feat(seal): add Ruby (RubyGems) ecosystem support

Seal Ruby packages follow the seal-$name naming pattern with versions
in $version.0.1.sp$X format (e.g. seal-rack 2.0.7.0.1.sp1).
The standard rubygems comparer handles .sp* pre-release segments correctly.

Author: DmitriyLewen

docs/guide/coverage/others/seal.md

@@ -41,6 +41,7 @@ Seal also provides patched versions of application dependencies with their own v
 | Node.js (npm) | `@seal-security/*` | `@seal-security/ejs` |
 | Go | `sealsecurity.io/*` | `sealsecurity.io/github.com/Masterminds/goutils` |
 | Java (Maven) | `seal.sp*` | `seal.sp1.org.eclipse.jetty:jetty-http` |
+| Ruby (RubyGems) | `seal-*` | `seal-rack` |
 
 When Trivy detects packages matching these patterns, it automatically uses Seal Security advisories for vulnerability scanning.
 

pkg/detector/library/driver_test.go

@@ -264,6 +264,31 @@ func TestDriver_Detect(t *testing.T) {
 				},
 			},
 		},
+		{
+			name: "seal security rubygems package",
+			fixtures: []string{
+				"testdata/fixtures/seal.yaml",
+				"testdata/fixtures/data-source.yaml",
+			},
+			libType: ftypes.Bundler,
+			args: args{
+				pkgName: "seal-rack",
+				pkgVer:  "2.0.7.0.1.sp1",
+			},
+			want: []types.DetectedVulnerability{
+				{
+					VulnerabilityID:  "CVE-2025-61780",
+					PkgName:          "seal-rack",
+					InstalledVersion: "2.0.7.0.1.sp1",
+					FixedVersion:     "2.0.7.0.1.sp999",
+					DataSource: &dbTypes.DataSource{
+						ID:   vulnerability.Seal,
+						Name: "Seal Security Database",
+						URL:  "http://vulnfeed.sealsecurity.io/v1/osv/renamed/vulnerabilities.zip",
+					},
+				},
+			},
+		},
 		{
 			name: "seal security npm package",
 			fixtures: []string{

pkg/detector/library/testdata/fixtures/data-source.yaml

@@ -40,6 +40,11 @@
         ID: "seal"
         Name: "Seal Security Database"
         URL: "http://vulnfeed.sealsecurity.io/v1/osv/renamed/vulnerabilities.zip"
+    - key: "seal rubygems::Seal Security Database"
+      value:
+        ID: "seal"
+        Name: "Seal Security Database"
+        URL: "http://vulnfeed.sealsecurity.io/v1/osv/renamed/vulnerabilities.zip"
     - key: "seal npm::Seal Security Database"
       value:
         ID: "seal"

pkg/detector/library/testdata/fixtures/seal.yaml

@@ -31,6 +31,17 @@
             VulnerableVersions:
               - ">= 0.26.0-sp1, < 0.26.0-sp2"
 
+- bucket: "seal rubygems::Seal Security Database"
+  pairs:
+    - bucket: "seal-rack"
+      pairs:
+        - key: "CVE-2025-61780"
+          value:
+            PatchedVersions:
+              - "2.0.7.0.1.sp999"
+            VulnerableVersions:
+              - ">= 2.0.7.0.1.sp1, < 2.0.7.0.1.sp999"
+
 - bucket: "seal maven::Seal Security Database"
   pairs:
     - bucket: "seal.sp1.org.apache.logging.log4j:log4j-core"

pkg/detector/library/vendors/seal/seal.go

@@ -13,10 +13,11 @@ import (
 // Seal Security provides patched versions of open source packages with their own
 // vulnerability advisories. Their packages are identified by ecosystem-specific
 // naming patterns:
-//   - Maven:  seal.sp*.$groupId:$artifactId (e.g. seal.sp1, seal.sp2)
-//   - npm:    @seal-security/$name
-//   - Python: seal-$name
-//   - Go:     sealsecurity.io/$name
+//   - Maven:   seal.sp*.$groupId:$artifactId (e.g. seal.sp1, seal.sp2)
+//   - npm:     @seal-security/$name
+//   - Python:  seal-$name
+//   - Go:      sealsecurity.io/$name
+//   - Ruby:    seal-$name
 //
 // See also: pkg/detector/ospkg/seal/ for the OS package equivalent.
 type SealSecurity struct{}
@@ -35,8 +36,8 @@ func (SealSecurity) Match(eco ecosystem.Type, pkgName, _ string) bool {
 	case ecosystem.Npm:
 		// e.g. @seal-security/ejs, @seal-security/seal-ejs
 		return strings.HasPrefix(normalized, "@seal-security/")
-	case ecosystem.Pip:
-		// e.g. seal-django
+	case ecosystem.Pip, ecosystem.RubyGems:
+		// e.g. seal-django (pip), seal-rack (rubygems)
 		return strings.HasPrefix(normalized, "seal-")
 	case ecosystem.Go:
 		// e.g. sealsecurity.io/github.com/Masterminds/goutils

pkg/detector/library/vendors/seal/seal_test.go

@@ -88,12 +88,27 @@ func TestSealSecurity_Match(t *testing.T) {
 			pkgVer:  "v1.1.1-sp1",
 			want:    false,
 		},
-		// Unsupported ecosystem
+		// Ruby - name prefix seal-
+		{
+			name:    "ruby seal package",
+			eco:     ecosystem.RubyGems,
+			pkgName: "seal-rack",
+			pkgVer:  "2.0.7.0.1.sp1",
+			want:    true,
+		},
 		{
-			name:    "rubygems package is not supported",
+			name:    "ruby non-seal package",
 			eco:     ecosystem.RubyGems,
-			pkgName: "activesupport",
-			pkgVer:  "7.0.0",
+			pkgName: "rack",
+			pkgVer:  "2.0.7",
+			want:    false,
+		},
+		// Unsupported ecosystem
+		{
+			name:    "erlang package is not supported",
+			eco:     ecosystem.Erlang,
+			pkgName: "seal-cowboy",
+			pkgVer:  "2.9.0",
 			want:    false,
 		},
 		// Edge cases