From f95b8a145cbcc259ef7a9605d7c6f705544f54b6 Mon Sep 17 00:00:00 2001 From: Ahmed Allam Date: Tue, 4 Aug 2026 19:05:45 +0000 Subject: [PATCH] feat(reporting): render transitive dependency chain in dependency evidence --- strix/tools/reporting/tool.py | 11 +++++++++++ tests/test_reporting_fields.py | 8 ++++++++ 2 files changed, 19 insertions(+) diff --git a/strix/tools/reporting/tool.py b/strix/tools/reporting/tool.py index a44d93bc..a1425315 100644 --- a/strix/tools/reporting/tool.py +++ b/strix/tools/reporting/tool.py @@ -749,6 +749,8 @@ def _build_dependency_evidence( package_name: str, installed_version: str, fixed_version: str | None, + introduced_by: str | None, + dependency_path: str | None, ) -> str: evidence = ( f"**Advisory evidence:** `{cve}` applies to `{package_name}` " @@ -756,6 +758,13 @@ def _build_dependency_evidence( ) if fixed_version and fixed_version.strip(): evidence += f" The advisory is fixed in `{fixed_version.strip()}`." + if introduced_by and introduced_by.strip(): + evidence += ( + f"\n\n**Transitive dependency:** introduced by the direct " + f"dependency `{introduced_by.strip()}`." + ) + if dependency_path and dependency_path.strip(): + evidence += f"\n\n**Dependency chain:** `{dependency_path.strip()}`" return evidence @@ -840,6 +849,8 @@ async def _do_create_dependency( # noqa: PLR0912 package_name=package_name.strip(), installed_version=installed_version.strip(), fixed_version=fixed_version, + introduced_by=introduced_by, + dependency_path=dependency_path, ) try: diff --git a/tests/test_reporting_fields.py b/tests/test_reporting_fields.py index 85dfb979..7bef970b 100644 --- a/tests/test_reporting_fields.py +++ b/tests/test_reporting_fields.py @@ -191,6 +191,14 @@ async def test_dependency_report_records_transitive_chain(report_state: ReportSt report["dependency_metadata"]["dependency_path"] == "express@4.18.1 > body-parser@1.20.0 > qs@6.10.2" ) + assert ( + "**Transitive dependency:** introduced by the direct dependency `express@4.18.1`." + in report["evidence"] + ) + assert ( + "**Dependency chain:** `express@4.18.1 > body-parser@1.20.0 > qs@6.10.2`" + in report["evidence"] + ) async def test_dependency_report_omits_blank_chain_fields(report_state: ReportState) -> None: