.3` squat-warning decoy) rather than the gem the user installs. It is now set only for a gem that actually lives on public rubygems.org, the same #43 guard the repository-URL substitution already applies.
 - **An Artifactory-sourced gem is no longer reported `(YANKED)` when its real host is a legacy private registry.** Artifactory's `/api/v1/versions/<gem>.json` merges metadata from a virtual repo's member remotes; when a member (a legacy host like Contribsys) can't answer it, the merge returns only whatever rubygems.org holds for the name, which for `sidekiq-pro` is a `0.0.3` squat-warning placeholder. still_active read that endpoint first, so the installed version was absent from the list and looked yanked. It now reads the RubyGems compact index (`/info/<gem>`, what Bundler resolves through) instead, listing exactly the versions the repo can resolve, with the versions API demoted to dating those versions and AQL kept only as a last resort for hosts serving no compact index (and no longer presenting its cache timestamp as a release date). A side benefit: the compact index's per-version Ruby requirement and dependency constraints let the runtime-ceiling and poison-pill checks work on Artifactory sources for the first time.
 - **SARIF `tool.driver` version fields are populated and spec-correct.** `version` was null, so a consumer reading `tool.driver.version` (rather than `semanticVersion`) saw nothing, and `semanticVersion` carried the RubyGems version verbatim (`3.0.0.rc4`), which is not valid SemVer 2.0.0 for a prerelease. Now `version` carries the free-form gem version and `semanticVersion` the SemVer form (`3.0.0-rc4`); final releases like `3.0.0` were already valid.

data/lib/still_active/ecosystem_lens.rb

@@ -76,7 +76,9 @@ module StillActive
       vulnerabilities = vulnerabilities_for(info)
       # Enrich with OSV: a real GHSA severity label (deps.dev can't score a CVSS-4-only
       # advisory) and the fixed-version ranges the "capped below the fix" signal needs.
-      OsvClient.enrich(vulnerabilities, ecosystem: ecosystem, name: name)
+      # Passing the version also lets OSV confirm the advisory actually applies to it,
+      # correcting deps.dev's lag on an advisory amended with backport fixes.
+      vulnerabilities = OsvClient.enrich(vulnerabilities, ecosystem: ecosystem, name: name, version: version)
       scorecard = DepsDevClient.project_scorecard(project_id: project_id)
       repo = repo_signals(project_id)
 

data/lib/still_active/osv_client.rb

@@ -15,8 +15,13 @@ module StillActive
   # poison cap's ceiling.
   #
   # Enrichment is best-effort: any failure (missing record, transport error, odd
-  # shape) leaves the advisory exactly as deps.dev produced it. It must never drop
-  # an advisory the audit already found, so it only ever ADDS fields.
+  # shape) leaves the advisory exactly as deps.dev produced it.
+  #
+  # OSV is also the ARBITER of whether a deps.dev-discovered advisory really applies
+  # to the audited version (see reject_unaffected), which is the one place this module
+  # removes rather than adds. That direction is the dangerous one -- a wrongly dropped
+  # advisory reads a vulnerable dependency as clean -- so every degrade path here must
+  # resolve to "keep", and only an unambiguous OSV contradiction may drop.
   module OsvClient
     extend self
 
@@ -45,25 +50,24 @@ module StillActive
     TYPE_VERSIONS = {"CVSS_V4" => "4.0", "CVSS_V3" => "3.1", "CVSS_V2" => "2.0"}.freeze
 
     # Enrich each advisory in place with the OSV severity label and the fixed
-    # versions for the audited package. A missing/failed lookup is a no-op on that
-    # advisory (it keeps whatever deps.dev gave it), never a raise.
-    def enrich(advisories, ecosystem:, name:)
-      advisories.each do |advisory|
-        record = detail(advisory_id: advisory[:id])
-        next if record.nil?
-
-        advisory[:osv_severity] = record[:severity_label]
-        advisory[:osv_cvss_score] = record[:cvss_score]
-        advisory[:cvss_version] = record[:cvss_version]
-        advisory[:cvss_vector] = record[:cvss_vector]
-        advisory[:fixed_versions] = fixed_versions(record, ecosystem: ecosystem, name: name)
-      rescue => e
-        # Enrichment is additive and best-effort. An unexpected OSV shape must never
-        # raise out through the workflow's per-gem rescue, which would DROP the whole
-        # gem and read a known-vulnerable dependency as clean. Leave the advisory
-        # exactly as deps.dev produced it.
-        warn("warning: OSV enrichment for #{advisory[:id]} failed: #{e.class} (#{e.message}); leaving advisory unchanged")
+    # versions for the audited package, and return the advisories that survive
+    # version confirmation (see reject_unaffected). A missing/failed lookup is a
+    # no-op on that advisory (it keeps whatever deps.dev gave it), never a raise.
+    def enrich(advisories, ecosystem:, name:, version: nil)
+      # Each eligible advisory is paired with OSV's own identifiers for it, which the
+      # confirmation match needs alongside deps.dev's (see detail).
+      backed = advisories.filter_map do |advisory|
+        osv_ids = apply_record(advisory, ecosystem: ecosystem, name: name)
+        [advisory, osv_ids] if osv_ids
       end
+      reject_unaffected(advisories, backed, ecosystem: ecosystem, name: name, version: version)
+    rescue => e
+      # The confirmation pass runs outside apply_record's per-advisory rescue, and an
+      # escape from here would hit the workflow's per-gem rescue and strip the gem of
+      # ALL its signals -- reading a known-vulnerable dependency as clean, the very
+      # thing this module exists to prevent. Keep every advisory instead.
+      warn("warning: OSV version confirmation for #{name} failed: #{e.class} (#{e.message}); keeping every advisory")
+      advisories
     end
 
     # Fetch and parse one OSV record by advisory id (GHSA/CVE). Returns
@@ -79,6 +83,11 @@ module StillActive
 
       cvss = best_cvss(body)
       {
+        # OSV's own identity for the advisory, unioned into the match against a query
+        # result. Asking for a CVE returns the GHSA record (OSV resolves aliases), so
+        # deps.dev's id alone can miss the id the query answers with, and reading a
+        # listed advisory as absent would drop a real finding.
+        identifiers: [body["id"], *Array(body["aliases"])].grep(String),
         severity_label: body.dig("database_specific", "severity"),
         cvss_score: cvss[:score],
         cvss_version: cvss[:version],
@@ -89,6 +98,158 @@ module StillActive
 
     private
 
+    # Applies one OSV record to one advisory, in place. Returns OSV's identifiers for
+    # the advisory when it is eligible for the version confirmation below (only OSV
+    # data may overrule OSV-derived data), or nil when it is not and must be kept
+    # whatever the query says.
+    def apply_record(advisory, ecosystem:, name:)
+      record = detail(advisory_id: advisory[:id])
+      return if record.nil?
+
+      advisory[:osv_severity] = record[:severity_label]
+      advisory[:osv_cvss_score] = record[:cvss_score]
+      advisory[:cvss_version] = record[:cvss_version]
+      advisory[:cvss_vector] = record[:cvss_vector]
+      advisory[:fixed_versions] = fixed_versions(record, ecosystem: ecosystem, name: name)
+      record[:identifiers] if names_package?(record, ecosystem: ecosystem, name: name)
+    rescue => e
+      # Enrichment is additive and best-effort. An unexpected OSV shape must never
+      # raise out through the workflow's per-gem rescue, which would DROP the whole
+      # gem and read a known-vulnerable dependency as clean. Leave the advisory
+      # exactly as deps.dev produced it, and hold it (nil) rather than risk
+      # dropping it on a record we couldn't read.
+      warn("warning: OSV enrichment for #{advisory[:id]} failed: #{e.class} (#{e.message}); leaving advisory unchanged")
+      nil
+    end
+
+    # Drops the advisories that OSV's own version matching says don't apply to the
+    # audited version. deps.dev is the discovery source, but it MIRRORS OSV/GHSA data
+    # with an ingestion lag, and advisories get AMENDED after publication: the usual
+    # shape is a CVE published with a fix on the current release line, then backports
+    # to the older supported lines, then an amendment adding those branch ranges. Until
+    # deps.dev re-ingests, it keeps serving the pre-amendment record, whose broader
+    # range still covers versions the amendment has since marked patched.
+    #
+    # Receipt (2026-07-31): GHSA-mh99-v99m-4gvg was published 07-24 with a single
+    # range, introduced 0 / fixed 5.0.8. Backports 3.0.3, 2.1.3 and 1.1.17 shipped
+    # 07-27 to 07-29, and the advisory was amended 07-31 19:39Z to carry all four
+    # branches. Hours later deps.dev still answered from the 07-24 record, reporting
+    # the patched 1.1.17/1.1.18/2.1.3/2.1.4/3.0.3 as vulnerable.
+    #
+    # This is lag, NOT a parsing defect: 341 multi-branch advisories across
+    # npm/rubygems/pypi/cargo were compared against OSV over 589 version checks, and
+    # every one agreed. So the correction has to be a live re-check, not a local range
+    # fix. We
+    # ask OSV's /v1/query, deps.dev's own upstream, which applies the declared ranges
+    # under each ecosystem's semantics and reflects an amendment immediately. It also
+    # saves reimplementing cross-ecosystem version ordering.
+    #
+    # The window reopens with every backported fix, so this is structural, not a
+    # one-off worth waiting out.
+    #
+    # Removing a finding is the one direction this tool must never get wrong, so a drop
+    # needs positive contradiction on every count: the advisory came from deps.dev ALONE
+    # (ruby-advisory-db does its own version matching and is the Ruby authority, so its
+    # verdict stands), OSV served a record for it that names this package under this
+    # ecosystem and spelling, and the query for this exact version succeeded without
+    # listing it. Anything unknown -- no version, unmapped ecosystem, failed query --
+    # keeps the advisory.
+    def reject_unaffected(advisories, backed, ecosystem:, name:, version:)
+      candidates = backed.select { |advisory, _osv_ids| advisory[:source] == "deps.dev" }
+      return advisories if candidates.empty? || version.to_s.empty?
+
+      affected = affected_identifiers(ecosystem: ecosystem, name: name, version: version)
+      return advisories if affected.nil?
+
+      unaffected = candidates
+        .reject { |advisory, osv_ids| (identifiers(advisory) | osv_ids).intersect?(affected) }
+        .map(&:first)
+      # Say so when a finding is removed. This is the only path that can turn a red run
+      # green, and a silent drop leaves no way to tell "OSV cleared it" from "the audit
+      # missed it". Matches the per-gem stderr notes the severity gates already emit.
+      unaffected.each { |advisory| warn("still_active: #{name}@#{version} is not affected by #{advisory[:id]} per OSV; deps.dev listed it, dropping") }
+      advisories - unaffected
+    end
+
+    # Every advisory identifier OSV reports as affecting this exact package version,
+    # or nil when the question can't be asked or answered (unmapped ecosystem, failed
+    # request, unusable body). An EMPTY array is a real answer -- "nothing affects this
+    # version" -- and must stay distinct from the nil, which means "we don't know".
+    #
+    # That distinction is the whole safety of the drop, so an empty array is only ever
+    # returned for a body that positively IS an empty OSV result. OSV's genuine all-clear
+    # is a bare `{}` (verified live, and identical to what an unknown package name
+    # returns), which gives a malformed or truncated body no distinguishing marker of
+    # its own: read loosely, every unparseable 200 would fabricate an all-clear.
+    def affected_identifiers(ecosystem:, name:, version:)
+      osv_ecosystem = ECOSYSTEM_NAMES[ecosystem || :rubygems]
+      return if osv_ecosystem.nil?
+
+      query = {version: version, package: {name: name, ecosystem: osv_ecosystem}}
+      body = HttpHelper.post_json(BASE_URI, "/v1/query", body: JSON.generate(query))
+      return unless body.is_a?(Hash)
+
+      identifiers_from(body)
+    rescue => e
+      warn("warning: OSV version confirmation for #{name}@#{version} failed: #{e.class} (#{e.message}); keeping every advisory")
+      nil
+    end
+
+    # The identifiers in one /v1/query body, or nil when the body isn't a complete,
+    # readable answer. A truncated answer is not an answer: OSV paginates past 1000
+    # vulnerabilities OR once a query exceeds 20 seconds, and documents that a page can
+    # carry ONLY a next_page_token. That second trigger is latency, not package size, so
+    # it can land on any package on a slow day; reading it as "nothing affects this
+    # version" would drop real findings at random. We decline to filter rather than
+    # walk the pages, since the pass only ever removes false positives.
+    def identifiers_from(body)
+      return if body["next_page_token"] || body["nextPageToken"]
+      # A bare `{}` is OSV's genuine "nothing affects this version" (verified live). It
+      # has to be matched exactly, not as "no vulns key": an error envelope served with a
+      # 200 (`{"code":3,"message":...}`) has no vulns key either, and reading that as an
+      # all-clear would drop every advisory on the package.
+      return [] if body.empty?
+
+      vulns = body["vulns"]
+      return unless vulns.is_a?(Array)
+      # EVERY entry has to be readable, not just one of them. Skipping the unreadable
+      # ones would silently shorten the list, and a short list is indistinguishable from
+      # OSV not listing that advisory at all: the one it named but we couldn't parse
+      # would be dropped as unaffected. `all?` holds on an empty array, so OSV's other
+      # genuine all-clear shape, `{"vulns": []}`, still answers.
+      return unless vulns.all? { |vuln| vuln.is_a?(Hash) && vuln["id"].is_a?(String) }
+
+      vulns.flat_map { |vuln| [vuln["id"], *vuln["aliases"]] }.grep(String)
+    end
+
+    # An advisory's own id plus its aliases, mirroring VulnerabilityHelper's merge
+    # identity: OSV keys a record by GHSA while deps.dev may hand us the CVE (or the
+    # reverse), so matching on the primary id alone would read a listed advisory as
+    # absent and drop a real finding.
+    def identifiers(advisory)
+      [advisory[:id], *advisory[:aliases]].compact.map(&:to_s)
+    end
+
+    # Does this record carry version data for the audited package, under the exact
+    # ecosystem and spelling we're querying with? Both halves guard a fabricated
+    # all-clear, because OSV answers an unknown package and a patched version with the
+    # same bare `{}`:
+    #
+    # NAME -- registry name normalization differs by ecosystem (PyPI folds case and
+    # -/_/.), so a spelling mismatch would turn a missed lookup into "not affected".
+    # Exact equality is stricter than OSV's own matching, which costs us the fix on a
+    # case-divergent name; that's the safe direction to be wrong in.
+    #
+    # VERSIONED -- an affected entry with no ranges and no version list (or one whose
+    # window lives somewhere /v1/query can't match on, like a GIT range) is OSV having
+    # no opinion on versions at all. The query can then never return that record for
+    # ANY version, so treating its silence as contradiction would drop the advisory
+    # permanently, for every user, while deps.dev still asserts the version is affected.
+    def names_package?(record, ecosystem:, name:)
+      osv_ecosystem = ECOSYSTEM_NAMES[ecosystem || :rubygems]
+      record[:affected].any? { |a| a[:name] == name && a[:ecosystem] == osv_ecosystem && a[:versioned] }
+    end
+
     # The highest-version CVSS vector the record carries, as { score:, version:,
     # vector: } (a computed base score, the "3.1"/"4.0" version, and the raw string),
     # or all-nil. deps.dev has no v4 score, so this is what gives a CVSS-4-only
@@ -132,12 +293,21 @@ module StillActive
       package = entry["package"]
       return unless package.is_a?(Hash) && package["name"]
 
-      fixed = Array(entry["ranges"]).flat_map do |range|
-        next [] unless range.is_a?(Hash)
+      ranges = Array(entry["ranges"]).select { |range| range.is_a?(Hash) }
+      fixed = ranges.flat_map { |range| Array(range["events"]).filter_map { |event| event["fixed"] if event.is_a?(Hash) } }
+      {ecosystem: package["ecosystem"], name: package["name"], fixed: fixed, versioned: version_matchable?(entry, ranges)}
+    end
 
-        Array(range["events"]).filter_map { |event| event["fixed"] if event.is_a?(Hash) }
-      end
-      {ecosystem: package["ecosystem"], name: package["name"], fixed: fixed}
+    # Range types /v1/query can resolve a VERSION against. A GIT range is commit-graph
+    # data a version query never matches, so a record carrying only those has no version
+    # opinion to contradict deps.dev with. A range missing its type reads the same way.
+    VERSION_RANGE_TYPES = ["SEMVER", "ECOSYSTEM"].freeze
+
+    # Does this affected entry hold data a version query could match on -- an explicit
+    # version list, or a version-ordered range? See names_package? for why the absence
+    # of it has to block a drop rather than permit one.
+    def version_matchable?(entry, ranges)
+      !Array(entry["versions"]).empty? || ranges.any? { |range| VERSION_RANGE_TYPES.include?(range["type"]) }
     end
 
     def encode(value)

data/lib/still_active/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module StillActive
-  VERSION = "3.0.0.rc5"
+  VERSION = "3.0.0.rc6"
 end

data/lib/still_active/workflow.rb

@@ -384,8 +384,9 @@ module StillActive
       vulnerabilities = VulnerabilityHelper.merge_advisories(deps_dev: deps_dev_vulns, ruby_advisory_db: radb_vulns)
       # Enrich with OSV: a real GHSA severity label (deps.dev can't score a CVSS-4-only
       # advisory) and the fixed-version ranges the "capped below the fix" signal needs.
-      # Native path is rubygems.
-      OsvClient.enrich(vulnerabilities, ecosystem: :rubygems, name: gem_name)
+      # Native path is rubygems. The version also lets OSV confirm a deps.dev-only
+      # advisory applies to it; a ruby-advisory-db verdict is never overruled.
+      vulnerabilities = OsvClient.enrich(vulnerabilities, ecosystem: :rubygems, name: gem_name, version: version)
       {
         scorecard_score: scorecard&.dig(:score),
         scorecard_maintained: scorecard&.dig(:maintained),

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: still_active
 version: !ruby/object:Gem::Version
-  version: 3.0.0.rc5
+  version: 3.0.0.rc6
 platform: ruby
 authors:
 - Sean Floyd