From 5713ebc14be7eb0a7dffba8826ab6a349c2bf9b4 Mon Sep 17 00:00:00 2001 From: Jonathan Singer Date: Tue, 13 Oct 2026 12:05:27 -0400 Subject: [PATCH] fix(reporting): drop the static-analysis disclaimer from dependency evidence --- strix/tools/reporting/tool.py | 4 ---- tests/test_reporting_fields.py | 1 - 2 files changed, 5 deletions(-) diff --git a/strix/tools/reporting/tool.py b/strix/tools/reporting/tool.py index d2d9a688..791bae79 100644 --- a/strix/tools/reporting/tool.py +++ b/strix/tools/reporting/tool.py @@ -1876,10 +1876,6 @@ def _build_dependency_evidence( evidence += f"\n\n**Usage analysis:** {label}." if reachability_evidence and reachability_evidence.strip(): evidence += f" {reachability_evidence.strip()}" - evidence += ( - " This is a prioritization signal from static analysis, not a" - " proof of exploitability or of safety." - ) return evidence diff --git a/tests/test_reporting_fields.py b/tests/test_reporting_fields.py index 258fef1c..558a2b64 100644 --- a/tests/test_reporting_fields.py +++ b/tests/test_reporting_fields.py @@ -663,7 +663,6 @@ async def test_dependency_report_records_reachability(report_state: ReportState) == "src/render.ts:14 calls `_.template()`." ) assert "**Usage analysis:**" in report["evidence"] - assert "not a proof of exploitability or of safety" in report["evidence"] # The level must never influence the rating — that comes from the contextual # breakdown, or from advisory_cvss when no breakdown applies. assert report["severity"] == "high"