SC6: track release of the uvicorn/gunicorn exact-name correction

[mohgupta-ship-it]

Filed by Codex on Mohit Gupta’s behalf.

Please track review and release of the existing SC6 exact-name correction in #530. That PR addresses the uvicorn/gunicorn observation from the broader issue #523; this issue provides focused ownership and release acceptance for that specific correction, without duplicating the implementation work.

Reproduction

Verified against v2.11.2 and current main at 1c0eb569a2550172415aaebd83a62ea163cb3c06:

from skillspector.nodes.analyzers.static_patterns_supply_chain import (
    _POPULAR_PYPI,
    _is_typosquat,
)

assert "uvicorn" in _POPULAR_PYPI
print(_is_typosquat("uvicorn", _POPULAR_PYPI))
# Actual: gunicorn
# Expected: None

A manifest containing uvicorn[standard]>=0.27.0 can produce a High SC6 finding saying uvicorn resembles gunicorn, even though uvicorn is itself a known package.

Cause and existing fix

The similarity loop returns the fuzzy gunicorn match before reaching exact uvicorn membership. #530 checks normalized exact membership before approximate matching and adds regression tests. At filing time that PR is open and unmerged.

Acceptance

• Review and land fix(supply-chain): prefer exact known-package matches in SC6 #530, or an equivalent correction, preserving detection of unknown misspelled packages.
• Verify the exact uvicorn case, case folding, underscore/hyphen normalization, and real typo-positive cases through dependency analysis.
• Identify the first published release containing the correction so downstream consumers can update their pinned version.
• Link the merged fix and release here before closure.

This is limited to SC6 package-name matching. It does not claim every finding in #523 is false, and does not request suppression of vulnerable-version advisories or incomplete scan coverage. The separately tracked AE1 issue is already fixed and is not being reopened.