scriptoriumadmin/strix
1
0
Fork 0
mirror of https://github.com/usestrix/strix.git synced 2026-11-02 07:12:37 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

chore(report): log the confirmed-in-range emit so the check is observable in scan logs

Browse source 
An in-range (real) finding was emitted silently, giving a scan log no evidence the
version-range check ran. Add an INFO line on the confirmed-emit path, mirroring the
reject / coverage-gap logs.
This commit is contained in:
Sean Turner 2026-08-03 08:28:27 +01:00
parent 1b850d3f6c
commit 8af0d81418
No known key found for this signature in database
1 changed files with 2 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
strix/report/dep_verify.py
View file

@ -157,6 +157,8 @@ def verify_dependency( # noqa: PLR0911 — the returns are deliberate fail-open
if affecting is None:
return None # provider couldn't answer → fail open, emit
if ident in affecting:
logger.info("dep-verify: %s confirmed in range for %s@%s; emitting (real)",
ident, pkg, version)
return None # confirmed: installed version IS in the CVE's range → emit (real)
if not affecting:
# definitive "no advisories affect this version" is still a coverage-gap