scriptoriumadmin/strix
1
0
Fork 0
mirror of https://github.com/usestrix/strix.git synced 2026-10-15 04:18:10 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

fix(reporting): drop the static-analysis disclaimer from dependency evidence (#1520)

Browse source
This commit is contained in:
yoni-at-strix 2026-10-14 10:59:11 -04:00 • committed by GitHub
parent 956a26715b
commit 87f2d783d6
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 0 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
strix/tools/reporting/tool.py
View file

@ -1876,10 +1876,6 @@ def _build_dependency_evidence(
evidence += f"\n\n**Usage analysis:** {label}."
if reachability_evidence and reachability_evidence.strip():
evidence += f" {reachability_evidence.strip()}"
evidence += (
" This is a prioritization signal from static analysis, not a"
" proof of exploitability or of safety."
)
return evidence

1
tests/test_reporting_fields.py
View file

@ -663,7 +663,6 @@ async def test_dependency_report_records_reachability(report_state: ReportState)
== "src/render.ts:14 calls `_.template()`."
)
assert "**Usage analysis:**" in report["evidence"]
assert "not a proof of exploitability or of safety" in report["evidence"]
# The level must never influence the rating — that comes from the contextual
# breakdown, or from advisory_cvss when no breakdown applies.
assert report["severity"] == "high"