A dependency CVE can now be filed with reachability=not_reached: the
package is imported, but the usage analysis showed that the vulnerable
code of this advisory does not run in the codebase. It sits between
imported and not_imported on the evidence ladder and is decided per
advisory, with the check that showed it in reachability_evidence.
The dependency-cve-scanning skill explains when the level applies
(govulncheck finds no path, the parent of a transitive package never
references the affected API, the only call site is behind a condition
that is false here, build-only tooling) and keeps a partial or skipped
search at imported.
Verifying http_exchange_ids fetched every request with its full raw
request and response bodies, serially, and timed out on busy proxy
projects; the ids were then dropped and the finding lost its evidence.
Check existence with an id-only GraphQL query, retry once, and when the
proxy still does not answer keep the ids with a warning instead of
discarding them.
Every renderer of the final report already titles each section, so the
heading the docstring asked for printed twice. Describe the fields as
section bodies and drop the example headings.
