fix(reporting): drop the static-analysis disclaimer from dependency evidence

2026-11-09 05:19:39 -10:00 · 2026-10-13 12:05:27 -04:00
2 changed files with 0 additions and 5 deletions
@@ -1876,10 +1876,6 @@ def _build_dependency_evidence(
        evidence += f"\n\n**Usage analysis:** {label}."
        if reachability_evidence and reachability_evidence.strip():
            evidence += f" {reachability_evidence.strip()}"
-        evidence += (
-            " This is a prioritization signal from static analysis, not a"
-            " proof of exploitability or of safety."
-        )
    return evidence


@@ -663,7 +663,6 @@ async def test_dependency_report_records_reachability(report_state: ReportState)
        == "src/render.ts:14 calls `_.template()`."
    )
    assert "**Usage analysis:**" in report["evidence"]
-    assert "not a proof of exploitability or of safety" in report["evidence"]
    # The level must never influence the rating — that comes from the contextual
    # breakdown, or from advisory_cvss when no breakdown applies.
    assert report["severity"] == "high"