From 7d87e4c1a3ed7a39674af5d1491434f03c126e94 Mon Sep 17 00:00:00 2001
From: Venancio Orozco <4390221+v3nant@users.noreply.github.com>
Date: Thu, 16 Jul 2026 11:41:32 -0600
Subject: [PATCH] fix(scan): count packages with unknownReason metadata as
 UNKNOWN

---
 package-lock.json                |  7 +++----
 package.json                     |  2 +-
 test/service/display.svc.test.ts | 25 ++++++++++++++++++++++++-
 test/service/file.svc.test.ts    |  2 +-
 4 files changed, 29 insertions(+), 7 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index a977deb4..56fa7c80 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -12,7 +12,7 @@
         "@amplitude/analytics-node": "^1.5.59",
         "@apollo/client": "^4.2.3",
         "@cyclonedx/cdxgen": "^12.5.1",
-        "@herodevs/eol-shared": "github:herodevs/eol-shared#v0.1.20",
+        "@herodevs/eol-shared": "github:herodevs/eol-shared#v0.1.23",
         "@inquirer/prompts": "^8.0.2",
         "@oclif/core": "^4.11.4",
         "@oclif/plugin-help": "^6.2.32",
@@ -1774,13 +1774,13 @@
     },
     "node_modules/@herodevs/eol-shared": {
       "version": "1.0.0",
-      "resolved": "git+ssh://git@github.com/herodevs/eol-shared.git#9e1ada64643ff801113d9361f14a49fabd067cdc",
+      "resolved": "git+ssh://git@github.com/herodevs/eol-shared.git#1a326d22002568be6632b2c4667c6e6e3aaca20b",
       "license": "ISC",
       "dependencies": {
         "@cyclonedx/cyclonedx-library": "^9.4.1",
         "fast-xml-parser": "^5.3.3",
         "json-schema-to-typescript": "^15.0.4",
-        "packageurl-js": "^2.0.1"
+        "packageurl-js": "2.0.1"
       },
       "engines": {
         "node": ">=22"
@@ -10384,7 +10384,6 @@
       "version": "7.8.2",
       "resolved": "https://registry.npmjs.org/rxjs/-/rxjs-7.8.2.tgz",
       "integrity": "sha512-dhKf903U/PQZY6boNNtAGdWbG85WAbjT/1xYoZIC7FAY0yWapOBQVsVrDl58W86//e1VpMNBtRV4MaXfdMySFA==",
-      "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
         "tslib": "^2.1.0"
diff --git a/package.json b/package.json
index fdbf05be..c406b200 100644
--- a/package.json
+++ b/package.json
@@ -45,7 +45,7 @@
     "@amplitude/analytics-node": "^1.5.59",
     "@apollo/client": "^4.2.3",
     "@cyclonedx/cdxgen": "^12.5.1",
-    "@herodevs/eol-shared": "github:herodevs/eol-shared#v0.1.20",
+    "@herodevs/eol-shared": "github:herodevs/eol-shared#v0.1.23",
     "@inquirer/prompts": "^8.0.2",
     "@oclif/core": "^4.11.4",
     "@oclif/plugin-help": "^6.2.32",
diff --git a/test/service/display.svc.test.ts b/test/service/display.svc.test.ts
index 5313827d..33ea4dc2 100644
--- a/test/service/display.svc.test.ts
+++ b/test/service/display.svc.test.ts
@@ -39,7 +39,7 @@ describe('display.svc', () => {
       },
       {
         purl: 'pkg:npm/test3@3.0.0',
-        metadata: null,
+        metadata: { unknownReason: 'not_identifiable' },
       },
       {
         purl: 'pkg:npm/%40scoped/package@1.0.0',
@@ -81,6 +81,29 @@ describe('display.svc', () => {
       expect(counts.NES_AVAILABLE).toBe(1);
     });
 
+    it('should count components with only an unknownReason as UNKNOWN, not OK', () => {
+      const unknownReports: EolReport = {
+        ...mockReport,
+        components: [
+          {
+            purl: 'pkg:npm/mystery@1.0.0',
+            metadata: { unknownReason: 'not_identifiable' },
+          },
+          {
+            purl: 'pkg:npm/queued@2.0.0',
+            metadata: { unknownReason: 'queued' },
+          },
+        ],
+      };
+
+      const counts = countComponentsByStatus(unknownReports);
+
+      expect(counts.UNKNOWN).toBe(2);
+      expect(counts.OK).toBe(0);
+      expect(counts.EOL).toBe(0);
+      expect(counts.EOL_UPCOMING).toBe(0);
+    });
+
     it('should extract ecosystems correctly from various PURL formats', () => {
       const counts = countComponentsByStatus(mockReport);
 
diff --git a/test/service/file.svc.test.ts b/test/service/file.svc.test.ts
index 24f29c10..0d97b120 100644
--- a/test/service/file.svc.test.ts
+++ b/test/service/file.svc.test.ts
@@ -233,7 +233,7 @@ describe('file.svc', () => {
         components: [
           {
             purl: 'pkg:npm/bootstrap@3.1.1',
-            metadata: null,
+            metadata: { unknownReason: 'not_identifiable' },
             remediations: [
               {
                 type: 'nes_available',