feat: surface prod vs dev split in severity summary - #1074
Merged
Conversation
Add countProdFindings helper to formatters.ts that returns prod/dev counts when at least one finding has pkg.dev defined and devTotal > 0, or null when the split adds no signal (all prod or dev flag unavailable). Wire the helper into printSummary so a contextual gray line appears below the severity table only when meaningful.
When some findings belong to dev dependencies, a contextual line now appears below the severity card strip: "N of M findings in prod dependencies". Silent when all findings are prod or when the dev flag is unavailable on all findings. CSS class .sev-dev-note added to REPORT_STYLES. Logic uses the serialized finding dev field (boolean) that buildReportData populates via serializeFinding. Three tests added to tests/html-reporter.test.ts.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Surfaces a contextual "N of M findings in prod dependencies" line below the severity summary when some findings belong to dev-only packages. Silent when all findings are prod or when the lockfile parser didn't populate the dev flag.
Terminal (compact and verbose): a
└line in gray appears below the severity table/summary box only when there is a dev/prod split.HTML report: a small centered note appears below the sev-card strip under the same condition.
Also fixes the priority signal legend in the HTML report: removes the 32px horizontal indent and adds 16px top spacing so it sits flush with the table width and has breathing room above it.
Closes #991