vulnscan-ai 0.4.4

Effective-state scanner — a patch on disk is not a patch in RAM

New read-only effective scanner reports what the running system is still using:

• Kernel currency — running kernel vs newest installed. If an update landed but the host hasn't rebooted, it keeps executing the OLD (vulnerable) kernel while the package scanners report it patched. → one reboot required finding (important). A membership check avoids false positives on kernel-rt/debug hosts.
• Superseded libraries in use — a process still mapping a deleted/replaced library (.so updated on disk but the running process holds the old code) needs a restart. Reads /proc/<pid>/maps and maps each PID to its systemd unit via /proc/<pid>/cgroup → per-service restart to load the update finding. Deleted core libraries (glibc/loader/systemd) imply a reboot.

Pure stdlib (/proc + rpm); uses dnf-utils' needs-restarting -r as the authoritative reboot verdict when present (now a Recommends).

fix now overwrites a package fix's requires_reboot with this ground truth after applying — the "reboot required" note is a fact, not an AI guess. And reboot/shutdown/poweroff/halt/kexec/init 0,6/systemctl reboot are on the deny-list: a fix never takes the host down itself — rebooting stays the operator's call.

Run it with --scanner effective or --all. 259 tests, bandit clean. Signed el9 + el10 packages below; install via https://repo.techhack.nl