[lelia]

Summary

Security and license alerts on a transitive dependency now name the direct dependency that introduced it, on a new line under the manifest link:

<p><strong>Source:</strong> <a href="…">Manifest File</a></p>
<p><strong>Introduced by:</strong> <code>npm/@acme/widgets@1.2.0</code></p>

The default comment showed only the manifest file; introduced_by was rendered only in the legacy table format.

• Direct dependencies, and transitive ones whose ancestors aren't in the scan, get no line.
• An ancestor declared in several manifests is listed once; more than five are shown as "… and N more".
• Names are HTML-escaped like the other repository-controlled text in the comment.

Namespaces in ancestor labels

get_source_data built ancestor labels from type/name@version, dropping the npm scope or Maven group ID, so @acme/widgets rendered as npm/widgets@… and two same-named scoped roots collapsed into one. This carries the same fix as #405 so the new line is correct without waiting on that stack. Whichever lands second resolves a one-hunk conflict in get_source_data.

Overlap with open PRs

• Keep namespaces in dependency source labels #405: identical get_source_data change (see above).
• Correct package and alert information links #406: rewrites the "Read more" lines directly below the new "Introduced by" line, so expect a small adjacent-line conflict.

Testing

• New cases in tests/unit/test_pr_comment_rendering.py covering transitive, direct and no-ancestor alerts, deduplication, the cap, escaping, the license row, HTML-block integrity, and namespaced npm and Maven ancestor labels.
• uv run pytest tests: 762 passed. ruff check clean.

Bumps to 2.12.1.

Refs CE-495

[cursor]

PR Summary

Low Risk
Comment-only output and ancestor label formatting with HTML escaping and broad unit coverage; no auth, scan, or API behavior changes.

Overview
Release 2.12.1 adds an Introduced by: line to default GitHub/GitLab-style security and license alert details for transitive dependencies, placed under the manifest link. The line lists up to five deduplicated direct-dependency PURLs (with "and N more" when needed), skips direct deps and transients with no known ancestors, and escapes names like other repo-controlled comment text.

Ancestor labels used for that line are fixed in Core.get_source_data: scoped npm and Maven roots now render as type/namespace/name@version instead of dropping the scope or group ID.

Version bumps and changelog entries accompany new unit tests for rendering, caps, deduplication, escaping, and namespaced ancestors.

^{Reviewed by Cursor Bugbot for commit 84f06bc. Configure here.}

[lelia]

bugbot run

[cursor]

Stale Bugbot comment from a previous run.

[lelia]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 84f06bc. Configure here.}