From 8af0d81418f239a0cb227729ff4fc971e90a2003 Mon Sep 17 00:00:00 2001 From: Sean Turner Date: Mon, 3 Aug 2026 08:28:27 +0100 Subject: [PATCH] chore(report): log the confirmed-in-range emit so the check is observable in scan logs An in-range (real) finding was emitted silently, giving a scan log no evidence the version-range check ran. Add an INFO line on the confirmed-emit path, mirroring the reject / coverage-gap logs. --- strix/report/dep_verify.py | 2 ++ 1 file changed, 2 insertions(+) diff --git a/strix/report/dep_verify.py b/strix/report/dep_verify.py index 48c207fc7..8d5b8b504 100644 --- a/strix/report/dep_verify.py +++ b/strix/report/dep_verify.py @@ -157,6 +157,8 @@ def verify_dependency( # noqa: PLR0911 — the returns are deliberate fail-open if affecting is None: return None # provider couldn't answer → fail open, emit if ident in affecting: + logger.info("dep-verify: %s confirmed in range for %s@%s; emitting (real)", + ident, pkg, version) return None # confirmed: installed version IS in the CVE's range → emit (real) if not affecting: # definitive "no advisories affect this version" is still a coverage-gap