From c93a4dc3e8a777dc90fdb4c54fdad7c1c576dccf Mon Sep 17 00:00:00 2001 From: Ahmed Allam Date: Tue, 4 Aug 2026 19:12:17 +0000 Subject: [PATCH] feat(reporting): surface dependency chain in markdown, SARIF, and TUI outputs --- strix/interface/tui/internal/app/vuln_report.go | 2 ++ strix/interface/tui/internal/app/vulnerabilities.go | 2 ++ strix/report/sarif.py | 4 ++++ strix/report/writer.py | 2 ++ 4 files changed, 10 insertions(+) diff --git a/strix/interface/tui/internal/app/vuln_report.go b/strix/interface/tui/internal/app/vuln_report.go index b7749805..2f460926 100644 --- a/strix/interface/tui/internal/app/vuln_report.go +++ b/strix/interface/tui/internal/app/vuln_report.go @@ -74,6 +74,8 @@ func vulnerabilityMarkdownReport(v map[string]any) string { field("Ecosystem", render.StringValue(dep["package_ecosystem"])) field("Installed Version", render.StringValue(dep["installed_version"])) field("Fixed Version", render.StringValue(dep["fixed_version"])) + field("Introduced By", render.StringValue(dep["introduced_by"])) + field("Dependency Chain", render.StringValue(dep["dependency_path"])) } field("Endpoint", render.StringValue(v["endpoint"])) field("Method", render.StringValue(v["method"])) diff --git a/strix/interface/tui/internal/app/vulnerabilities.go b/strix/interface/tui/internal/app/vulnerabilities.go index 12b057d5..0d4f23b4 100644 --- a/strix/interface/tui/internal/app/vulnerabilities.go +++ b/strix/interface/tui/internal/app/vulnerabilities.go @@ -298,6 +298,8 @@ func vulnerabilityBody(v map[string]any) string { field("Ecosystem", render.StringValue(dep["package_ecosystem"])) field("Installed Version", render.StringValue(dep["installed_version"])) field("Fixed Version", render.StringValue(dep["fixed_version"])) + field("Introduced By", render.StringValue(dep["introduced_by"])) + field("Dependency Chain", render.StringValue(dep["dependency_path"])) } field("Endpoint", render.StringValue(v["endpoint"])) field("Method", render.StringValue(v["method"])) diff --git a/strix/report/sarif.py b/strix/report/sarif.py index 6d5db177..fc6e05db 100644 --- a/strix/report/sarif.py +++ b/strix/report/sarif.py @@ -531,6 +531,10 @@ def _result_properties( if value not in (None, ""): strix[key] = value + dependency_metadata = report.get("dependency_metadata") + if isinstance(dependency_metadata, dict) and dependency_metadata: + strix["dependency_metadata"] = dependency_metadata + # SARIF is written for external upload (code-scanning / ASPM), so it must # NOT carry the weaponized exploit payload — that stays a local run # artifact (vulnerabilities.json / the finding MD). We surface the PoC diff --git a/strix/report/writer.py b/strix/report/writer.py index 1b0a8a1d..ec592f14 100644 --- a/strix/report/writer.py +++ b/strix/report/writer.py @@ -205,6 +205,8 @@ def render_vulnerability_md(report: dict[str, Any]) -> str: # noqa: PLR0912, PL ("Ecosystem", dep_meta.get("package_ecosystem")), ("Installed Version", dep_meta.get("installed_version")), ("Fixed Version", dep_meta.get("fixed_version")), + ("Introduced By", dep_meta.get("introduced_by")), + ("Dependency Chain", dep_meta.get("dependency_path")), ("Endpoint", report.get("endpoint")), ("Method", report.get("method")), ("CVE", report.get("cve")),