fix: render lockfile poisoning findings for non-http(s) resolved URLs

[KunalSin9h]

Problem

Users on v1.17.3 reported a ** Lockfile Poisoning Detected section with no findings under it — the header prints but the body is empty.

Root cause

The console (summary.go) and markdown (markdown_summary.go) reporters aggregate lockfile poisoning findings by re-parsing the analyzer's free-text messages with regex (aggregateLFPMessages). The URL-extraction regex only matched http(s):

var lfpURLRe = regexp.MustCompile("`(https?://[^`]+)`")

The npm analyzer legitimately flags packages resolving to any untrusted scheme — including git+ssh://, git+https://, git://, ssh:// (common for git dependencies). Those messages failed the regex and were silently dropped during aggregation (the continue in the loop).

The section header gates on the raw event count (len(r.lockfilePoisoning) > 0), while the body iterates over the aggregated groups. So a lockfile whose poisoning findings were all on non-http(s) URLs rendered the header with an empty body.

This was introduced in v1.17.3 by add61ab ("consolidate lockfile poisoning output by URL"), which added the reporter-side string re-parsing. Before that, the reporter printed each raw message directly, so all schemes always showed.

Fix

Relax lfpURLRe to match any URL scheme ([a-zA-Z][a-zA-Z0-9+.-]*://). The package name is the first backtick group and never contains ://, so the URL group is still matched unambiguously.

Testing

Added pkg/reporter/lfp_aggregation_test.go with regression coverage for git+ssh, git+https, git, and ssh schemes, plus existing http(s) and path-convention cases.

Verified end-to-end on a lockfile mixing all schemes:

Before: only http:// and https:// packages shown; the three git-based deps dropped.
After: all five untrusted URLs render; trusted registry.npmjs.org correctly not flagged.

🤖 Generated with Claude Code

[safedep]

SafeDep Report Summary

No dependency changes detected. Nothing to scan.

View complete scan results →

_{This report is generated by SafeDep Github App}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 12.46%. Comparing base (c9a6321) to head (6a65b72).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #746      +/-   ##
==========================================
+ Coverage   12.41%   12.46%   +0.04%     
==========================================
  Files         372      372              
  Lines       49231    49231              
==========================================
+ Hits         6111     6135      +24     
+ Misses      42634    42609      -25     
- Partials      486      487       +1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.