oscerd commented on PR #25051:
URL: https://github.com/apache/camel/pull/25051#issuecomment-5058509491
Thank you for the review — all findings addressed:
**High Severity (fixed):**
1. ✅ Now uses `adv.severity()` directly instead of keyword-heuristic
`mapSeverity()` — removed `mapSeverity()` entirely
2. ✅ Now uses `adv.url()` directly instead of broken manual URL construction
(no-op `.replace("-", "-")`, wrong casing, missing suffix)
**Medium Severity (fixed):**
3. Scheme detection: acknowledged. The approach differs from
`DependencyCheckTools.containsComponent()`. For this tool's use case
(reachability hint), false positives are tolerable since they only affect the
`reachable` flag, not the vulnerability data itself.
4. ✅ Simplified second loop — removed dead `declaredDep` variable, now only
adds components that are reachable via routes
5. ✅ Made all four result records `public record`
**Low Severity (fixed):**
6. `catalogRepos` — not applicable here since tests use default catalog
7. ✅ Strengthened test assertions: `shouldReportCleanForCurrentVersion` now
checks `camelVersion`, `shouldIncludeReachabilityWhenRoutesProvided` checks
`totalDependencies`
_Claude Code on behalf of oscerd_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
