feat(triage-security): clarify transitive dependency remediation in task templates

[ruromero]

Summary

• Add two-tier remediation guidance (direct dep bump vs transitive dep pinning) to upstream backport and downstream propagation templates in remediation-templates.md
• Expand Step 2.3.5 in version-impact-analysis.md with remediation decision implications for direct vs transitive dependencies and add separate example outputs for each type
• Add transitive dependency documentation rule to SKILL.md Remediation Task Creation section
• Add eval scenario 28 with a transitive dependency CVE fixture (h2 via reqwest → hyper → h2)
• Fix eval-14 regression: remove prompt instruction to write separate sbom-verification.md file and strengthen Step 2.3.5 output requirement to prohibit separate SBOM output files (TC-5073)
• Fix eval-4 regression: add guard clause to Step 8 Case B making it explicit that cross-stream impact checks apply only to scoped issues, not unscoped ones (TC-5074)

Implements TC-4908

Test plan

• Run eval scenario 28 (vuln-issue-transitive.md) and verify remediation output includes full dependency chain and two-tier approach
• Verify existing eval scenarios still pass (no regressions from template changes)
• Review that remediation-templates.md correctly distinguishes direct vs transitive in both upstream and downstream templates
• Run eval-14 and verify assertion 5 (SBOM presentation format) passes consistently
• Run eval-4 and verify assertion 5 (unscoped cross-stream reasoning) passes consistently

🤖 Generated with Claude Code

[sourcery-ai]

Reviewer's Guide

Clarifies remediation guidance for direct vs transitive dependencies in triage-security docs and templates, and adds an evaluation fixture for a transitive dependency CVE scenario.

Flow diagram for remediation approach based on dependency type

flowchart TD
  Start["Inspect dependency in Step 2.3.5"] --> Type{Direct vs transitive}

  Type -->|direct| DirectRemediation["Remediation: bump direct dependency version in manifest/lock file"]
  Type -->|transitive| TransitiveTier1["Preferred: bump direct dependency that pulls in vulnerable package"]

  TransitiveTier1 --> Viable{Direct dep bump viable?}
  Viable -->|yes| TransitiveRemediation1["Apply direct dep bump; dependency chain recorded in task"]
  Viable -->|no| TransitiveRemediation2["Fallback: pin transitive dependency directly (cargo add / overrides / resolutions)"]

  DirectRemediation --> End["Document remediation in task using templates"]
  TransitiveRemediation1 --> End
  TransitiveRemediation2 --> End

Loading

File-Level Changes

Change	Details	Files
Refine upstream remediation task template with explicit direct vs transitive dependency handling and two-tier remediation strategy.	Introduce a dependency type field indicating direct vs transitive with chain context. Split implementation notes into separate sections for direct and transitive dependency remediation. Define preferred remediation via direct dependency bump and fallback via explicit transitive dependency pinning with ecosystem-specific examples (Cargo, npm, yarn/pnpm). Add requirement to document why a direct dependency bump is not viable when falling back to pinning.	plugins/sdlc-workflow/skills/triage-security/remediation-templates.md
Update downstream propagation template to carry dependency type and enforce consistency when upstream fixes use transitive pinning.	Add dependency type field to downstream implementation notes, carried from upstream task. Require verification that upstream transitive pins are reflected in downstream lock files after source reference updates.	plugins/sdlc-workflow/skills/triage-security/remediation-templates.md
Expand version impact analysis guidance to connect dependency chain investigation to remediation strategy with distinct examples for direct and transitive dependencies.	Clarify that dependency chain determines remediation approach and reference remediation templates. Elaborate direct vs transitive classification with associated remediation actions (bump vs two-tier strategy). Emphasize recording full dependency chain for transitive cases so engineers know which direct dependency to bump. Replace single example output with separate direct and transitive dependency examples including remediation notes.	plugins/sdlc-workflow/skills/triage-security/version-impact-analysis.md
Strengthen SKILL remediation task creation rules to mandate documenting chains and two-tier strategy for transitive dependencies.	Require remediation tasks for transitive dependencies to include full dependency chain from version impact analysis. Specify that tasks must state preferred direct dependency bump and fallback transitive pinning, including potential coordination with intermediate package maintainers.	plugins/sdlc-workflow/skills/triage-security/SKILL.md
Add an eval scenario file for a transitive dependency vulnerability to validate the new documentation and remediation behavior.	Introduce synthetic Jira vulnerability issue fixture modeling h2 as a transitive dependency via reqwest → hyper → h2. Provide mock dependency chain, manifest, and lockfile evidence matching the transitive scenario for use by Step 2.3.5. Reference fixed vs affected versions to exercise remediation logic around direct dep bump vs transitive pinning.	evals/triage-security/evals.json evals/triage-security/files/vuln-issue-transitive.md

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

Hey - I've found 1 issue, and left some high level feedback:

• In the transitive remediation section, consider explicitly tying the recorded dependency chain from Step 2.3.5 into the upstream template’s acceptance criteria (e.g., requiring the chain to be present in the task description) to make the expectation enforceable.
• The two-tier remediation examples currently focus on Cargo and npm; if other ecosystems (e.g., Maven, Pip) are in scope for this skill, it may be worth briefly noting their equivalent pinning strategies to avoid ambiguity for non-JS/Rust cases.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- In the transitive remediation section, consider explicitly tying the recorded dependency chain from Step 2.3.5 into the upstream template’s acceptance criteria (e.g., requiring the chain to be present in the task description) to make the expectation enforceable.
- The two-tier remediation examples currently focus on Cargo and npm; if other ecosystems (e.g., Maven, Pip) are in scope for this skill, it may be worth briefly noting their equivalent pinning strategies to avoid ambiguity for non-JS/Rust cases.

## Individual Comments

### Comment 1
<location path="plugins/sdlc-workflow/skills/triage-security/SKILL.md" line_range="735-737" />
<code_context>

+For transitive dependencies, the remediation task must document the full
+dependency chain (from Step 2.3.5) and specify the two-tier remediation
+approach: bump the direct dependency first, fall back to pinning the
+transitive dep. This may require coordination with intermediate package
+maintainers if they pin the vulnerable version.
+
</code_context>
<issue_to_address>
**nitpick (typo):** Consider writing out "transitive dependency" instead of "transitive dep".

Using "transitive dependency" here keeps terminology consistent with "direct dependency" in the same paragraph and improves readability.

```suggestion
approach: bump the direct dependency first, fall back to pinning the
transitive dependency. This may require coordination with intermediate package
maintainers if they pin the vulnerable version.
```
</issue_to_address>

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[github-actions]

Eval Results

Eval Results: triage-security

Eval	Passed	Failed	Pass Rate
eval-1	11/11	0	100%
eval-10	5/5	0	100%
eval-11	5/5	0	100%
eval-12	5/5	0	100%
eval-13	5/5	0	100%
eval-14	5/5	0	100%
eval-15	5/5	0	100%
eval-16	7/7	0	100%
eval-17	4/5	1	80%
eval-18	5/5	0	100%
eval-19	5/5	0	100%
eval-2	5/5	0	100%
eval-20	4/4	0	100%
eval-21	4/4	0	100%
eval-22	4/4	0	100%
eval-23	4/4	0	100%
eval-24	4/4	0	100%
eval-25	4/4	0	100%
eval-26	5/5	0	100%
eval-27	5/5	0	100%
eval-28	5/5	0	100%
eval-3	5/5	0	100%
eval-4	5/5	0	100%
eval-5	6/6	0	100%
eval-6	6/6	0	100%
eval-7	5/5	0	100%
eval-8	8/8	0	100%
eval-9	5/5	0	100%

Failed Assertions

eval-17: 1 failing assertion

• Assertion: "The embargo warning gate does NOT trigger for Low or Moderate severity CVEs (CVSS < 7.0) — it is skipped silently when severity is below threshold (§1.70)"
  Evidence: "No output file demonstrates the behavior for a CVE with CVSS < 7.0. The eval only tested CVE-2026-31812 with CVSS 7.5 (above threshold). While embargo-check.md defines the threshold as 'CVSS >= 7.0', there is no evidence showing the gate being skipped silently for a low or moderate severity CVE. The outputs only demonstrate the positive triggering case, not the negative/skip case. Burden of proof is on PASS and no direct evidence exists."

Pass rate: 99% · Tokens: 48,412 · Duration: 123s

Baseline (eda40c55): 100% · 48,645 tokens · 118s

---

Generated by sdlc-workflow/run-evals v0.12.2

[ruromero]

[sdlc-workflow/verify-pr] Re: @sourcery-ai[bot] review —

1. "consider explicitly tying the recorded dependency chain from Step 2.3.5 into the upstream template's acceptance criteria" — Classified as suggestion — this proposes an enhancement to tie step outputs into acceptance criteria, but no CONVENTIONS.md convention or established codebase pattern requires this. The dependency chain is already documented in Implementation Notes where the engineer needs it; acceptance criteria remain outcome-focused. No sub-task created.

2. "it may be worth briefly noting their equivalent pinning strategies to avoid ambiguity for non-JS/Rust cases" — Classified as suggestion — the skill explicitly scopes source-level dependencies to Cargo and npm (see version-impact-analysis.md section header). The fallback pinning section already covers both in-scope ecosystems. No sub-task created.

[ruromero]

Verification Report

Task: TC-4908 — Clarify transitive dependency remediation in task templates
PR: #234
Branch: TC-4908
HEAD: 6cead1a

Check	Verdict	Details
Scope Containment	⚠️ WARN	2 eval baseline files out-of-scope; justified by eval infrastructure changes
Diff Size	✅ PASS	187 lines across 5 files — proportionate to task scope
Commit Traceability	✅ PASS	Commit body contains "Implements TC-4908"
Sensitive Patterns	✅ PASS	No secrets or sensitive patterns detected
CI Status	✅ PASS	All 5 CI checks pass
Acceptance Criteria	✅ PASS	All 3 acceptance criteria satisfied
Verification Commands	— N/A	No verification commands specified
Review Feedback	✅ PASS	1 nit + 2 suggestions; no code change requests
Test Quality	⚠️ WARN	Eval Quality: 99% pass rate, 2 regressions (eval-14, eval-4) unrelated to PR changes
Test Change Classification	— N/A	No test files modified

Overall: ⚠️ WARN

Findings

Scope Containment (WARN)

• 2 eval baseline files (evals/triage-security/baselines/latest/summary.md, evals/triage-security/baselines/latest/assertion-results.json) are out-of-scope per task description
• Justified: baseline files are auto-generated by eval infrastructure and reflect the current state after skill changes

Test Quality — Eval Quality (WARN)

• eval-14 (SBOM verification presentation format): Regression — passed at baseline 8255bb0, fails on PR branch. Root cause: non-deterministic LLM output organization. Sub-task: TC-5073
• eval-4 (cross-stream impact notice reasoning): Regression — passed at baseline 8255bb0, fails on PR branch. Root cause: non-deterministic LLM scope reasoning. Sub-task: TC-5074
• eval-8: Improved from 62% to 100% (3 pre-existing failures resolved)
• Both regressions are unrelated to the PR's changes to remediation-templates.md

Root-Cause Investigation

• TC-5075: Strengthen Step 2.3.5 SBOM output organization instructions (skill gap)
• TC-5076: Strengthen Step 8 Case B unscoped issue handling (skill gap)

Sub-Tasks Created

• TC-5073: Fix eval-14 — SBOM verification presentation format regression (Blocks TC-4908)
• TC-5074: Fix eval-4 — cross-stream impact notice reasoning regression (Blocks TC-4908)
• TC-5075: Root-cause — strengthen Step 2.3.5 SBOM output organization instructions (Blocks TC-4908)
• TC-5076: Root-cause — strengthen Step 8 Case B unscoped issue handling (Blocks TC-4908)

---

This comment was generated by sdlc-workflow/verify-pr v0.12.2.

[ruromero]

Verification Report for TC-4908 (commit 232ddb6)

Check	Result	Details
Review Feedback	PASS	Comments exist but no code change requests
Root-Cause Investigation	DONE	TC-5092: convention gap — add counterfactual assertion prohibition to CONVENTIONS.md
Scope Containment	WARN	2 out-of-scope eval files (evals.json, vuln-issue-transitive.md); all 3 task files present
Diff Size	PASS	209 lines proportionate to task scope
Commit Traceability	WARN	1/3 commits references TC-4908; others reference TC-5073, TC-5074
Sensitive Patterns	PASS	No secrets detected
CI Status	PASS	All 5 CI checks pass
Acceptance Criteria	PASS	3/3 criteria met
Test Quality	WARN	Eval Quality: 99% triage-security (146/147); eval-17 regression (flaky counterfactual assertion) → TC-5091
Test Change Classification	N/A	No test files modified
Verification Commands	N/A	None specified, no eval infra changes

Overall: WARN

Scope Containment WARN: Eval fixture files (evals.json, vuln-issue-transitive.md) are outside the task's Files to Modify section but fulfill the Test Requirements ("Add eval scenario with a transitive dependency CVE").

Commit Traceability WARN: Commits f6411519 and 232ddb69 reference TC-5073 and TC-5074 respectively (review feedback fix sub-tasks from the previous verify-pr run), not TC-4908 directly. Only 6cead1a3 references TC-4908.

Test Quality WARN: Eval-17 assertion 5 regressed (baseline 5/5 → PR 4/5). Root cause: counterfactual assertion — tests below-threshold behavior (CVSS < 7.0) without a fixture exercising it. Fix tracked in TC-5091; convention gap tracked in TC-5092.

Note: Test Quality, Test Change Classification, and Root-Cause Investigation are informational and do not affect the Overall result.

---

This comment was AI-generated by sdlc-workflow/verify-pr v0.12.2.

[mrizzi]

Verification Report for TC-4908 (commit 2ba1f51)

Check	Result	Details
Review Feedback	PASS	Comments exist but no code change requests
Root-Cause Investigation	N/A	No sub-tasks created — nothing to investigate
Scope Containment	⚠️ WARN	2 eval files out-of-scope (evals.json, vuln-issue-transitive.md); all 3 task-specified files present
Diff Size	PASS	+194 -15 across 5 files — proportionate to documentation task
Commit Traceability	⚠️ WARN	1/4 commits references TC-4908; others reference TC-5073, TC-5074, or no task
Sensitive Patterns	PASS	No secrets or credentials detected
CI Status	PASS	All 5 checks passed
Acceptance Criteria	PASS	3/3 criteria met
Test Quality	⚠️ WARN	Eval Quality: WARN (99%, 148/149 — eval-17 failure is pre-existing, not a regression); Repetitive Test Detection: PASS; Test Documentation: PASS
Test Change Classification	ADDITIVE	+1 eval scenario (eval-28), +5 assertions; eval-14 prompt refined without weakening
Verification Commands	N/A	No verification commands specified; no run-evals infrastructure changes

Overall: WARN

Scope Containment and Commit Traceability are WARN. The out-of-scope eval files are justified by the Test Requirements section (eval scenario 28). Commits for TC-5073 and TC-5074 are review feedback sub-tasks linked to TC-4908. The eval-17 failure (1 assertion, pre-existing) is unrelated to this PR's changes.

---

This comment was AI-generated by sdlc-workflow/verify-pr v0.12.2.