From 87f2d783d6595d0aa557809e02c67d94e52bda05 Mon Sep 17 00:00:00 2001 From: yoni-at-strix Date: Wed, 14 Oct 2026 10:59:11 -0400 Subject: [PATCH] fix(reporting): drop the static-analysis disclaimer from dependency evidence (#1520) --- strix/tools/reporting/tool.py | 4 ---- tests/test_reporting_fields.py | 1 - 2 files changed, 5 deletions(-) diff --git a/strix/tools/reporting/tool.py b/strix/tools/reporting/tool.py index d2d9a688..791bae79 100644 --- a/strix/tools/reporting/tool.py +++ b/strix/tools/reporting/tool.py @@ -1876,10 +1876,6 @@ def _build_dependency_evidence( evidence += f"\n\n**Usage analysis:** {label}." if reachability_evidence and reachability_evidence.strip(): evidence += f" {reachability_evidence.strip()}" - evidence += ( - " This is a prioritization signal from static analysis, not a" - " proof of exploitability or of safety." - ) return evidence diff --git a/tests/test_reporting_fields.py b/tests/test_reporting_fields.py index 258fef1c..558a2b64 100644 --- a/tests/test_reporting_fields.py +++ b/tests/test_reporting_fields.py @@ -663,7 +663,6 @@ async def test_dependency_report_records_reachability(report_state: ReportState) == "src/render.ts:14 calls `_.template()`." ) assert "**Usage analysis:**" in report["evidence"] - assert "not a proof of exploitability or of safety" in report["evidence"] # The level must never influence the rating — that comes from the contextual # breakdown, or from advisory_cvss when no breakdown applies. assert report["severity"] == "high"