sentinello 3.8.0 → 3.8.2

package/dist/cli.cjs

@@ -2680,16 +2680,16 @@ var require_parse2 = __commonJS({
       return self2.pull(4).then(function(data) {
         if (data.length === 0)
           return;
-        const signature = data.readUInt32LE(0);
-        if (signature === 875721283) {
+        const signature2 = data.readUInt32LE(0);
+        if (signature2 === 875721283) {
           return self2._readCrxHeader();
         }
-        if (signature === 67324752) {
+        if (signature2 === 67324752) {
           return self2._readFile();
-        } else if (signature === 33639248) {
+        } else if (signature2 === 33639248) {
           self2.reachedCD = true;
           return self2._readCentralDirectoryFileHeader();
-        } else if (signature === 101010256) {
+        } else if (signature2 === 101010256) {
           return self2._readEndOfCentralDirectoryRecord();
         } else if (self2.reachedCD) {
           const includeEof = true;
@@ -2697,7 +2697,7 @@ var require_parse2 = __commonJS({
             return self2._readEndOfCentralDirectoryRecord();
           });
         } else
-          self2.emit("error", new Error("invalid signature: 0x" + signature.toString(16)));
+          self2.emit("error", new Error("invalid signature: 0x" + signature2.toString(16)));
       }).then((function(loop) {
         if (loop) {
           return self2._readRecord();
@@ -5487,8 +5487,8 @@ var require_graceful_fs = __commonJS({
       fs2.createReadStream = createReadStream;
       fs2.createWriteStream = createWriteStream2;
       var fs$readFile = fs2.readFile;
-      fs2.readFile = readFile13;
-      function readFile13(path, options, cb) {
+      fs2.readFile = readFile14;
+      function readFile14(path, options, cb) {
         if (typeof options === "function")
           cb = options, options = null;
         return go$readFile(path, options, cb);
@@ -6874,7 +6874,7 @@ var require_jsonfile = __commonJS({
       }
       return obj2;
     }
-    var readFile13 = universalify.fromPromise(_readFile);
+    var readFile14 = universalify.fromPromise(_readFile);
     function readFileSync2(file2, options = {}) {
       if (typeof options === "string") {
         options = { encoding: options };
@@ -6906,7 +6906,7 @@ var require_jsonfile = __commonJS({
       return fs.writeFileSync(file2, str2, options);
     }
     module2.exports = {
-      readFile: readFile13,
+      readFile: readFile14,
       readFileSync: readFileSync2,
       writeFile: writeFile4,
       writeFileSync
@@ -12784,13 +12784,13 @@ var require_directory = __commonJS({
     var parseDateTime = require_parseDateTime();
     var parseBuffer = require_parseBuffer();
     var Bluebird = require_bluebird();
-    var signature = Buffer.alloc(4);
-    signature.writeUInt32LE(101010256, 0);
+    var signature2 = Buffer.alloc(4);
+    signature2.writeUInt32LE(101010256, 0);
     function getCrxHeader(source) {
       const sourceStream = source.stream(0).pipe(PullStream());
       return sourceStream.pull(4).then(function(data) {
-        const signature2 = data.readUInt32LE(0);
-        if (signature2 === 875721283) {
+        const signature3 = data.readUInt32LE(0);
+        if (signature3 === 875721283) {
           let crxHeader;
           return sourceStream.pull(12).then(function(data2) {
             crxHeader = parseBuffer.parse(data2, [
@@ -12853,7 +12853,7 @@ var require_directory = __commonJS({
         source.stream(Math.max(0, size - tailSize)).on("error", function(error62) {
           endDir.emit("error", error62);
         }).pipe(endDir);
-        return endDir.pull(signature);
+        return endDir.pull(signature2);
       }).then(function() {
         return Bluebird.props({ directory: endDir.pull(22), crxHeader });
       }).then(function(d) {
@@ -13113,6 +13113,7 @@ var SEVERITY_WEIGHT = {
   critical: 5,
   high: 4,
   moderate: 3,
+  unrated: 3,
   low: 2,
   info: 1
 };
@@ -13133,7 +13134,7 @@ function maxSeverity(severities) {
   for (const s of severities) {
     const normalized = s.trim().toLowerCase();
     const known = SEVERITY_WEIGHT[normalized];
-    if (known !== void 0 && known > bestWeight) {
+    if (known !== void 0 && (known > bestWeight || known === bestWeight && normalized === "moderate")) {
       bestWeight = known;
       best = normalized;
     }
@@ -13174,6 +13175,7 @@ var REASON_CODE_VALUES = [
   "ambiguous_dependency_spec",
   "unsupported_lockfile",
   "ecosystem_source_disabled",
+  "source_not_applicable",
   "timeout"
 ];
 var SOURCE_UNAVAILABLE_REASON_CODES = [
@@ -13747,7 +13749,7 @@ var ECOSYSTEMS = [
     status: "stable",
     osvEcosystem: "npm",
     gemnasiumPackageType: "npm",
-    resolverKinds: ["package-lock.json", "pnpm-lock.yaml", "yarn.lock"],
+    resolverKinds: ["package-lock.json", "pnpm-lock.yaml", "yarn.lock", "bun.lock", "bun.lockb"],
     manifestKinds: ["package.json"],
     comparator: "semver",
     wayOut: true,
@@ -13821,6 +13823,9 @@ function getSource(id) {
   }
   return null;
 }
+function sourceAppliesToPackageManager(source, packageManager) {
+  return !(source === "npm-audit" && packageManager === "bun");
+}
 function requireEcosystemId(id) {
   const def = getEcosystem(id);
   if (def === null) throw new Error("unknown ecosystem " + JSON.stringify(id));
@@ -13855,6 +13860,8 @@ var MANIFEST_PACKAGE_MANAGERS = {
   "package-lock.json": "npm",
   "pnpm-lock.yaml": "pnpm",
   "yarn.lock": "yarn",
+  "bun.lock": "bun",
+  "bun.lockb": "bun",
   "package.json": "unknown",
   "poetry.lock": "poetry",
   "Pipfile.lock": "pipenv",
@@ -13904,6 +13911,7 @@ var REASON_CODE_LABELS = {
     ambiguous_dependency_spec: "Ambiguous dependency spec",
     unsupported_lockfile: "Unsupported lockfile",
     ecosystem_source_disabled: "No source enabled for ecosystem",
+    source_not_applicable: "npm audit does not read bun.lock",
     timeout: "Timeout"
   },
   "es": {
@@ -13935,6 +13943,7 @@ var REASON_CODE_LABELS = {
     ambiguous_dependency_spec: "Especificaci\xF3n de dependencia ambigua",
     unsupported_lockfile: "Lockfile no compatible",
     ecosystem_source_disabled: "Sin fuente habilitada para el ecosistema",
+    source_not_applicable: "npm audit no lee bun.lock",
     timeout: "Tiempo de espera agotado"
   },
   "fr": {
@@ -13966,6 +13975,7 @@ var REASON_CODE_LABELS = {
     ambiguous_dependency_spec: "Sp\xE9cification de d\xE9pendance ambigu\xEB",
     unsupported_lockfile: "Lockfile non pris en charge",
     ecosystem_source_disabled: "Aucune source activ\xE9e pour l\u2019\xE9cosyst\xE8me",
+    source_not_applicable: "npm audit ne lit pas bun.lock",
     timeout: "D\xE9lai d\xE9pass\xE9"
   },
   "de": {
@@ -13997,6 +14007,7 @@ var REASON_CODE_LABELS = {
     ambiguous_dependency_spec: "Mehrdeutige Abh\xE4ngigkeitsangabe",
     unsupported_lockfile: "Nicht unterst\xFCtzte Lockfile",
     ecosystem_source_disabled: "Keine Quelle f\xFCr \xD6kosystem aktiviert",
+    source_not_applicable: "npm audit liest bun.lock nicht",
     timeout: "Zeit\xFCberschreitung"
   },
   "pt-BR": {
@@ -14028,6 +14039,7 @@ var REASON_CODE_LABELS = {
     ambiguous_dependency_spec: "Especifica\xE7\xE3o de depend\xEAncia amb\xEDgua",
     unsupported_lockfile: "Lockfile n\xE3o suportado",
     ecosystem_source_disabled: "Nenhuma fonte habilitada para o ecossistema",
+    source_not_applicable: "npm audit n\xE3o l\xEA bun.lock",
     timeout: "Tempo esgotado"
   },
   "it": {
@@ -14059,6 +14071,7 @@ var REASON_CODE_LABELS = {
     ambiguous_dependency_spec: "Specifica di dipendenza ambigua",
     unsupported_lockfile: "Lockfile non supportato",
     ecosystem_source_disabled: "Nessuna fonte abilitata per l\u2019ecosistema",
+    source_not_applicable: "npm audit non legge bun.lock",
     timeout: "Timeout scaduto"
   },
   "ja": {
@@ -14090,6 +14103,7 @@ var REASON_CODE_LABELS = {
     ambiguous_dependency_spec: "\u4F9D\u5B58\u95A2\u4FC2\u306E\u6307\u5B9A\u304C\u66D6\u6627",
     unsupported_lockfile: "\u672A\u5BFE\u5FDC\u306E\u30ED\u30C3\u30AF\u30D5\u30A1\u30A4\u30EB",
     ecosystem_source_disabled: "\u30A8\u30B3\u30B7\u30B9\u30C6\u30E0\u306B\u6709\u52B9\u306A\u30BD\u30FC\u30B9\u304C\u3042\u308A\u307E\u305B\u3093",
+    source_not_applicable: "npm audit \u306F bun.lock \u3092\u8AAD\u307F\u53D6\u308A\u307E\u305B\u3093",
     timeout: "\u30BF\u30A4\u30E0\u30A2\u30A6\u30C8"
   },
   "zh-CN": {
@@ -14121,6 +14135,7 @@ var REASON_CODE_LABELS = {
     ambiguous_dependency_spec: "\u4F9D\u8D56\u9879\u89C4\u8303\u4E0D\u660E\u786E",
     unsupported_lockfile: "\u4E0D\u652F\u6301\u7684\u9501\u6587\u4EF6",
     ecosystem_source_disabled: "\u8BE5\u751F\u6001\u7CFB\u7EDF\u672A\u542F\u7528\u4EFB\u4F55\u6765\u6E90",
+    source_not_applicable: "npm audit \u4E0D\u8BFB\u53D6 bun.lock",
     timeout: "\u8D85\u65F6"
   },
   "ko": {
@@ -14152,6 +14167,7 @@ var REASON_CODE_LABELS = {
     ambiguous_dependency_spec: "\uBAA8\uD638\uD55C \uC758\uC874\uC131 \uBA85\uC138",
     unsupported_lockfile: "\uC9C0\uC6D0\uD558\uC9C0 \uC54A\uB294 \uC7A0\uAE08 \uD30C\uC77C",
     ecosystem_source_disabled: "\uC0DD\uD0DC\uACC4\uC5D0 \uD65C\uC131\uD654\uB41C \uC18C\uC2A4 \uC5C6\uC74C",
+    source_not_applicable: "npm audit\uB294 bun.lock\uC744 \uC77D\uC9C0 \uC54A\uC74C",
     timeout: "\uC2DC\uAC04 \uCD08\uACFC"
   },
   "ru": {
@@ -14183,6 +14199,7 @@ var REASON_CODE_LABELS = {
     ambiguous_dependency_spec: "\u041D\u0435\u043E\u0434\u043D\u043E\u0437\u043D\u0430\u0447\u043D\u0430\u044F \u0441\u043F\u0435\u0446\u0438\u0444\u0438\u043A\u0430\u0446\u0438\u044F \u0437\u0430\u0432\u0438\u0441\u0438\u043C\u043E\u0441\u0442\u0438",
     unsupported_lockfile: "\u041D\u0435\u043F\u043E\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043C\u044B\u0439 lockfile",
     ecosystem_source_disabled: "\u041D\u0435\u0442 \u0438\u0441\u0442\u043E\u0447\u043D\u0438\u043A\u0430 \u0434\u043B\u044F \u044D\u043A\u043E\u0441\u0438\u0441\u0442\u0435\u043C\u044B",
+    source_not_applicable: "npm audit \u043D\u0435 \u0447\u0438\u0442\u0430\u0435\u0442 bun.lock",
     timeout: "\u0422\u0430\u0439\u043C-\u0430\u0443\u0442"
   }
 };
@@ -14322,6 +14339,7 @@ var REASON_SIDE = {
   gemnasium_db_not_seeded: "environment",
   gemnasium_db_unavailable: "environment",
   ecosystem_source_disabled: "environment",
+  source_not_applicable: "environment",
   timeout: "environment"
 };
 function failureReasonCode(code) {
@@ -14402,6 +14420,12 @@ var NOT_YET_RUN_LABELS = {
 };
 
 // ../../packages/core/src/fix-status.ts
+function fixKindOf(f) {
+  if (f.fixStatus !== "released" || !f.fixVersion) return null;
+  const comparator = comparatorForEcosystem(f.ecosystem);
+  const normalized = comparator?.normalize(f.fixVersion) ?? null;
+  return normalized !== null && comparator.releaseKind(normalized) === "pseudo" ? "untagged_commit" : "release";
+}
 function isoDate2(at) {
   return new Date(at).toISOString().slice(0, 10);
 }
@@ -14420,12 +14444,17 @@ function staleSuffix(check2) {
   return " \xB7 cached data from " + isoDate2(check2.packageDataAsOf);
 }
 function describeNotRechecked(reason) {
-  const project = reason.projectState === "cannot_scan" ? "the project cannot be scanned" : "the project cannot be fully scanned";
-  if (reason.manifests !== null) return "copies in " + reason.manifests.join(", ") + " not re-checked \u2014 " + project + ": " + reasonCodeLabel(reason.reasonCode);
+  const project = projectCannotBeScanned(reason);
+  if (reason.manifests !== null) return "copies in " + reason.manifests.join(", ") + " not re-checked \u2014 " + project + reasonCodeLabel(reason.reasonCode);
   const when = reason.lastOkScanAt === null ? "never scanned successfully" : "last scanned successfully " + isoDate2(reason.lastOkScanAt);
-  return "not re-checked \u2014 " + project + ": " + reasonCodeLabel(reason.reasonCode) + " (" + when + ")";
+  return "not re-checked \u2014 " + project + reasonCodeLabel(reason.reasonCode) + " (" + when + ")";
+}
+function projectCannotBeScanned(reason) {
+  if (reason.projectState === "cannot_scan") return "the project cannot be scanned: ";
+  return reason.projectState === "partial" || reason.manifests !== null ? "the project cannot be fully scanned: " : "";
 }
 function describeFix(f, style) {
+  if (f.noticeKind) return "no fix to chase \u2014 this is a notice (" + f.noticeKind + "), not a vulnerability";
   const notRechecked = f.notRecheckedBecause ?? null;
   if (notRechecked === null) return describeSettledFix(f, style);
   if (f.fixCheck === null) return describeNotRechecked(notRechecked);
@@ -14435,6 +14464,7 @@ function describeSettledFix(f, style) {
   const check2 = f.fixCheck;
   if (check2 === null) return "fix not re-checked yet \u2014 rescan pending";
   if (f.fixStatus === "released" && f.fixVersion) {
+    if (fixKindOf(f) === "untagged_commit") return "upgrade to " + style.code(f.fixVersion) + " (an untagged commit: no tagged release has the fix)" + staleSuffix(check2);
     return "upgrade to " + style.code(f.fixVersion) + staleSuffix(check2);
   }
   if (f.fixStatus === "none_released") {
@@ -14460,6 +14490,93 @@ function describeFixDisagreement(f, style) {
   return "sources disagree: " + listed + " \u2014 " + style.code(f.fixVersion) + " is outside " + outside;
 }
 
+// ../../packages/core/src/reason-fix-hints.ts
+var REASON_FIX_HINTS = {
+  "en": {
+    no_lockfile: "commit the lockfile your package manager writes",
+    unknown_pm: "name the package manager in package.json, or commit its lockfile",
+    yarn_v1_unsupported: "move to Yarn 2 or later, npm or pnpm",
+    partial_dependency_graph: "pin what comes from git, a local path or a URL to a released version where you can",
+    ambiguous_dependency_spec: "pin exact versions (== in requirements.txt) or commit a lockfile",
+    unsupported_lockfile: "regenerate it in a format Sentinello reads: npm install with npm 7 or later, or bun install --save-text-lockfile"
+  },
+  "es": {
+    no_lockfile: "haz commit del lockfile que escribe tu gestor de paquetes",
+    unknown_pm: "indica el gestor de paquetes en package.json o haz commit de su lockfile",
+    yarn_v1_unsupported: "pasa a Yarn 2 o posterior, npm o pnpm",
+    partial_dependency_graph: "fija en una versi\xF3n publicada lo que venga de git, de una ruta local o de una URL, cuando puedas",
+    ambiguous_dependency_spec: "fija versiones exactas (== en requirements.txt) o haz commit de un lockfile",
+    unsupported_lockfile: "regen\xE9ralo en un formato que Sentinello lea: npm install con npm 7 o posterior, o bun install --save-text-lockfile"
+  },
+  "fr": {
+    no_lockfile: "committez le lockfile \xE9crit par votre gestionnaire de paquets",
+    unknown_pm: "indiquez le gestionnaire de paquets dans package.json, ou committez son lockfile",
+    yarn_v1_unsupported: "passez \xE0 Yarn 2 ou ult\xE9rieur, npm ou pnpm",
+    partial_dependency_graph: "\xE9pinglez sur une version publi\xE9e ce qui vient de git, d'un chemin local ou d'une URL, si possible",
+    ambiguous_dependency_spec: "\xE9pinglez des versions exactes (== dans requirements.txt) ou committez un lockfile",
+    unsupported_lockfile: "r\xE9g\xE9n\xE9rez-le dans un format que Sentinello lit : npm install avec npm 7 ou ult\xE9rieur, ou bun install --save-text-lockfile"
+  },
+  "de": {
+    no_lockfile: "committe die Lockfile, die dein Paketmanager schreibt",
+    unknown_pm: "nenne den Paketmanager in package.json oder committe seine Lockfile",
+    yarn_v1_unsupported: "wechsle zu Yarn 2 oder neuer, npm oder pnpm",
+    partial_dependency_graph: "pinne, was aus git, einem lokalen Pfad oder einer URL kommt, wo m\xF6glich auf eine ver\xF6ffentlichte Version",
+    ambiguous_dependency_spec: "pinne exakte Versionen (== in requirements.txt) oder committe eine Lockfile",
+    unsupported_lockfile: "erzeuge sie in einem Format neu, das Sentinello liest: npm install mit npm 7 oder neuer, oder bun install --save-text-lockfile"
+  },
+  "pt-BR": {
+    no_lockfile: "fa\xE7a commit do lockfile que seu gerenciador de pacotes escreve",
+    unknown_pm: "indique o gerenciador de pacotes no package.json ou fa\xE7a commit do lockfile dele",
+    yarn_v1_unsupported: "migre para Yarn 2 ou posterior, npm ou pnpm",
+    partial_dependency_graph: "fixe em uma vers\xE3o publicada o que vem do git, de um caminho local ou de uma URL, quando poss\xEDvel",
+    ambiguous_dependency_spec: "fixe vers\xF5es exatas (== no requirements.txt) ou fa\xE7a commit de um lockfile",
+    unsupported_lockfile: "gere-o de novo em um formato que o Sentinello leia: npm install com npm 7 ou posterior, ou bun install --save-text-lockfile"
+  },
+  "it": {
+    no_lockfile: "esegui il commit del lockfile scritto dal tuo gestore di pacchetti",
+    unknown_pm: "indica il gestore di pacchetti in package.json o esegui il commit del suo lockfile",
+    yarn_v1_unsupported: "passa a Yarn 2 o successivo, npm o pnpm",
+    partial_dependency_graph: "fissa su una versione pubblicata ci\xF2 che viene da git, da un percorso locale o da un URL, dove puoi",
+    ambiguous_dependency_spec: "fissa versioni esatte (== in requirements.txt) o esegui il commit di un lockfile",
+    unsupported_lockfile: "rigeneralo in un formato che Sentinello legge: npm install con npm 7 o successivo, oppure bun install --save-text-lockfile"
+  },
+  "ja": {
+    no_lockfile: "\u30D1\u30C3\u30B1\u30FC\u30B8\u30DE\u30CD\u30FC\u30B8\u30E3\u30FC\u304C\u751F\u6210\u3059\u308B lockfile \u3092\u30B3\u30DF\u30C3\u30C8\u3057\u3066\u304F\u3060\u3055\u3044",
+    unknown_pm: "package.json \u3067\u30D1\u30C3\u30B1\u30FC\u30B8\u30DE\u30CD\u30FC\u30B8\u30E3\u30FC\u3092\u6307\u5B9A\u3059\u308B\u304B\u3001\u305D\u306E lockfile \u3092\u30B3\u30DF\u30C3\u30C8\u3057\u3066\u304F\u3060\u3055\u3044",
+    yarn_v1_unsupported: "Yarn 2 \u4EE5\u964D\u3001npm\u3001pnpm \u306E\u3044\u305A\u308C\u304B\u306B\u79FB\u884C\u3057\u3066\u304F\u3060\u3055\u3044",
+    partial_dependency_graph: "git\u3001\u30ED\u30FC\u30AB\u30EB\u30D1\u30B9\u3001URL \u304B\u3089\u53D6\u5F97\u3057\u3066\u3044\u308B\u3082\u306E\u306F\u3001\u53EF\u80FD\u306A\u7BC4\u56F2\u3067\u516C\u958B\u6E08\u307F\u30D0\u30FC\u30B8\u30E7\u30F3\u306B\u56FA\u5B9A\u3057\u3066\u304F\u3060\u3055\u3044",
+    ambiguous_dependency_spec: "\u6B63\u78BA\u306A\u30D0\u30FC\u30B8\u30E7\u30F3\u3092\u56FA\u5B9A\u3059\u308B\uFF08requirements.txt \u306E ==\uFF09\u304B\u3001lockfile \u3092\u30B3\u30DF\u30C3\u30C8\u3057\u3066\u304F\u3060\u3055\u3044",
+    unsupported_lockfile: "Sentinello \u304C\u8AAD\u3081\u308B\u5F62\u5F0F\u3067\u518D\u751F\u6210\u3057\u3066\u304F\u3060\u3055\u3044: npm 7 \u4EE5\u964D\u306E npm install\u3001\u307E\u305F\u306F bun install --save-text-lockfile"
+  },
+  "zh-CN": {
+    no_lockfile: "\u63D0\u4EA4\u5305\u7BA1\u7406\u5668\u751F\u6210\u7684 lockfile",
+    unknown_pm: "\u5728 package.json \u4E2D\u6307\u660E\u5305\u7BA1\u7406\u5668\uFF0C\u6216\u63D0\u4EA4\u5176 lockfile",
+    yarn_v1_unsupported: "\u8FC1\u79FB\u5230 Yarn 2 \u6216\u66F4\u9AD8\u7248\u672C\u3001npm \u6216 pnpm",
+    partial_dependency_graph: "\u5C3D\u53EF\u80FD\u5C06\u6765\u81EA git\u3001\u672C\u5730\u8DEF\u5F84\u6216 URL \u7684\u4F9D\u8D56\u56FA\u5B9A\u5230\u5DF2\u53D1\u5E03\u7248\u672C",
+    ambiguous_dependency_spec: "\u56FA\u5B9A\u786E\u5207\u7248\u672C\uFF08requirements.txt \u4E2D\u4F7F\u7528 ==\uFF09\u6216\u63D0\u4EA4 lockfile",
+    unsupported_lockfile: "\u4EE5 Sentinello \u53EF\u8BFB\u7684\u683C\u5F0F\u91CD\u65B0\u751F\u6210\uFF1A\u4F7F\u7528 npm 7 \u6216\u66F4\u9AD8\u7248\u672C\u8FD0\u884C npm install\uFF0C\u6216\u8FD0\u884C bun install --save-text-lockfile"
+  },
+  "ko": {
+    no_lockfile: "\uD328\uD0A4\uC9C0 \uAD00\uB9AC\uC790\uAC00 \uC0DD\uC131\uD558\uB294 lockfile\uC744 \uCEE4\uBC0B\uD558\uC138\uC694",
+    unknown_pm: "package.json\uC5D0 \uD328\uD0A4\uC9C0 \uAD00\uB9AC\uC790\uB97C \uC9C0\uC815\uD558\uAC70\uB098 \uD574\uB2F9 lockfile\uC744 \uCEE4\uBC0B\uD558\uC138\uC694",
+    yarn_v1_unsupported: "Yarn 2 \uC774\uC0C1, npm \uB610\uB294 pnpm\uC73C\uB85C \uC62E\uAE30\uC138\uC694",
+    partial_dependency_graph: "git, \uB85C\uCEEC \uACBD\uB85C, URL\uC5D0\uC11C \uAC00\uC838\uC624\uB294 \uD56D\uBAA9\uC740 \uAC00\uB2A5\uD55C \uACBD\uC6B0 \uAC8C\uC2DC\uB41C \uBC84\uC804\uC73C\uB85C \uACE0\uC815\uD558\uC138\uC694",
+    ambiguous_dependency_spec: "\uC815\uD655\uD55C \uBC84\uC804\uC744 \uACE0\uC815\uD558\uAC70\uB098(requirements.txt\uC758 ==) lockfile\uC744 \uCEE4\uBC0B\uD558\uC138\uC694",
+    unsupported_lockfile: "Sentinello\uAC00 \uC77D\uC744 \uC218 \uC788\uB294 \uD615\uC2DD\uC73C\uB85C \uB2E4\uC2DC \uC0DD\uC131\uD558\uC138\uC694: npm 7 \uC774\uC0C1\uC758 npm install \uB610\uB294 bun install --save-text-lockfile"
+  },
+  "ru": {
+    no_lockfile: "\u0437\u0430\u043A\u043E\u043C\u043C\u0438\u0442\u044C\u0442\u0435 lockfile, \u043A\u043E\u0442\u043E\u0440\u044B\u0439 \u0441\u043E\u0437\u0434\u0430\u0451\u0442 \u0432\u0430\u0448 \u043C\u0435\u043D\u0435\u0434\u0436\u0435\u0440 \u043F\u0430\u043A\u0435\u0442\u043E\u0432",
+    unknown_pm: "\u0443\u043A\u0430\u0436\u0438\u0442\u0435 \u043C\u0435\u043D\u0435\u0434\u0436\u0435\u0440 \u043F\u0430\u043A\u0435\u0442\u043E\u0432 \u0432 package.json \u0438\u043B\u0438 \u0437\u0430\u043A\u043E\u043C\u043C\u0438\u0442\u044C\u0442\u0435 \u0435\u0433\u043E lockfile",
+    yarn_v1_unsupported: "\u043F\u0435\u0440\u0435\u0439\u0434\u0438\u0442\u0435 \u043D\u0430 Yarn 2 \u0438\u043B\u0438 \u043D\u043E\u0432\u0435\u0435, npm \u0438\u043B\u0438 pnpm",
+    partial_dependency_graph: "\u043F\u043E \u0432\u043E\u0437\u043C\u043E\u0436\u043D\u043E\u0441\u0442\u0438 \u0437\u0430\u043A\u0440\u0435\u043F\u0438\u0442\u0435 \u043D\u0430 \u043E\u043F\u0443\u0431\u043B\u0438\u043A\u043E\u0432\u0430\u043D\u043D\u043E\u0439 \u0432\u0435\u0440\u0441\u0438\u0438 \u0442\u043E, \u0447\u0442\u043E \u0431\u0435\u0440\u0451\u0442\u0441\u044F \u0438\u0437 git, \u043B\u043E\u043A\u0430\u043B\u044C\u043D\u043E\u0433\u043E \u043F\u0443\u0442\u0438 \u0438\u043B\u0438 URL",
+    ambiguous_dependency_spec: "\u0437\u0430\u043A\u0440\u0435\u043F\u0438\u0442\u0435 \u0442\u043E\u0447\u043D\u044B\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 (== \u0432 requirements.txt) \u0438\u043B\u0438 \u0437\u0430\u043A\u043E\u043C\u043C\u0438\u0442\u044C\u0442\u0435 lockfile",
+    unsupported_lockfile: "\u0441\u043E\u0437\u0434\u0430\u0439\u0442\u0435 \u0435\u0433\u043E \u0437\u0430\u043D\u043E\u0432\u043E \u0432 \u0444\u043E\u0440\u043C\u0430\u0442\u0435, \u043A\u043E\u0442\u043E\u0440\u044B\u0439 \u0447\u0438\u0442\u0430\u0435\u0442 Sentinello: npm install \u0441 npm 7 \u0438\u043B\u0438 \u043D\u043E\u0432\u0435\u0435 \u043B\u0438\u0431\u043E bun install --save-text-lockfile"
+  }
+};
+function reasonFixHint(code, locale = "en") {
+  return REASON_FIX_HINTS[locale][code] ?? null;
+}
+
 // ../../packages/core/src/scan-state-text.ts
 function scanReasonLabel(reason, locale = "en") {
   if (reason.reasonCode === "not_yet_run") return NOT_YET_RUN_LABELS[locale];
@@ -14469,7 +14586,7 @@ function labelScanState(state, locale = "en") {
   return {
     state: state.state,
     reasons: state.reasons.map(function labelled(reason) {
-      return { ...reason, label: scanReasonLabel(reason, locale) };
+      return { ...reason, label: scanReasonLabel(reason, locale), fixHint: reasonFixHint(reason.reasonCode, locale) };
     })
   };
 }
@@ -14503,14 +14620,15 @@ function groupScanReasons(reasons, locale = "en") {
       if (!group.subjects.includes(subject)) group.subjects.push(subject);
       continue;
     }
-    out.push({ reasonCode: reason.reasonCode, side: reason.side, label: scanReasonLabel(reason, locale), subjects: [subject] });
+    out.push({ reasonCode: reason.reasonCode, side: reason.side, label: scanReasonLabel(reason, locale), subjects: [subject], fixHint: reasonFixHint(reason.reasonCode, locale) });
   }
   return out;
 }
-function describeScanReasons(reasons, locale = "en") {
+function describeScanReasons(reasons, locale = "en", withFix = false) {
   return groupScanReasons(reasons, locale).map(function line(g) {
     if (g.side === null) return g.subjects.join(", ") + ": " + g.label;
-    return g.label + " (" + SCAN_STATE_SIDE_SHORT[g.side] + ")";
+    const whose = g.label + " (" + SCAN_STATE_SIDE_SHORT[g.side] + ")";
+    return withFix && g.fixHint !== null ? whose + ": " + g.fixHint : whose;
   }).join(" \xB7 ");
 }
 function describeGroupedReasonLong(group) {
@@ -14531,9 +14649,9 @@ function asError(err) {
 // ../../packages/core/src/advisory-rows.ts
 var OSV_NORMALIZER_VERSIONS = {
   npm: 8,
-  PyPI: 8,
+  PyPI: 9,
   Go: 8,
-  "crates.io": 8,
+  "crates.io": 9,
   RubyGems: 8
 };
 function osvNormalizerVersion(ecosystem) {
@@ -14659,7 +14777,7 @@ function escapeForMarkdown(value) {
 }
 function formatFinding(index, f) {
   const lines = [];
-  const headline = "`" + escapeForMarkdown(f.packageName) + "@" + escapeForMarkdown(f.installedVersion) + "` \u2014 " + f.severity;
+  const headline = "`" + escapeForMarkdown(f.packageName) + "@" + escapeForMarkdown(f.installedVersion) + "` \u2014 " + (f.noticeKind ? "notice: " + f.noticeKind : f.severity);
   lines.push("### " + index + ". " + headline);
   lines.push("");
   lines.push("- **Ecosystem:** " + ecosystemLabel(f.ecosystem));
@@ -14736,8 +14854,16 @@ function wayOutLines(ecosystem, r, notRechecked) {
   for (const a of text.alternatives) lines.push("    - **Alternatives:** " + a);
   return lines;
 }
+function isNotice(f) {
+  return Boolean(f.noticeKind);
+}
+function countNotices(findings) {
+  return findings.filter(isNotice).length;
+}
 function sortForExport(findings) {
   return [...findings].sort(function bySeverityThenName(a, b) {
+    const kind = Number(isNotice(a)) - Number(isNotice(b));
+    if (kind !== 0) return kind;
     const sev = compareSeverity(a.severity, b.severity);
     if (sev !== 0) return sev;
     const nameCmp = a.packageName.localeCompare(b.packageName);
@@ -14745,13 +14871,14 @@ function sortForExport(findings) {
     return a.advisoryId.localeCompare(b.advisoryId);
   });
 }
-function buildHeader(scope, generatedAt, count2, range) {
+function buildHeader(scope, generatedAt, count2, range, notices) {
   const title = "Sentinello advisory export \u2014 " + scopeTitle(scope);
   const subtitleParts = [];
   subtitleParts.push("Generated " + new Date(generatedAt).toISOString());
   {
     subtitleParts.push(count2 + " " + (count2 === 1 ? "finding" : "findings"));
   }
+  if (notices > 0) subtitleParts.push(notices + " " + (notices === 1 ? "notice" : "notices") + ", not vulnerabilities");
   if (scope.kind === "project") {
     subtitleParts.push("project: `" + escapeForMarkdown(scope.projectPath) + "`");
   } else if (scope.kind === "library") {
@@ -14803,12 +14930,21 @@ function buildFindingsSection(findings, startIndex) {
   const out = [];
   out.push("## Findings");
   out.push("");
-  if (findings.length === 0) {
+  if (!findings.some(function vulnerability(f) {
+    return !isNotice(f);
+  })) {
     out.push("_No current findings._");
     out.push("");
-    return out;
   }
+  let noticesStarted = false;
   findings.forEach(function appendFinding(f, i) {
+    if (isNotice(f) && !noticesStarted) {
+      noticesStarted = true;
+      out.push("## Notices");
+      out.push("");
+      out.push("Not vulnerabilities: the advisory says the package is unmaintained, unsound or worth knowing about, and there is no fix version to chase. Weigh them when you next touch the dependency.");
+      out.push("");
+    }
     out.push(formatFinding(startIndex + i + 1, f));
     out.push("");
   });
@@ -14817,7 +14953,8 @@ function buildFindingsSection(findings, startIndex) {
 function buildAdvisoryMarkdown(args) {
   const { scope, prompt, findings, generatedAt } = args;
   const sorted = sortForExport(findings);
-  const out = buildHeader(scope, generatedAt, sorted.length).concat(buildPromptSection(prompt)).concat(buildScanStateSection(args.scanStates ?? [])).concat(buildFindingsSection(sorted, 0));
+  const notices = countNotices(sorted);
+  const out = buildHeader(scope, generatedAt, sorted.length - notices, null, notices).concat(buildPromptSection(prompt)).concat(buildScanStateSection(args.scanStates ?? [])).concat(buildFindingsSection(sorted, 0));
   return out.join("\n");
 }
 function buildExportFilename(scope, generatedAt) {
@@ -34766,8 +34903,8 @@ function evaluableContains(ev, version2) {
 
 // ../../packages/scanners/src/npm-audit-parse.ts
 var NPM_AUDIT_SCANNER_NAME = "npm-audit";
-var SEVERITY_VALUES = ["critical", "high", "moderate", "low", "info"];
-var severitySchema = external_exports.enum(SEVERITY_VALUES).catch("moderate");
+var SEVERITY_VALUES = ["critical", "high", "moderate", "unrated", "low", "info"];
+var severitySchema = external_exports.enum(SEVERITY_VALUES).catch("unrated");
 var viaObjectSchema = external_exports.object({
   source: external_exports.number().int().optional(),
   name: external_exports.string().optional(),
@@ -34952,7 +35089,7 @@ function pickAdvisoryAliases(advisoryId, url2, githubAdvisoryId) {
 function pickSeverity(via, vuln) {
   if (via.severity) return via.severity;
   if (vuln.severity) return vuln.severity;
-  return "moderate";
+  return "unrated";
 }
 function pickFixAvailability(fix) {
   if (fix === void 0 || fix === false) return { fixAvailable: false, fixVersion: null, fixName: null };
@@ -35074,7 +35211,7 @@ function normalizePnpmAuditOutput(parsed, classifier) {
     const adv = advisories[idKey];
     if (!adv) continue;
     const advisoryId = pickPnpmAdvisoryId(adv, idKey);
-    const severity = adv.severity || "moderate";
+    const severity = adv.severity || "unrated";
     const patched = adv.patched_versions || null;
     const recommendation = adv.recommendation || null;
     const vulnRange = adv.vulnerable_versions || "";
@@ -35793,6 +35930,141 @@ function unauditable(details) {
   return { status: "unauditable", ecosystem: GO_ECOSYSTEM, reasonCode: "ambiguous_dependency_spec", details };
 }
 var NPM_ECOSYSTEM = "npm";
+async function parseBunLock(absolutePath, manifestPath) {
+  let doc;
+  try {
+    doc = parseJsonc(await promises.readFile(absolutePath, "utf8"));
+  } catch {
+    return { status: "unauditable", ecosystem: NPM_ECOSYSTEM, reasonCode: "unsupported_lockfile", details: ["could not read " + manifestPath] };
+  }
+  const packages = recordOf(recordOf(doc).packages);
+  const workspaces = recordOf(recordOf(doc).workspaces);
+  const entries = /* @__PURE__ */ new Map();
+  const cannotAudit = [];
+  for (const key of Object.keys(packages)) {
+    const entry = readEntry(key, packages[key]);
+    if (entry === null) cannotAudit.push(key);
+    else if (!entry.spec.startsWith("workspace:")) entries.set(key, entry);
+  }
+  const nodes = [];
+  const edges = [];
+  const auditable = /* @__PURE__ */ new Set();
+  for (const entry of entries.values()) {
+    nodes.push({ id: entry.key, name: entry.name, version: entry.spec });
+    if (entry.spec.includes(":")) cannotAudit.push(entry.name + "@" + entry.spec);
+    else auditable.add(entry.key);
+    const chain = packageChain(entry.key);
+    addEdges(entry.key, chain, entry.meta.dependencies, "prod", entries, edges);
+    addEdges(entry.key, chain, entry.meta.optionalDependencies, "optional", entries, edges);
+    addEdges(entry.key, chain, entry.meta.peerDependencies, "peer", entries, edges);
+  }
+  const roots = [];
+  for (const path of Object.keys(workspaces)) {
+    const workspace = recordOf(workspaces[path]);
+    const importer = path === "" ? "." : path;
+    const chain = typeof workspace.name === "string" ? [workspace.name] : [];
+    addRoots(importer, chain, workspace.dependencies, "prod", entries, roots);
+    addRoots(importer, chain, workspace.peerDependencies, "prod", entries, roots);
+    addRoots(importer, chain, workspace.optionalDependencies, "optional", entries, roots);
+    addRoots(importer, chain, workspace.devDependencies, "dev", entries, roots);
+  }
+  const graph = graphFromLock({
+    ecosystem: NPM_ECOSYSTEM,
+    manifestPath,
+    nodes,
+    edges,
+    roots,
+    auditable(nodeId) {
+      return auditable.has(nodeId);
+    }
+  });
+  if (cannotAudit.length === 0) return { status: "ok", ecosystem: NPM_ECOSYSTEM, graph };
+  return {
+    status: "partial",
+    ecosystem: NPM_ECOSYSTEM,
+    graph,
+    reasonCode: "partial_dependency_graph",
+    details: [cannotAudit.length + " packages from git, local path or URL sources cannot be audited: " + cannotAudit.sort().join(", ")]
+  };
+}
+function readEntry(key, value) {
+  if (!Array.isArray(value) || typeof value[0] !== "string") return null;
+  const at = value[0].indexOf("@", 1);
+  if (at < 0 || at === value[0].length - 1) return null;
+  const meta3 = value.slice(1).find(function isMeta(part) {
+    return part !== null && typeof part === "object" && !Array.isArray(part);
+  });
+  return { key, name: value[0].slice(0, at), spec: value[0].slice(at + 1), meta: meta3 ?? {} };
+}
+function packageChain(key) {
+  const chain = [];
+  const parts = key.split("/");
+  for (let i = 0; i < parts.length; i++) {
+    const part = parts[i];
+    if (part.startsWith("@") && i + 1 < parts.length) {
+      chain.push(part + "/" + parts[i + 1]);
+      i += 1;
+    } else {
+      chain.push(part);
+    }
+  }
+  return chain;
+}
+function resolveFrom(chain, child, entries) {
+  for (let depth = chain.length; depth >= 0; depth--) {
+    const key = [...chain.slice(0, depth), child].join("/");
+    if (entries.has(key)) return key;
+  }
+  return null;
+}
+function addEdges(from, chain, deps, kind, entries, out) {
+  for (const child of Object.keys(deps ?? {})) {
+    const to = resolveFrom(chain, child, entries);
+    if (to !== null) out.push({ from, to, kind });
+  }
+}
+function addRoots(importer, chain, deps, kind, entries, out) {
+  for (const child of Object.keys(deps ?? {})) {
+    const nodeId = resolveFrom(chain, child, entries);
+    if (nodeId !== null) out.push({ importer, nodeId, kind });
+  }
+}
+function recordOf(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value) ? value : {};
+}
+function parseJsonc(text) {
+  let out = "";
+  let i = 0;
+  while (i < text.length) {
+    const c = text[i];
+    if (c === '"') {
+      const end = stringEnd(text, i);
+      out += text.slice(i, end);
+      i = end;
+    } else if (c === "/" && text[i + 1] === "/") {
+      const newline = text.indexOf("\n", i);
+      i = newline < 0 ? text.length : newline;
+    } else if (c === "/" && text[i + 1] === "*") {
+      const close = text.indexOf("*/", i + 2);
+      i = close < 0 ? text.length : close + 2;
+    } else {
+      if (c === "}" || c === "]") out = out.replace(/,\s*$/, "");
+      out += c;
+      i += 1;
+    }
+  }
+  return JSON.parse(out);
+}
+function stringEnd(text, start) {
+  let i = start + 1;
+  while (i < text.length) {
+    if (text[i] === "\\") i += 2;
+    else if (text[i] === '"') return i + 1;
+    else i += 1;
+  }
+  return text.length;
+}
+var NPM_ECOSYSTEM2 = "npm";
 async function parseNpmLock(projectPath, absolutePath, manifestPath) {
   let text;
   try {
@@ -35808,6 +36080,7 @@ async function parseNpmLock(projectPath, absolutePath, manifestPath) {
   }
   if (!parsed || typeof parsed !== "object") return null;
   const doc = parsed;
+  if (doc.lockfileVersion === 1) return null;
   const packages = doc.packages || {};
   const direct = await readDirectDeps(projectPath);
   const out = [];
@@ -35823,7 +36096,7 @@ async function parseNpmLock(projectPath, absolutePath, manifestPath) {
     if (direct.prod.has(name)) isProd = true;
     if (direct.dev.has(name)) isDev = true;
     out.push({
-      ecosystem: NPM_ECOSYSTEM,
+      ecosystem: NPM_ECOSYSTEM2,
       name,
       version: entry.version,
       scope: { isProd, isDev, isOptional: entry.optional === true || entry.devOptional === true },
@@ -35833,6 +36106,13 @@ async function parseNpmLock(projectPath, absolutePath, manifestPath) {
   }
   return makeGraph(out, doc.packages ? buildNodeGraph(packages) : null);
 }
+async function isNpmLockV1(absolutePath) {
+  try {
+    return JSON.parse(await promises.readFile(absolutePath, "utf8"))?.lockfileVersion === 1;
+  } catch {
+    return false;
+  }
+}
 function buildNodeGraph(packages) {
   const nodes = [];
   const edges = [];
@@ -35842,37 +36122,37 @@ function buildNodeGraph(packages) {
     if (!entry) continue;
     if (!isNodePath(path)) {
       const importer = path === "" ? "." : path;
-      addRoots(importer, path, entry.dependencies, "prod", packages, roots);
-      addRoots(importer, path, entry.peerDependencies, "prod", packages, roots);
-      addRoots(importer, path, entry.optionalDependencies, "optional", packages, roots);
-      addRoots(importer, path, entry.devDependencies, "dev", packages, roots);
+      addRoots2(importer, path, entry.dependencies, "prod", packages, roots);
+      addRoots2(importer, path, entry.peerDependencies, "prod", packages, roots);
+      addRoots2(importer, path, entry.optionalDependencies, "optional", packages, roots);
+      addRoots2(importer, path, entry.devDependencies, "dev", packages, roots);
       continue;
     }
     const name = entry.name || nameFromNodePath(path);
     if (entry.link === true || !entry.version || !name) continue;
     nodes.push({ id: path, name, version: entry.version });
-    addEdges(path, entry.dependencies, "prod", packages, edges);
-    addEdges(path, entry.optionalDependencies, "optional", packages, edges);
-    addEdges(path, entry.peerDependencies, "peer", packages, edges);
+    addEdges2(path, entry.dependencies, "prod", packages, edges);
+    addEdges2(path, entry.optionalDependencies, "optional", packages, edges);
+    addEdges2(path, entry.peerDependencies, "peer", packages, edges);
   }
   return { nodes, edges, roots };
 }
 function isNodePath(path) {
   return path.startsWith("node_modules/") || path.includes("/node_modules/");
 }
-function addRoots(importer, from, deps, kind, packages, out) {
+function addRoots2(importer, from, deps, kind, packages, out) {
   for (const child of Object.keys(deps || {})) {
-    const nodeId = resolveFrom(from, child, packages);
+    const nodeId = resolveFrom2(from, child, packages);
     if (nodeId !== null) out.push({ importer, nodeId, kind });
   }
 }
-function addEdges(from, deps, kind, packages, out) {
+function addEdges2(from, deps, kind, packages, out) {
   for (const child of Object.keys(deps || {})) {
-    const to = resolveFrom(from, child, packages);
+    const to = resolveFrom2(from, child, packages);
     if (to !== null) out.push({ from, to, kind });
   }
 }
-function resolveFrom(location, child, packages) {
+function resolveFrom2(location, child, packages) {
   let base = location;
   for (; ; ) {
     const candidate = (base === "" ? "" : base + "/") + "node_modules/" + child;
@@ -38990,7 +39270,7 @@ var {
 } = yaml;
 
 // ../../packages/scanners/src/resolver/pnpm.ts
-var NPM_ECOSYSTEM2 = "npm";
+var NPM_ECOSYSTEM3 = "npm";
 async function parsePnpmLock(absolutePath, manifestPath) {
   let text;
   try {
@@ -39063,7 +39343,7 @@ function parsePnpmV9(root, manifestPath) {
       existing.depPaths.push(key);
     } else {
       byId.set(id, {
-        ecosystem: NPM_ECOSYSTEM2,
+        ecosystem: NPM_ECOSYSTEM3,
         name: parsed.name,
         version: parsed.version,
         scope: { isProd, isDev, isOptional },
@@ -39094,7 +39374,7 @@ function parsePnpmLegacy(root, manifestPath) {
     const version2 = entry.version || parsed.version;
     const isDev = entry.dev === true;
     out.push({
-      ecosystem: NPM_ECOSYSTEM2,
+      ecosystem: NPM_ECOSYSTEM3,
       name: parsed.name,
       version: version2,
       scope: { isProd: !isDev, isDev, isOptional: entry.optional === true },
@@ -39825,6 +40105,16 @@ function unauditable3(reasonCode, details) {
 var CRATES_ECOSYSTEM = "crates.io";
 var CRATES_IO_SOURCES = ["registry+https://github.com/rust-lang/crates.io-index", "sparse+https://index.crates.io/"];
 var MAX_MANIFESTS = 1e3;
+function ownCratesOfLock(text) {
+  return parseArrayOfTables(text, "package").flatMap(function ownName(t) {
+    const name = tomlString(t.name);
+    const source = tomlString(t.source);
+    return name !== null && (source === null || source.length === 0) ? [name] : [];
+  });
+}
+function crateNameOfManifest(text) {
+  return tomlString(tomlTable(parseTomlDocument(text).package)?.name);
+}
 async function parseCargoLock(projectPath, absolutePath, manifestPath) {
   let text;
   try {
@@ -40196,11 +40486,19 @@ async function resolveManifest(projectPath, manifest) {
   if (lockless !== null) return { status: "unauditable", ecosystem, reasonCode: "no_lockfile", details: [lockless] };
   if (ecosystem === "npm") {
     if (kind === "package-lock.json") {
-      return wrapNpm(ecosystem, await parseNpmLock(projectPath, absolutePath, manifestPath), kind);
+      const graph = await parseNpmLock(projectPath, absolutePath, manifestPath);
+      if (graph === null && await isNpmLockV1(absolutePath)) {
+        return { status: "unauditable", ecosystem, reasonCode: "unsupported_lockfile", details: [manifestPath + " is lockfileVersion 1, which lists no packages to read: run npm install with npm 7 or later to upgrade it"] };
+      }
+      return wrapNpm(ecosystem, graph, kind);
     }
     if (kind === "pnpm-lock.yaml") {
       return wrapNpm(ecosystem, await parsePnpmLock(absolutePath, manifestPath), kind);
     }
+    if (kind === "bun.lock") return parseBunLock(absolutePath, manifestPath);
+    if (kind === "bun.lockb") {
+      return { status: "unauditable", ecosystem, reasonCode: "unsupported_lockfile", details: [manifestPath + " is Bun's binary lockfile, which cannot be read: run bun install --save-text-lockfile to write bun.lock"] };
+    }
     return { status: "unauditable", ecosystem, reasonCode: "unsupported_lockfile", details: [kind + " is not a supported JavaScript lockfile format"] };
   }
   if (ecosystem === "PyPI") return parsePythonLock(projectPath, kind, absolutePath, manifestPath);
@@ -40255,7 +40553,9 @@ var import_ignore = __toESM(require_ignore());
 var LOCKFILE_TO_PM = {
   "pnpm-lock.yaml": "pnpm",
   "package-lock.json": "npm",
-  "yarn.lock": "yarn"
+  "yarn.lock": "yarn",
+  "bun.lock": "bun",
+  "bun.lockb": "bun"
 };
 var ALWAYS_SKIP = /* @__PURE__ */ new Set(["node_modules", ".git"]);
 var MANIFEST_SKIP = /* @__PURE__ */ new Set(["node_modules", "vendor", ".venv", "venv", "target", "Pods", "build", "dist"]);
@@ -40277,6 +40577,7 @@ function discoverProjectsInTree(options) {
     excludeMatcher,
     hasExcludes: Boolean(options.excludes && options.excludes.length > 0),
     layers,
+    readIgnoreFiles: true,
     onSkip: options.onSkip,
     onError: options.onError,
     ecosystems,
@@ -40296,7 +40597,7 @@ function walk(state) {
   const manifestsOff = owner === state.owner && state.manifestsOff;
   if (owner?.npm && state.subEcosystems.length === 0) return;
   if (state.maxDepth !== null && state.depth >= state.maxDepth) return;
-  const localLayer = loadIgnoreLayer(state.currentDir);
+  const localLayer = state.readIgnoreFiles ? loadIgnoreLayer(state.currentDir) : null;
   const layers = localLayer ? state.layers.concat([localLayer]) : state.layers;
   for (const entry of readEntries(state.currentDir, state.onError)) {
     if (!entry.isDirectory()) continue;
@@ -40360,6 +40661,7 @@ function addManifests(project, found) {
   }
 }
 function finishProject(project, ecosystems) {
+  project.manifests = withoutLockedCrates(project);
   project.manifests.sort(function byDirectory(a, b) {
     return manifestDirOf(a.path).localeCompare(manifestDirOf(b.path));
   });
@@ -40371,6 +40673,30 @@ function finishProject(project, ecosystems) {
     return eco.id;
   });
 }
+function withoutLockedCrates(project) {
+  const bare = project.manifests.filter(function isBare(m) {
+    return m.kind === "Cargo.toml";
+  });
+  if (bare.length === 0) return project.manifests;
+  const locked = /* @__PURE__ */ new Set();
+  for (const m of project.manifests) {
+    if (m.kind !== "Cargo.lock") continue;
+    for (const name of ownCratesOfLock(readFileOrEmpty(path.join(project.absolutePath, m.path)))) locked.add(name);
+  }
+  if (locked.size === 0) return project.manifests;
+  return project.manifests.filter(function uncovered(m) {
+    if (m.kind !== "Cargo.toml") return true;
+    const name = crateNameOfManifest(readFileOrEmpty(path.join(project.absolutePath, m.path)));
+    return name === null || !locked.has(name);
+  });
+}
+function readFileOrEmpty(path) {
+  try {
+    return fs.readFileSync(path, "utf8");
+  } catch {
+    return "";
+  }
+}
 function isNpm(eco) {
   return eco.id === "npm";
 }
@@ -40628,7 +40954,8 @@ function buildFinding(pkg2, advisory, severity, fixVersion, vulnerableRange, aff
     depPath: pkg2.depPaths,
     isProd: pkg2.scope.isProd,
     isDev: pkg2.scope.isDev,
-    aliases: advisory.aliases
+    aliases: advisory.aliases,
+    noticeKind: advisory.noticeKind ?? null
   };
 }
 function rangesToDisplay(ranges, exactVersions) {
@@ -40638,14 +40965,14 @@ function rangesToDisplay(ranges, exactVersions) {
   return parts.join(" || ");
 }
 function mapSeverity(severity) {
-  if (!severity) return "moderate";
+  if (!severity) return "unrated";
   const s = String(severity).trim().toLowerCase();
   if (s === "critical") return "critical";
   if (s === "high") return "high";
   if (s === "moderate" || s === "medium") return "moderate";
   if (s === "low") return "low";
   if (s === "info" || s === "none") return "info";
-  return "moderate";
+  return "unrated";
 }
 
 // ../../packages/scanners/src/osv.ts
@@ -40680,7 +41007,13 @@ function createOsvScanner(deps) {
       durationMs: Date.now() - startedAt
     };
   }
-  return { name: OSV_SCANNER_NAME, scan };
+  return {
+    name: OSV_SCANNER_NAME,
+    scan,
+    aliasEvidence: function aliasEvidence(ecosystem, packageNames) {
+      return deps.isSeeded(ecosystem) ? deps.lookup(ecosystem, packageNames) : null;
+    }
+  };
 }
 function matchPackages(packages, lookup, isSeeded2, isEnabled) {
   const findings = [];
@@ -40717,7 +41050,8 @@ function toCanonicalAdvisory(packageName, ecosystem, advisory) {
     severity: advisory.severity,
     summary: advisory.summary,
     url: advisory.url,
-    withdrawn: advisory.withdrawn
+    withdrawn: advisory.withdrawn,
+    noticeKind: advisory.noticeKind
   };
 }
 function groupByEcosystem(packages) {
@@ -40753,6 +41087,64 @@ function unauditable5(reasonCode, message, startedAt) {
   };
 }
 
+// ../../packages/scanners/src/withdrawn.ts
+function stampWithdrawn(advisories, links) {
+  return advisories.map(function stamp(advisory) {
+    const withdrawn = withdrawnAt(advisory, links);
+    if (withdrawn !== null) return { ...advisory, withdrawn };
+    const osvRecords = liveLinks(advisory, links);
+    return osvRecords.length === 0 ? advisory : { ...advisory, osvRecords };
+  });
+}
+function stampWithdrawnByPackage(byPackage, linksByPackage) {
+  const out = /* @__PURE__ */ new Map();
+  for (const [name, advisories] of byPackage.entries()) {
+    out.set(name, stampWithdrawn(advisories, linksByPackage.get(name) ?? []));
+  }
+  return out;
+}
+function liveLinks(advisory, links) {
+  const identity = /* @__PURE__ */ new Set([advisory.advisoryId, ...advisory.aliases]);
+  return links.filter(function live(link2) {
+    return link2.withdrawn === null && sharesIdentifier(identity, link2);
+  });
+}
+function clearedByOsv(records, version2, comparator, acceptedRangeTypes) {
+  if (records === void 0 || records.length === 0) return false;
+  if (comparator.normalize(version2) === null) return false;
+  return !records.some(function contains(record2) {
+    if (record2.rangesDiscarded === true) return true;
+    if (record2.ranges.length === 0 && record2.versions.length === 0) return true;
+    if (record2.versions.includes(version2)) return true;
+    if (record2.ranges.some(function unreadable(range) {
+      return isRefused(range) || range.type === void 0 || !acceptedRangeTypes.includes(range.type);
+    })) return true;
+    const exact = /* @__PURE__ */ new Set();
+    for (const raw of record2.versions) {
+      const normalized = comparator.normalize(raw);
+      if (normalized === null) return true;
+      exact.add(normalized);
+    }
+    return versionInSet(version2, record2.ranges, exact, comparator, void 0);
+  });
+}
+function withdrawnAt(advisory, links) {
+  const identity = /* @__PURE__ */ new Set([advisory.advisoryId, ...advisory.aliases]);
+  let latest = null;
+  for (const link2 of links) {
+    if (!sharesIdentifier(identity, link2)) continue;
+    if (link2.withdrawn === null) return null;
+    if (latest === null || link2.withdrawn > latest) latest = link2.withdrawn;
+  }
+  return latest;
+}
+function sharesIdentifier(identity, link2) {
+  if (identity.has(link2.advisoryId)) return true;
+  return link2.aliases.some(function inIdentity(alias) {
+    return identity.has(alias);
+  });
+}
+
 // ../../packages/scanners/src/gemnasium.ts
 var GEMNASIUM_SCANNER_NAME = "gemnasium";
 function createGemnasiumScanner(deps) {
@@ -40799,7 +41191,13 @@ function createGemnasiumScanner(deps) {
       durationMs: Date.now() - startedAt
     };
   }
-  return { name: GEMNASIUM_SCANNER_NAME, scan };
+  return {
+    name: GEMNASIUM_SCANNER_NAME,
+    scan,
+    aliasEvidence: function aliasEvidence(ecosystem, packageNames) {
+      return deps.isSeeded() ? deps.lookup(ecosystem, packageNames) : null;
+    }
+  };
 }
 function matchPackages2(packages, lookup, isEnabled) {
   const findings = [];
@@ -40815,7 +41213,13 @@ function matchPackages2(packages, lookup, isEnabled) {
         return toCanonicalAdvisory2(name, ecosystem, advisory);
       }));
     }
-    for (const finding of matchAdvisories(pkgs, byPackage, comparator)) findings.push(finding);
+    const acceptedRangeTypes = acceptedRangeTypesForEcosystem(ecosystem);
+    for (const finding of matchAdvisories(pkgs, byPackage, comparator)) {
+      const advisory = byPackageRaw.get(finding.packageName)?.find(function same(a) {
+        return a.advisoryId === finding.advisoryId;
+      });
+      if (!clearedByOsv(advisory?.osvRecords, finding.installedVersion, comparator, acceptedRangeTypes)) findings.push(finding);
+    }
   }
   return findings;
 }
@@ -40870,37 +41274,6 @@ function unauditable6(reasonCode, message, startedAt) {
   };
 }
 
-// ../../packages/scanners/src/withdrawn.ts
-function stampWithdrawn(advisories, links) {
-  return advisories.map(function stamp(advisory) {
-    const withdrawn = withdrawnAt(advisory, links);
-    return withdrawn === null ? advisory : { ...advisory, withdrawn };
-  });
-}
-function stampWithdrawnByPackage(byPackage, linksByPackage) {
-  const out = /* @__PURE__ */ new Map();
-  for (const [name, advisories] of byPackage.entries()) {
-    out.set(name, stampWithdrawn(advisories, linksByPackage.get(name) ?? []));
-  }
-  return out;
-}
-function withdrawnAt(advisory, links) {
-  const identity = /* @__PURE__ */ new Set([advisory.advisoryId, ...advisory.aliases]);
-  let latest = null;
-  for (const link2 of links) {
-    if (!sharesIdentifier(identity, link2)) continue;
-    if (link2.withdrawn === null) return null;
-    if (latest === null || link2.withdrawn > latest) latest = link2.withdrawn;
-  }
-  return latest;
-}
-function sharesIdentifier(identity, link2) {
-  if (identity.has(link2.advisoryId)) return true;
-  return link2.aliases.some(function inIdentity(alias) {
-    return identity.has(alias);
-  });
-}
-
 // ../../packages/scanners/src/engine/reconcile.ts
 function findingIdentityKeys(finding) {
   const keys = [finding.advisoryId.toLowerCase()];
@@ -40922,6 +41295,9 @@ function reconcileAgainstReported(findings, reportedByPackage, source) {
     const target = firstReported(existing, keys);
     if (target && target.source === source) {
       foldInstallation(target.finding, finding);
+      target.severity = maxSeverity([target.severity, finding.severity]);
+      target.finding.severity = escalatedSeverity(target.severity, target.finding.corroborations ?? []);
+      clearNoticeWhenReal(target.finding, finding);
       target.evidence.push(finding.fixInputs);
       continue;
     }
@@ -40934,6 +41310,7 @@ function reconcileAgainstReported(findings, reportedByPackage, source) {
       })) attached.push(by);
       target.finding.corroborations = attached;
       target.finding.severity = escalatedSeverity(target.severity, attached);
+      clearNoticeWhenReal(target.finding, finding);
       target.evidence.push(finding.fixInputs);
       continue;
     }
@@ -40973,6 +41350,9 @@ function foldInstallation(survivor, copy) {
 function installationsOf(finding) {
   return finding.installations ? finding.installations.slice() : [];
 }
+function clearNoticeWhenReal(survivor, other) {
+  if (!other.noticeKind) survivor.noticeKind = null;
+}
 function firstReported(existing, keys) {
   for (const key of keys) {
     const found = existing.get(key);
@@ -41169,6 +41549,98 @@ async function openDownloadStream(url2, onProgress, options) {
   return { stream, contentLength, lastModified: response.headers["last-modified"] ?? null };
 }
 
+// ../../packages/feeds/src/gemnasium/cvss.ts
+var V3_AV = { N: 0.85, A: 0.62, L: 0.55, P: 0.2 };
+var V3_AC = { L: 0.77, H: 0.44 };
+var V3_UI = { N: 0.85, R: 0.62 };
+var V3_CIA = { H: 0.56, L: 0.22, N: 0 };
+var V3_PR_UNCHANGED = { N: 0.85, L: 0.62, H: 0.27 };
+var V3_PR_CHANGED = { N: 0.85, L: 0.68, H: 0.5 };
+var V2_AV = { L: 0.395, A: 0.646, N: 1 };
+var V2_AC = { H: 0.35, M: 0.61, L: 0.71 };
+var V2_AU = { M: 0.45, S: 0.56, N: 0.704 };
+var V2_CIA = { N: 0, P: 0.275, C: 0.66 };
+function severityFromCvss(cvssV3, cvssV2) {
+  const v3 = parseVector(cvssV3);
+  if (v3) {
+    const score = baseScoreV3(v3);
+    if (score !== null) return bucketV3(score);
+  }
+  const v2 = parseVector(cvssV2);
+  if (v2) {
+    const score = baseScoreV2(v2);
+    if (score !== null) return bucketV2(score);
+  }
+  return null;
+}
+function parseVector(vector) {
+  if (typeof vector !== "string" || vector.trim().length === 0) return null;
+  const out = {};
+  for (const part of vector.trim().split("/")) {
+    const colon = part.indexOf(":");
+    if (colon <= 0) continue;
+    const key = part.slice(0, colon).trim();
+    const value = part.slice(colon + 1).trim().toUpperCase();
+    if (key === "CVSS") continue;
+    out[key] = value;
+  }
+  return Object.keys(out).length > 0 ? out : null;
+}
+function weight(table, key) {
+  if (key === void 0) return void 0;
+  return table[key];
+}
+function baseScoreV3(m) {
+  const av = weight(V3_AV, m.AV);
+  const ac = weight(V3_AC, m.AC);
+  const ui = weight(V3_UI, m.UI);
+  const c = weight(V3_CIA, m.C);
+  const i = weight(V3_CIA, m.I);
+  const a = weight(V3_CIA, m.A);
+  const changed = m.S === "C";
+  const pr = weight(changed ? V3_PR_CHANGED : V3_PR_UNCHANGED, m.PR);
+  if (av === void 0 || ac === void 0 || ui === void 0 || pr === void 0) return null;
+  if (c === void 0 || i === void 0 || a === void 0) return null;
+  const iss = 1 - (1 - c) * (1 - i) * (1 - a);
+  const impact = changed ? 7.52 * (iss - 0.029) - 3.25 * Math.pow(iss - 0.02, 15) : 6.42 * iss;
+  const exploitability = 8.22 * av * ac * pr * ui;
+  if (impact <= 0) return 0;
+  const raw = changed ? 1.08 * (impact + exploitability) : impact + exploitability;
+  return roundUpV3(Math.min(raw, 10));
+}
+function roundUpV3(value) {
+  const intInput = Math.round(value * 1e5);
+  if (intInput % 1e4 === 0) return intInput / 1e5;
+  return (Math.floor(intInput / 1e4) + 1) / 10;
+}
+function bucketV3(score) {
+  if (score === 0) return "info";
+  if (score < 4) return "low";
+  if (score < 7) return "moderate";
+  if (score < 9) return "high";
+  return "critical";
+}
+function baseScoreV2(m) {
+  const av = weight(V2_AV, m.AV);
+  const ac = weight(V2_AC, m.AC);
+  const au = weight(V2_AU, m.Au) ?? weight(V2_AU, m.AU);
+  const c = weight(V2_CIA, m.C);
+  const i = weight(V2_CIA, m.I);
+  const a = weight(V2_CIA, m.A);
+  if (av === void 0 || ac === void 0 || au === void 0) return null;
+  if (c === void 0 || i === void 0 || a === void 0) return null;
+  const impact = 10.41 * (1 - (1 - c) * (1 - i) * (1 - a));
+  const exploitability = 20 * av * ac * au;
+  const f = impact === 0 ? 0 : 1.176;
+  const base = (0.6 * impact + 0.4 * exploitability - 1.5) * f;
+  return Math.round(base * 10) / 10;
+}
+function bucketV2(score) {
+  if (score < 4) return "low";
+  if (score < 7) return "moderate";
+  return "high";
+}
+
 // ../../packages/feeds/src/osv/normalize.ts
 function normalizeOsvRecord(record2, ecosystem) {
   if (!record2 || typeof record2 !== "object") return [];
@@ -41193,10 +41665,14 @@ function normalizeOsvRecord(record2, ecosystem) {
     if (!packageName) continue;
     const ranges = extractRanges(affected.ranges, affected.database_specific?.last_known_affected_version_range, comparator);
     const versions = extractVersions(affected.versions);
+    const noticeKind = noticeKindOf(r.database_specific?.informational) ?? noticeKindOf(affected.database_specific?.informational);
+    const rangesDiscarded = Array.isArray(affected.ranges) && !affected.ranges.every(isReadableRange);
     const existing = byPackage.get(packageName);
     if (existing) {
       for (const range of ranges) existing.ranges.push(range);
       for (const version2 of versions) existing.versions.push(version2);
+      existing.noticeKind ??= noticeKind;
+      if (rangesDiscarded) existing.rangesDiscarded = true;
       continue;
     }
     byPackage.set(packageName, {
@@ -41210,7 +41686,9 @@ function normalizeOsvRecord(record2, ecosystem) {
       summary,
       url: url2,
       malicious,
-      withdrawn
+      withdrawn,
+      noticeKind,
+      ...rangesDiscarded ? { rangesDiscarded } : {}
     });
   }
   for (const row of byPackage.values()) {
@@ -41230,14 +41708,17 @@ function extractVersions(versions) {
   }
   return out;
 }
+function isReadableRange(range) {
+  const type2 = typeof range.type === "string" ? range.type : "SEMVER";
+  return (type2 === "SEMVER" || type2 === "ECOSYSTEM") && Array.isArray(range.events);
+}
 function extractRanges(ranges, lastKnownAffected, comparator) {
   if (!Array.isArray(ranges)) return [];
   const out = [];
   const refused = [];
   for (const range of ranges) {
+    if (!isReadableRange(range)) continue;
     const type2 = typeof range.type === "string" ? range.type : "SEMVER";
-    if (type2 !== "SEMVER" && type2 !== "ECOSYSTEM") continue;
-    if (!Array.isArray(range.events)) continue;
     let introduced = null;
     let lastAffected = null;
     for (const event of range.events) {
@@ -41295,7 +41776,17 @@ function boundOpenEndedRange(ranges, lastKnownAffected, comparator) {
 function pickSeverity2(r) {
   const ds = r.database_specific && r.database_specific.severity;
   if (typeof ds === "string" && ds.length > 0) return ds;
-  return null;
+  if (!Array.isArray(r.severity)) return null;
+  return severityFromCvss(vectorOfType(r.severity, "CVSS_V3"), vectorOfType(r.severity, "CVSS_V2"));
+}
+function vectorOfType(severity, type2) {
+  const entry = severity.find(function ofType(s) {
+    return s.type === type2 && typeof s.score === "string";
+  });
+  return entry?.score ?? null;
+}
+function noticeKindOf(value) {
+  return isNonEmptyString(value) ? value : null;
 }
 function pickUrl(r, advisoryId) {
   if (Array.isArray(r.references)) {
@@ -41425,98 +41916,6 @@ function parseSeedEntry(content, ecosystem) {
 // ../../packages/feeds/src/gemnasium/feed.ts
 var import_unzipper2 = __toESM(require_unzip2());
 
-// ../../packages/feeds/src/gemnasium/cvss.ts
-var V3_AV = { N: 0.85, A: 0.62, L: 0.55, P: 0.2 };
-var V3_AC = { L: 0.77, H: 0.44 };
-var V3_UI = { N: 0.85, R: 0.62 };
-var V3_CIA = { H: 0.56, L: 0.22, N: 0 };
-var V3_PR_UNCHANGED = { N: 0.85, L: 0.62, H: 0.27 };
-var V3_PR_CHANGED = { N: 0.85, L: 0.68, H: 0.5 };
-var V2_AV = { L: 0.395, A: 0.646, N: 1 };
-var V2_AC = { H: 0.35, M: 0.61, L: 0.71 };
-var V2_AU = { M: 0.45, S: 0.56, N: 0.704 };
-var V2_CIA = { N: 0, P: 0.275, C: 0.66 };
-function severityFromCvss(cvssV3, cvssV2) {
-  const v3 = parseVector(cvssV3);
-  if (v3) {
-    const score = baseScoreV3(v3);
-    if (score !== null) return bucketV3(score);
-  }
-  const v2 = parseVector(cvssV2);
-  if (v2) {
-    const score = baseScoreV2(v2);
-    if (score !== null) return bucketV2(score);
-  }
-  return null;
-}
-function parseVector(vector) {
-  if (typeof vector !== "string" || vector.trim().length === 0) return null;
-  const out = {};
-  for (const part of vector.trim().split("/")) {
-    const colon = part.indexOf(":");
-    if (colon <= 0) continue;
-    const key = part.slice(0, colon).trim();
-    const value = part.slice(colon + 1).trim().toUpperCase();
-    if (key === "CVSS") continue;
-    out[key] = value;
-  }
-  return Object.keys(out).length > 0 ? out : null;
-}
-function weight(table, key) {
-  if (key === void 0) return void 0;
-  return table[key];
-}
-function baseScoreV3(m) {
-  const av = weight(V3_AV, m.AV);
-  const ac = weight(V3_AC, m.AC);
-  const ui = weight(V3_UI, m.UI);
-  const c = weight(V3_CIA, m.C);
-  const i = weight(V3_CIA, m.I);
-  const a = weight(V3_CIA, m.A);
-  const changed = m.S === "C";
-  const pr = weight(changed ? V3_PR_CHANGED : V3_PR_UNCHANGED, m.PR);
-  if (av === void 0 || ac === void 0 || ui === void 0 || pr === void 0) return null;
-  if (c === void 0 || i === void 0 || a === void 0) return null;
-  const iss = 1 - (1 - c) * (1 - i) * (1 - a);
-  const impact = changed ? 7.52 * (iss - 0.029) - 3.25 * Math.pow(iss - 0.02, 15) : 6.42 * iss;
-  const exploitability = 8.22 * av * ac * pr * ui;
-  if (impact <= 0) return 0;
-  const raw = changed ? 1.08 * (impact + exploitability) : impact + exploitability;
-  return roundUpV3(Math.min(raw, 10));
-}
-function roundUpV3(value) {
-  const intInput = Math.round(value * 1e5);
-  if (intInput % 1e4 === 0) return intInput / 1e5;
-  return (Math.floor(intInput / 1e4) + 1) / 10;
-}
-function bucketV3(score) {
-  if (score === 0) return "info";
-  if (score < 4) return "low";
-  if (score < 7) return "moderate";
-  if (score < 9) return "high";
-  return "critical";
-}
-function baseScoreV2(m) {
-  const av = weight(V2_AV, m.AV);
-  const ac = weight(V2_AC, m.AC);
-  const au = weight(V2_AU, m.Au) ?? weight(V2_AU, m.AU);
-  const c = weight(V2_CIA, m.C);
-  const i = weight(V2_CIA, m.I);
-  const a = weight(V2_CIA, m.A);
-  if (av === void 0 || ac === void 0 || au === void 0) return null;
-  if (c === void 0 || i === void 0 || a === void 0) return null;
-  const impact = 10.41 * (1 - (1 - c) * (1 - i) * (1 - a));
-  const exploitability = 20 * av * ac * au;
-  const f = impact === 0 ? 0 : 1.176;
-  const base = (0.6 * impact + 0.4 * exploitability - 1.5) * f;
-  return Math.round(base * 10) / 10;
-}
-function bucketV2(score) {
-  if (score < 4) return "low";
-  if (score < 7) return "moderate";
-  return "high";
-}
-
 // ../../packages/feeds/src/gemnasium/normalize.ts
 function normalizeGemnasiumRecord(record2, ecosystem, slugPrefix) {
   if (!record2 || typeof record2 !== "object") return [];
@@ -55734,8 +56133,13 @@ function pickReleasedFix(args) {
     patched.push(range);
   }
   const stated = statedFixVersions(args.evidence, comparator);
-  let lowest = null;
-  let lowestCurrent = null;
+  function lowest(current, candidate) {
+    return current === null || comparator.lt(candidate.version, current.version) ? candidate : current;
+  }
+  let tagged = null;
+  let taggedCurrent = null;
+  let pseudo = null;
+  let pseudoCurrent = null;
   for (const p of args.published) {
     const v = comparator.normalize(p.version);
     if (v === null) continue;
@@ -55749,10 +56153,15 @@ function pickReleasedFix(args) {
       return evaluableContains(ev, v);
     })) continue;
     const candidate = { version: v, spelled: p.version };
-    if (lowest === null || comparator.lt(v, lowest.version)) lowest = candidate;
-    if (!p.deprecated && (lowestCurrent === null || comparator.lt(v, lowestCurrent.version))) lowestCurrent = candidate;
+    if (kind === "pseudo") {
+      pseudo = lowest(pseudo, candidate);
+      if (!p.deprecated) pseudoCurrent = lowest(pseudoCurrent, candidate);
+    } else {
+      tagged = lowest(tagged, candidate);
+      if (!p.deprecated) taggedCurrent = lowest(taggedCurrent, candidate);
+    }
   }
-  const chosen = lowestCurrent ?? lowest;
+  const chosen = taggedCurrent ?? tagged ?? pseudoCurrent ?? pseudo;
   if (chosen === null) return { kind: "none" };
   return { kind: "released", version: chosen.spelled };
 }
@@ -56215,7 +56624,8 @@ function toOsvAdvisory(row) {
     summary: row.summary,
     url: row.url,
     malicious: row.malicious,
-    withdrawn: row.withdrawn
+    withdrawn: row.withdrawn,
+    noticeKind: row.noticeKind ?? null
   };
 }
 function toGemnasiumAdvisory(row) {
@@ -56995,7 +57405,7 @@ function explicitFlagNames(argv) {
   return out;
 }
 function emptyCounts() {
-  return { critical: 0, high: 0, moderate: 0, low: 0, info: 0 };
+  return { critical: 0, high: 0, moderate: 0, unrated: 0, low: 0, info: 0 };
 }
 function matchesDepType(finding, depType) {
   if (depType === "all") return true;
@@ -57005,6 +57415,7 @@ function matchesDepType(finding, depType) {
 function summarize(results, options) {
   const projects = [];
   const findings = [];
+  const notices = [];
   const total = emptyCounts();
   let totalFindings = 0;
   for (const result of results) {
@@ -57012,26 +57423,30 @@ function summarize(results, options) {
     let projectFindings = 0;
     for (const finding of result.findings) {
       if (!matchesDepType(finding, options.depType)) continue;
-      if (!meetsSeverityFloor(finding.severity, options.minSeverity)) continue;
-      counts[finding.severity]++;
-      total[finding.severity]++;
-      projectFindings++;
-      totalFindings++;
+      if (!finding.noticeKind && !meetsSeverityFloor(finding.severity, options.minSeverity)) continue;
+      if (!finding.noticeKind) {
+        counts[finding.severity]++;
+        total[finding.severity]++;
+        projectFindings++;
+        totalFindings++;
+      }
       const fix = result.fixes.get(finding);
-      findings.push({
+      const list = finding.noticeKind ? notices : findings;
+      list.push({
         // npm-audit builds its findings without an ecosystem; it only ever reports npm packages.
         ecosystem: finding.ecosystem ?? DEFAULT_ECOSYSTEM,
         packageName: finding.packageName,
         installedVersion: finding.installedVersion,
         // scanProject records the installations of every finding it keeps.
         installations: result.installations.get(finding),
-        fixAvailable: fix.fixAvailable,
-        fixVersion: fix.fixVersion,
-        fixStatus: fix.fixStatus,
-        fixCheck: fix.fixCheck,
+        fixAvailable: fix?.fixAvailable ?? false,
+        fixVersion: fix?.fixVersion ?? null,
+        fixStatus: fix?.fixStatus ?? "unverified",
+        fixCheck: fix?.fixCheck ?? null,
         // Only a finding settled 'none_released' has one.
         remediation: result.remediations.get(finding) ?? null,
         severity: finding.severity,
+        noticeKind: finding.noticeKind ?? null,
         advisoryId: finding.advisoryId,
         advisoryTitle: finding.advisoryTitle,
         advisoryUrl: finding.advisoryUrl,
@@ -57057,7 +57472,7 @@ function summarize(results, options) {
       scanState: result.scanState
     });
   }
-  return { projects, totalFindings, counts: total, findings };
+  return { projects, totalFindings, counts: total, findings, notices };
 }
 async function resolvePrompt(options) {
   if (!options.includePrompt) return "";
@@ -57079,7 +57494,7 @@ function renderMarkdown(summary, options, prompt, generatedAt) {
   return buildAdvisoryMarkdown({
     scope: buildScope(options, summary.projects.length),
     prompt,
-    findings: summary.findings,
+    findings: [...summary.findings, ...summary.notices],
     generatedAt,
     // Only the projects that could not be (fully) scanned are rendered, in their own section.
     scanStates: summary.projects.map(function state(p) {
@@ -57109,7 +57524,8 @@ function renderJson(summary, options, generatedAt) {
         scanState: labelScanState(p.scanState)
       };
     }),
-    findings: summary.findings
+    findings: summary.findings,
+    notices: summary.notices
   }, null, 2) + "\n";
 }
 function hasUnavailableSource(summary) {
@@ -57266,7 +57682,7 @@ async function scanProject(setup, resolved2, scanners) {
   for (const scanner of scanners) {
     for (const ecosystem of ecosystems) {
       if (setup.abortSignal && setup.abortSignal.aborted) break;
-      if (!cellRuns(setup, scanner.name, ecosystem)) continue;
+      if (!cellRuns(setup, scanner.name, ecosystem) || !sourceAppliesToPackageManager(scanner.name, resolved2.project.packageManager)) continue;
       const isNpmAudit = scanner.name === NPM_AUDIT_SCANNER_NAME2;
       const cell = resolved2.manifests.filter(function of(m) {
         return m.result.ecosystem === ecosystem;
@@ -57319,7 +57735,10 @@ async function scanProject(setup, resolved2, scanners) {
     }
   }
   const settled = await settleProject({
-    findings: [...survivors.values()],
+    // A notice has no fix to chase, so it is not settled.
+    findings: [...survivors.values()].filter(function vulnerability(reported) {
+      return !reported.finding.noticeKind;
+    }),
     evidence,
     graph: resolved2.npmGraph,
     registry: setup.registry,
@@ -57330,7 +57749,8 @@ async function scanProject(setup, resolved2, scanners) {
   const installations = /* @__PURE__ */ new Map();
   for (const [finding, reported] of survivors) {
     const key = fixEvidenceKey(reported);
-    fixes.set(finding, settled.settlements.get(key));
+    const settlement = settled.settlements.get(key);
+    if (settlement) fixes.set(finding, settlement);
     const remediation = settled.remediations.get(key);
     if (remediation) remediations.set(finding, remediation);
     installations.set(finding, installationsFor(finding, resolved2.npmGraph));
@@ -57365,7 +57785,7 @@ function cliScanState(setup, resolved2, scanners, outcomes) {
   const expectedCells = [];
   for (const scanner of scanners) {
     for (const ecosystem of ecosystems) {
-      if (cellRuns(setup, scanner.name, ecosystem)) expectedCells.push({ source: scanner.name, ecosystem });
+      if (cellRuns(setup, scanner.name, ecosystem) && sourceAppliesToPackageManager(scanner.name, resolved2.project.packageManager)) expectedCells.push({ source: scanner.name, ecosystem });
     }
   }
   return projectScanState({
@@ -57409,7 +57829,7 @@ var PLAIN = {
   green: "",
   cyan: ""
 };
-var SEVERITY_ORDER = ["critical", "high", "moderate", "low", "info"];
+var SEVERITY_ORDER = ["critical", "high", "moderate", "unrated", "low", "info"];
 function formatBytes(bytes, estimated = false) {
   if (bytes === null) return "unknown size";
   const prefix = estimated ? "~" : "";
@@ -57445,7 +57865,7 @@ function createUi(options) {
   function severityColor(severity) {
     if (severity === "critical") return c.red;
     if (severity === "high") return c.magenta;
-    if (severity === "moderate") return c.yellow;
+    if (severity === "moderate" || severity === "unrated") return c.yellow;
     if (severity === "low") return c.blue;
     return c.dim;
   }
@@ -57712,6 +58132,9 @@ function createUi(options) {
         write("    " + project.relPath.padEnd(38).slice(0, 38) + "  " + breakdown);
       }
     }
+    if (runSummary.notices.length > 0) {
+      write("  " + c.dim + runSummary.notices.length + " notice" + (runSummary.notices.length === 1 ? "" : "s") + " (unmaintained, unsound), not vulnerabilities: listed in the report, in no count above." + c.reset);
+    }
     if (unscanned.length > 0) {
       const cannot = runSummary.projects.filter(function cannotScan(p) {
         return p.scanState.state === "cannot_scan";
@@ -57773,8 +58196,8 @@ function createUi(options) {
 
 // src/help.ts
 var CLI_VERSION = (function resolveVersion() {
-  if ("3.8.0".length > 0) {
-    return "3.8.0";
+  if ("3.8.2".length > 0) {
+    return "3.8.2";
   }
   const fromEnv = process.env.SENTINELLO_VERSION;
   if (fromEnv && fromEnv.trim().length > 0) return fromEnv.trim();