feat(remediation): validate upgrade suggestions against transitive dependency graph (#708)

backend/secuscan/executor.py

@@ -1191,6 +1191,33 @@ async def _build_result_contract(
             target=target,
             findings=[item for item in result.get("findings", []) if isinstance(item, dict)],
         )
+
+        try:
+            from .remediation import build_dependency_graph, validate_remediation
+            graph = build_dependency_graph(target)
+            validations = {}
+            for f in normalized_findings:
+                remediation_str = f.get("remediation", "")
+                if remediation_str:
+                    val_res = validate_remediation(remediation_str, graph)
+                    validations[id(f)] = val_res
+
+            for f in normalized_findings:
+                if id(f) in validations:
+                    val_res = validations[id(f)]
+                    f_metadata = f.setdefault("metadata", {})
+                    f_metadata["safe_to_apply"] = val_res["safe_to_apply"]
+                    f_metadata["compatible_range"] = val_res["compatible_range"]
+                    f_metadata["alternatives"] = val_res["alternatives"]
+        except Exception as e:
+            logger.warning(
+                "Remediation safety validation failed for task %s (plugin %s): %s. Skipping safety metadata enrichment.",
+                task_id,
+                plugin_id,
+                str(e),
+                exc_info=True,
+            )
+
         previous_findings = await self._load_previous_task_findings(
             db,
             owner_id=owner_id,

backend/secuscan/models.py

@@ -235,6 +235,9 @@ class Finding(BaseModel):
     evidence_count: int = 0
     analyst_status: AnalystStatus = AnalystStatus.NEW
     retest_status: RetestStatus = RetestStatus.NOT_REQUESTED
+    safe_to_apply: Optional[bool] = None
+    compatible_range: Optional[str] = None
+    alternatives: Optional[List[str]] = None
 
 
 class TaskResult(BaseModel):