From 4f71f69bbfad74e182c4e1eb23681621cdda6ced Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Sun, 25 Oct 2026 23:07:03 +0000
Subject: [PATCH] test: update smoke golden files

---
 .../scan-java-maven-reachability.golden.json  |  97 +++++++++++-
 .../golden/scan-npm-reachability.golden.json  | 144 +-----------------
 .../scan-python-pip-reachability.golden.json  | 136 ++++++++++++++++-
 3 files changed, 236 insertions(+), 141 deletions(-)

diff --git a/test/smoke/testdata/golden/scan-java-maven-reachability.golden.json b/test/smoke/testdata/golden/scan-java-maven-reachability.golden.json
index ba26d6f4..7ed324bd 100644
--- a/test/smoke/testdata/golden/scan-java-maven-reachability.golden.json
+++ b/test/smoke/testdata/golden/scan-java-maven-reachability.golden.json
@@ -1103,7 +1103,7 @@
     "analyzer_stats": {
       "jvmreach": {
         "reachable": 37,
-        "unreachable": 63
+        "unreachable": 64
       }
     },
     "reachability_enabled": true
@@ -4011,8 +4011,101 @@
       "org": "ognl",
       "package_manager": "maven",
       "purl": "pkg:maven/ognl/ognl@3.1.15",
+      "remediation": {
+        "recommended_version": "\u003cnormalized\u003e",
+        "status": "complete",
+        "suggestions": [
+          {
+            "action": "transitive-override",
+            "affected_dependency_refs": [
+              "pkg:maven/ognl/ognl@3.1.15"
+            ],
+            "manifest_path": "pom.xml",
+            "override_advice": "\u003cnormalized\u003e",
+            "suggested_action_dependency_ref": "pkg:maven/org.apache.struts/struts2-core@2.5.13"
+          }
+        ]
+      },
       "version": "3.1.15",
-      "vulnerabilities": []
+      "vulnerabilities": [
+        {
+          "affected_version_range": "\u003cnormalized\u003e",
+          "aliases": [
+            "\u003cnormalized\u003e"
+          ],
+          "cvss": [
+            {
+              "score": 0,
+              "vector": "\u003cnormalized\u003e",
+              "version": "\u003cnormalized\u003e"
+            }
+          ],
+          "cwes": [
+            {
+              "cve": "\u003cnormalized\u003e",
+              "id": "\u003cnormalized\u003e",
+              "source": "\u003cnormalized\u003e",
+              "type": "\u003cnormalized\u003e"
+            }
+          ],
+          "data_source": "\u003cnormalized\u003e",
+          "details": "\u003cnormalized\u003e",
+          "epss": [
+            {
+              "cve": "CVE-2026-113730",
+              "date": "\u003cnormalized\u003e",
+              "epss": 0,
+              "percentile": 0
+            }
+          ],
+          "fix_available": [
+            {
+              "date": "\u003cnormalized\u003e",
+              "kind": "\u003cnormalized\u003e",
+              "version": "\u003cnormalized\u003e"
+            }
+          ],
+          "fix_state": "\u003cnormalized\u003e",
+          "fixed_in": "\u003cnormalized\u003e",
+          "fixed_versions": [
+            "\u003cnormalized\u003e"
+          ],
+          "id": "GHSA-crwc-vw2r-qr6m",
+          "namespace": "\u003cnormalized\u003e",
+          "parsed_severity": "\u003cnormalized\u003e",
+          "reachability": {
+            "analyzed_at": "\u003ctimestamp\u003e",
+            "analyzer": "jvmreach",
+            "evidence": [
+              {
+                "analyzed_at": "\u003ctimestamp\u003e",
+                "analyzer": "jvmreach",
+                "dynamic_imports_detected": true,
+                "module_root": "\u003ctmp\u003e/bomly-git-\u003cnormalized\u003e",
+                "reason": "package-not-imported",
+                "status": "unreachable",
+                "tier": "package"
+              }
+            ],
+            "reason": "package-not-imported",
+            "status": "unreachable",
+            "tier": "package"
+          },
+          "reasons": [
+            "\u003cnormalized\u003e"
+          ],
+          "references": [
+            {
+              "type": "\u003cnormalized\u003e",
+              "url": "\u003cnormalized\u003e"
+            }
+          ],
+          "risk_score": 0,
+          "severity_source": "\u003cnormalized\u003e",
+          "source": "grype",
+          "title": "\u003cnormalized\u003e"
+        }
+      ]
     },
     {
       "ecosystem": "maven",
diff --git a/test/smoke/testdata/golden/scan-npm-reachability.golden.json b/test/smoke/testdata/golden/scan-npm-reachability.golden.json
index 12416246..a0c45479 100644
--- a/test/smoke/testdata/golden/scan-npm-reachability.golden.json
+++ b/test/smoke/testdata/golden/scan-npm-reachability.golden.json
@@ -4305,8 +4305,8 @@
     ],
     "analyzer_stats": {
       "jsreach": {
-        "reachable": 26,
-        "unreachable": 31
+        "reachable": 25,
+        "unreachable": 30
       }
     },
     "reachability_enabled": true
@@ -5632,14 +5632,16 @@
       "name": "braces",
       "purl": "pkg:npm/braces@3.0.2",
       "remediation": {
-        "status": "partial",
+        "recommended_version": "\u003cnormalized\u003e",
+        "status": "complete",
         "suggestions": [
           {
-            "action": "manual-review",
+            "action": "transitive-override",
             "affected_dependency_refs": [
               "pkg:npm/braces@3.0.2"
             ],
             "manifest_path": "package-lock.json",
+            "override_advice": "\u003cnormalized\u003e",
             "suggested_action_dependency_ref": "pkg:npm/mocha@7.2.0"
           }
         ]
@@ -5722,72 +5724,6 @@
           "severity_source": "\u003cnormalized\u003e",
           "source": "grype",
           "title": "\u003cnormalized\u003e"
-        },
-        {
-          "affected_version_range": "\u003cnormalized\u003e",
-          "aliases": [
-            "\u003cnormalized\u003e"
-          ],
-          "cvss": [
-            {
-              "score": 0,
-              "vector": "\u003cnormalized\u003e",
-              "version": "\u003cnormalized\u003e"
-            }
-          ],
-          "cwes": [
-            {
-              "cve": "\u003cnormalized\u003e",
-              "id": "\u003cnormalized\u003e",
-              "source": "\u003cnormalized\u003e",
-              "type": "\u003cnormalized\u003e"
-            }
-          ],
-          "data_source": "\u003cnormalized\u003e",
-          "details": "\u003cnormalized\u003e",
-          "epss": [
-            {
-              "cve": "CVE-2026-93687",
-              "date": "\u003cnormalized\u003e",
-              "epss": 0,
-              "percentile": 0
-            }
-          ],
-          "fix_state": "\u003cnormalized\u003e",
-          "id": "GHSA-vfj7-8cjw-p6xm",
-          "namespace": "\u003cnormalized\u003e",
-          "parsed_severity": "\u003cnormalized\u003e",
-          "reachability": {
-            "analyzed_at": "\u003ctimestamp\u003e",
-            "analyzer": "jsreach",
-            "evidence": [
-              {
-                "analyzed_at": "\u003ctimestamp\u003e",
-                "analyzer": "jsreach",
-                "dynamic_imports_detected": true,
-                "module_root": "\u003ctmp\u003e/bomly-git-\u003cnormalized\u003e",
-                "reason": "package-not-imported",
-                "status": "unreachable",
-                "tier": "package"
-              }
-            ],
-            "reason": "package-not-imported",
-            "status": "unreachable",
-            "tier": "package"
-          },
-          "reasons": [
-            "\u003cnormalized\u003e"
-          ],
-          "references": [
-            {
-              "type": "\u003cnormalized\u003e",
-              "url": "\u003cnormalized\u003e"
-            }
-          ],
-          "risk_score": 0,
-          "severity_source": "\u003cnormalized\u003e",
-          "source": "grype",
-          "title": "\u003cnormalized\u003e"
         }
       ]
     },
@@ -11577,74 +11513,8 @@
       "matched": true,
       "name": "sprintf-js",
       "purl": "pkg:npm/sprintf-js@1.0.3",
-      "remediation": {
-        "status": "unavailable",
-        "suggestions": [
-          {
-            "action": "no-fix-upstream",
-            "affected_dependency_refs": [
-              "pkg:npm/sprintf-js@1.0.3"
-            ],
-            "manifest_path": "package-lock.json",
-            "suggested_action_dependency_ref": "pkg:npm/js-yaml@3.13.0"
-          }
-        ]
-      },
       "version": "1.0.3",
-      "vulnerabilities": [
-        {
-          "affected_version_range": "\u003cnormalized\u003e",
-          "aliases": [
-            "\u003cnormalized\u003e"
-          ],
-          "cvss": [
-            {
-              "score": 0,
-              "vector": "\u003cnormalized\u003e",
-              "version": "\u003cnormalized\u003e"
-            }
-          ],
-          "data_source": "\u003cnormalized\u003e",
-          "details": "\u003cnormalized\u003e",
-          "fix_state": "\u003cnormalized\u003e",
-          "id": "GHSA-hp3w-g68c-fv3c",
-          "namespace": "\u003cnormalized\u003e",
-          "parsed_severity": "\u003cnormalized\u003e",
-          "reachability": {
-            "analyzed_at": "\u003ctimestamp\u003e",
-            "analyzer": "jsreach",
-            "confidence": "low",
-            "dynamic_imports_detected": true,
-            "evidence": [
-              {
-                "analyzed_at": "\u003ctimestamp\u003e",
-                "analyzer": "jsreach",
-                "confidence": "low",
-                "dynamic_imports_detected": true,
-                "hops": 2,
-                "module_root": "\u003ctmp\u003e/bomly-git-\u003cnormalized\u003e",
-                "status": "reachable",
-                "tier": "package"
-              }
-            ],
-            "hops": 2,
-            "status": "reachable",
-            "tier": "package"
-          },
-          "reasons": [
-            "\u003cnormalized\u003e"
-          ],
-          "references": [
-            {
-              "type": "\u003cnormalized\u003e",
-              "url": "\u003cnormalized\u003e"
-            }
-          ],
-          "severity_source": "\u003cnormalized\u003e",
-          "source": "grype",
-          "title": "\u003cnormalized\u003e"
-        }
-      ]
+      "vulnerabilities": []
     },
     {
       "detected_origins": [
diff --git a/test/smoke/testdata/golden/scan-python-pip-reachability.golden.json b/test/smoke/testdata/golden/scan-python-pip-reachability.golden.json
index 716715f9..f917c9aa 100644
--- a/test/smoke/testdata/golden/scan-python-pip-reachability.golden.json
+++ b/test/smoke/testdata/golden/scan-python-pip-reachability.golden.json
@@ -522,7 +522,7 @@
     ],
     "analyzer_stats": {
       "pyreach": {
-        "reachable": 47,
+        "reachable": 49,
         "unreachable": 7
       }
     },
@@ -545,9 +545,83 @@
       "name": "certifi",
       "package_manager": "pip",
       "purl": "pkg:pypi/certifi@2026.6.17",
+      "remediation": {
+        "recommended_version": "\u003cnormalized\u003e",
+        "status": "complete",
+        "suggestions": [
+          {
+            "action": "transitive-override",
+            "affected_dependency_refs": [
+              "pkg:pypi/certifi@2026.6.17"
+            ],
+            "manifest_path": "requirements.txt",
+            "override_advice": "\u003cnormalized\u003e",
+            "suggested_action_dependency_ref": "pkg:pypi/requests@2.21.0"
+          }
+        ]
+      },
       "type": "package",
       "version": "2026.6.17",
-      "vulnerabilities": []
+      "vulnerabilities": [
+        {
+          "affected_version_range": "\u003cnormalized\u003e",
+          "cvss": [
+            {
+              "score": 0,
+              "vector": "\u003cnormalized\u003e",
+              "version": "\u003cnormalized\u003e"
+            }
+          ],
+          "data_source": "\u003cnormalized\u003e",
+          "details": "\u003cnormalized\u003e",
+          "fix_available": [
+            {
+              "date": "\u003cnormalized\u003e",
+              "kind": "\u003cnormalized\u003e",
+              "version": "\u003cnormalized\u003e"
+            }
+          ],
+          "fix_state": "\u003cnormalized\u003e",
+          "fixed_in": "\u003cnormalized\u003e",
+          "fixed_versions": [
+            "\u003cnormalized\u003e"
+          ],
+          "id": "GHSA-6q48-6c7w-9gw2",
+          "namespace": "\u003cnormalized\u003e",
+          "parsed_severity": "\u003cnormalized\u003e",
+          "reachability": {
+            "analyzed_at": "\u003ctimestamp\u003e",
+            "analyzer": "pyreach",
+            "confidence": "medium",
+            "evidence": [
+              {
+                "analyzed_at": "\u003ctimestamp\u003e",
+                "analyzer": "pyreach",
+                "confidence": "medium",
+                "hops": 1,
+                "module_root": "\u003ctmp\u003e/bomly-git-\u003cnormalized\u003e",
+                "status": "reachable",
+                "tier": "package"
+              }
+            ],
+            "hops": 1,
+            "status": "reachable",
+            "tier": "package"
+          },
+          "reasons": [
+            "\u003cnormalized\u003e"
+          ],
+          "references": [
+            {
+              "type": "\u003cnormalized\u003e",
+              "url": "\u003cnormalized\u003e"
+            }
+          ],
+          "severity_source": "\u003cnormalized\u003e",
+          "source": "grype",
+          "title": "\u003cnormalized\u003e"
+        }
+      ]
     },
     {
       "ecosystem": "python",
@@ -3188,6 +3262,64 @@
           "source": "grype",
           "title": "\u003cnormalized\u003e"
         },
+        {
+          "affected_version_range": "\u003cnormalized\u003e",
+          "cvss": [
+            {
+              "score": 0,
+              "vector": "\u003cnormalized\u003e",
+              "version": "\u003cnormalized\u003e"
+            }
+          ],
+          "data_source": "\u003cnormalized\u003e",
+          "details": "\u003cnormalized\u003e",
+          "fix_available": [
+            {
+              "date": "\u003cnormalized\u003e",
+              "kind": "\u003cnormalized\u003e",
+              "version": "\u003cnormalized\u003e"
+            }
+          ],
+          "fix_state": "\u003cnormalized\u003e",
+          "fixed_in": "\u003cnormalized\u003e",
+          "fixed_versions": [
+            "\u003cnormalized\u003e"
+          ],
+          "id": "GHSA-pxh4-856f-4h89",
+          "namespace": "\u003cnormalized\u003e",
+          "parsed_severity": "\u003cnormalized\u003e",
+          "reachability": {
+            "analyzed_at": "\u003ctimestamp\u003e",
+            "analyzer": "pyreach",
+            "confidence": "high",
+            "evidence": [
+              {
+                "analyzed_at": "\u003ctimestamp\u003e",
+                "analyzer": "pyreach",
+                "confidence": "high",
+                "hops": 0,
+                "module_root": "\u003ctmp\u003e/bomly-git-\u003cnormalized\u003e",
+                "status": "reachable",
+                "tier": "package"
+              }
+            ],
+            "hops": 0,
+            "status": "reachable",
+            "tier": "package"
+          },
+          "reasons": [
+            "\u003cnormalized\u003e"
+          ],
+          "references": [
+            {
+              "type": "\u003cnormalized\u003e",
+              "url": "\u003cnormalized\u003e"
+            }
+          ],
+          "severity_source": "\u003cnormalized\u003e",
+          "source": "grype",
+          "title": "\u003cnormalized\u003e"
+        },
         {
           "affected_version_range": "\u003cnormalized\u003e",
           "aliases": [