From 9ebeffbc744378bf637813e15bec31b55686417b Mon Sep 17 00:00:00 2001 From: yoni Date: Mon, 9 Nov 2026 02:25:28 +0000 Subject: [PATCH] skills: a loaded package is never not_applicable --- strix/skills/custom/dependency_cve_scanning.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/strix/skills/custom/dependency_cve_scanning.md b/strix/skills/custom/dependency_cve_scanning.md index 5e8316272..e52fb64a0 100644 --- a/strix/skills/custom/dependency_cve_scanning.md +++ b/strix/skills/custom/dependency_cve_scanning.md @@ -141,6 +141,13 @@ so finish the analysis before you file. blob, a private bundle with no source) and nothing you can inspect reaches it. Evidence: the search scope and the negative result. +A loaded package is never `not_applicable`: once the shipped code imports or +links it, each advisory is `reachable` or `not_reachable` by its own path +(an unused server mode of a client-only `ws` import is `not_reachable`). The +only `not_applicable` cases for a loaded package are a patched or unaffected +installed copy and a platform this code does not run on. Sibling advisories +on one package share the "loaded or not" fact and differ only in the symbol. + The verdict is per CVE, not per package. Sibling CVEs on one package usually affect different symbols or modes (one hits a parser, another a header check): run the check against each advisory's own affected functions and