@coana-tech/cli 14.11.12 → 14.11.13

package/cli.mjs

@@ -225392,7 +225392,7 @@ async function onlineScan(dependencyTree, apiKey, timeout) {
 }
 
 // dist/version.js
-var version2 = "14.11.12";
+var version2 = "14.11.13";
 
 // dist/cli-core.js
 var { mapValues, omit, partition, pick } = import_lodash15.default;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coana-tech/cli",
-  "version": "14.11.12",
+  "version": "14.11.13",
   "description": "Coana CLI",
   "type": "module",
   "bin": {

package/reachability-analyzers-cli.mjs

@@ -94989,16 +94989,17 @@ import { join as join13, resolve as resolve10, sep } from "path";
 var { uniq: uniq5 } = import_lodash11.default;
 var GoCodeAwareVulnerabilityScanner = class {
   projectDir;
-  timeoutInSeconds;
+  options;
   name = "GOANA";
-  constructor(projectDir, timeoutInSeconds) {
+  constructor(projectDir, options = {}) {
     this.projectDir = projectDir;
-    this.timeoutInSeconds = timeoutInSeconds;
+    this.options = options;
   }
   async runAnalysis(vulns, heuristic, _analyzesAllVulns) {
     logger.info("Started instantiating Go code-aware analysis");
     if (!existsSync9(join13(this.projectDir, "go.mod")))
       throw new Error("go.mod file not found in the project directory");
+    const { timeoutInSeconds, memoryLimitInMB } = this.options;
     const tmpDir = await createTmpDirectory("goana-output");
     const vulnsOutputFile = join13(tmpDir, "vulns.json");
     const diagnosticsOutputFile = join13(tmpDir, "diagnostics.json");
@@ -95008,7 +95009,10 @@ var GoCodeAwareVulnerabilityScanner = class {
           -output-vulnerabilities ${vulnsOutputFile}
           -output-diagnostics ${diagnosticsOutputFile}
           -topk=4 ${heuristic.includeTests && "-tests"}
-          ${this.projectDir} ${vulnAccPaths}`, void 0, { timeout: this.timeoutInSeconds ? this.timeoutInSeconds * 1e3 : void 0 });
+          ${this.projectDir} ${vulnAccPaths}`, void 0, {
+        timeout: timeoutInSeconds ? timeoutInSeconds * 1e3 : void 0,
+        env: memoryLimitInMB ? { ...process.env, GOMEMLIMIT: `${memoryLimitInMB}MB` } : void 0
+      });
       if (error) {
         logger.error("Error running Go code-aware analysis", error);
         const timeout = !!error.killed;
@@ -95045,7 +95049,7 @@ ${stderr}`);
       await rm4(tmpDir, { recursive: true, force: true });
     }
   }
-  static async runOnDependencyChain([first2, ...rest], vuln, timeoutInSeconds) {
+  static async runOnDependencyChain([first2, ...rest], vuln, options = {}) {
     assert4(first2.version);
     const { Dir, GoMod } = JSON.parse(await runCommandResolveStdOut(cmdt`go mod download -json ${first2.packageName}@v${first2.version}`));
     const projectDir = await createTmpDirectory("go-run-on-dependency-chain-");
@@ -95062,7 +95066,7 @@ ${stderr}`);
         await runGoModTidy(projectDir);
       }
       const heuristic = GoanaHeuristics.NO_TESTS;
-      const result = await new this(projectDir, timeoutInSeconds).runAnalysis([vuln], heuristic, true);
+      const result = await new this(projectDir, options).runAnalysis([vuln], heuristic, true);
       if (result.type === "error")
         return {
           error: result.message,
@@ -95078,7 +95082,7 @@ ${stderr}`);
       await rm4(projectDir, { recursive: true, force: true });
     }
   }
-  static async runOnAlreadyDownloadedPackages(packages, vuln, timeoutInSeconds) {
+  static async runOnAlreadyDownloadedPackages(packages, vuln, options = {}) {
     for (const pkg of packages)
       assert4(existsSync9(join13(pkg, "go.mod")), `${pkg} does not contain a go.mod file`);
     const [app, ...dependencies] = packages;
@@ -95095,7 +95099,7 @@ ${stderr}`);
         await runGoModTidy(projectDir);
       }
       const heuristic = GoanaHeuristics.NO_TESTS;
-      const result = await new this(projectDir, timeoutInSeconds).runAnalysis([vuln], heuristic, true);
+      const result = await new this(projectDir, options).runAnalysis([vuln], heuristic, true);
       if (result.type === "error")
         return {
           error: result.message,
@@ -96170,7 +96174,10 @@ async function analyzePackages(ecosystem, packages, vulnerability, options) {
       break;
     case "GO":
       analysisName = "Goana";
-      result = await GoCodeAwareVulnerabilityScanner.runOnDependencyChain(packages, vulnerability, options?.timeoutInSeconds ?? 60);
+      result = await GoCodeAwareVulnerabilityScanner.runOnDependencyChain(packages, vulnerability, {
+        timeoutInSeconds: options?.timeoutInSeconds ?? 60,
+        memoryLimitInMB: options?.memoryLimitInMB ?? 16384
+      });
       break;
     case "RUST":
       analysisName = "Rustica";
@@ -96215,7 +96222,10 @@ async function analyzeAlreadyInstalledPackages(ecosystem, packages, vulnerabilit
       break;
     case "GO":
       analysisName = "Goana";
-      result = await GoCodeAwareVulnerabilityScanner.runOnAlreadyDownloadedPackages(packages, vulnerability, options?.timeoutInSeconds ?? 60);
+      result = await GoCodeAwareVulnerabilityScanner.runOnAlreadyDownloadedPackages(packages, vulnerability, {
+        timeoutInSeconds: options?.timeoutInSeconds ?? 60,
+        memoryLimitInMB: options?.memoryLimitInMB ?? 16384
+      });
       break;
     case "RUST":
       analysisName = "Rustica";
@@ -96270,7 +96280,7 @@ async function getVersion(analysisName) {
 // dist/whole-program-code-aware-vulnerability-scanner/python/python-code-aware-vulnerability-scanner.js
 var import_semver2 = __toESM(require_semver2(), 1);
 var { omit, once: once3, pick, sortedUniq, uniqBy } = import_lodash14.default;
-var PythonCodeAwareVulnerabilityScanner = class _PythonCodeAwareVulnerabilityScanner {
+var PythonCodeAwareVulnerabilityScanner = class {
   state;
   projectDir;
   name = "MAMBALADE";
@@ -96295,9 +96305,7 @@ var PythonCodeAwareVulnerabilityScanner = class _PythonCodeAwareVulnerabilitySca
   async runAnalysis(vulns, heuristic, analyzesAllVulns) {
     if (!this.virtualEnvInfo)
       throw new Error("Virtual environment not set up");
-    if (!this.mambaladeVenvPath) {
-      await this.setupMambalade();
-    }
+    this.mambaladeVenvPath ??= await setupMambalade();
     logger.info("Started instantiating Python code-aware analysis");
     logger.debug(`Trying to find files to analyze from projectDir: ${this.projectDir}`);
     const { rootWorkingDir, reachabilityAnalysisOptions } = this.state;
@@ -96429,7 +96437,7 @@ ${msg}`;
       logger.info(`Copying ${app} to ${projectDir}`);
       await cp5(app, projectDir, { recursive: true });
       fileMappings.set(projectDir, app);
-      const scanner = new _PythonCodeAwareVulnerabilityScanner({
+      const scanner = new this({
         rootWorkingDir: projectTmpDir,
         reachabilityAnalysisOptions: options
       }, projectTmpDir);
@@ -96608,22 +96616,6 @@ ${msg}`;
   getVirtualEnvInfo() {
     return this.virtualEnvInfo;
   }
-  async setupMambalade() {
-    const venvDir = await createTmpDirectory("mambalade-venv");
-    logger.info("Creating Mambalade virtual environment");
-    const pythonInterpreter = await getPythonInterpreter();
-    await exec(cmdt`${pythonInterpreter} -SIm venv ${venvDir}`);
-    const mambaladeWheelsPath = join15(COANA_REPOS_PATH(), "mambalade", "dist");
-    const wheelFiles = await readdir3(mambaladeWheelsPath);
-    const mambaladeWheels = wheelFiles.filter((f2) => f2.endsWith(".whl")).map((f2) => join15(mambaladeWheelsPath, f2));
-    if (mambaladeWheels.length === 0) {
-      throw new Error(`No mambalade wheel files found in ${mambaladeWheelsPath}`);
-    }
-    logger.info(`Installing mambalade wheels: ${mambaladeWheels.join(", ")}`);
-    await exec(cmdt`${venvDir}/bin/pip install --no-deps ${mambaladeWheels}`);
-    this.mambaladeVenvPath = venvDir;
-    logger.info("Mambalade virtual environment setup complete");
-  }
   // async [Symbol.asyncDispose]() {
   async cleanup() {
     if (this.virtualEnvInfo?.temporary) {
@@ -96684,6 +96676,21 @@ async function getPythonInterpreter() {
     return "python3";
   throw new Error(`No Python ${pythonVersionRequired} interpreter found`);
 }
+async function setupMambalade() {
+  const venvDir = await createTmpDirectory("mambalade-venv");
+  logger.info("Creating Mambalade virtual environment");
+  const pythonInterpreter = await getPythonInterpreter();
+  await exec(cmdt`${pythonInterpreter} -SIm venv ${venvDir}`);
+  const mambaladeWheelsPath = join15(COANA_REPOS_PATH(), "mambalade", "dist");
+  const wheelFiles = await readdir3(mambaladeWheelsPath);
+  const mambaladeWheels = wheelFiles.filter((f2) => f2.endsWith(".whl")).map((f2) => join15(mambaladeWheelsPath, f2));
+  if (!mambaladeWheels.length)
+    throw new Error(`No mambalade wheel files found in ${mambaladeWheelsPath}`);
+  logger.info(`Installing mambalade wheels: ${mambaladeWheels.join(", ")}`);
+  await exec(cmdt`${venvDir}/bin/pip install --no-deps ${mambaladeWheels}`);
+  logger.info("Mambalade virtual environment setup complete");
+  return venvDir;
+}
 
 // dist/whole-program-code-aware-vulnerability-scanner/python/phantom-deps.js
 var { uniq: uniq8 } = import_lodash15.default;
@@ -97208,7 +97215,7 @@ var GoAnalyzer = class {
     const vulnerablePackages = uniq9(vulns.flatMap((v) => v.vulnerabilityAccessPaths.map((vap) => vap.split(":")[0])));
     const irrelevantPackages = new Set(await getIrrelevantPackages(this.projectDir, vulnerablePackages));
     const [unreachableVulns, otherVulns] = partition2(vulns, (v) => v.vulnerabilityAccessPaths.every((vap) => irrelevantPackages.has(vap.split(":")[0])));
-    const res = otherVulns.length ? await analyzeWithHeuristics(this.state, otherVulns, [GoanaHeuristics.DEFAULT], false, new GoCodeAwareVulnerabilityScanner(this.projectDir, this.state.reachabilityAnalysisOptions.timeoutInSeconds), analysisMetadataCollector, statusUpdater) : [];
+    const res = otherVulns.length ? await analyzeWithHeuristics(this.state, otherVulns, [GoanaHeuristics.DEFAULT], false, new GoCodeAwareVulnerabilityScanner(this.projectDir, this.state.reachabilityAnalysisOptions), analysisMetadataCollector, statusUpdater) : [];
     if (unreachableVulns.length) {
       const heuristicName = GoanaHeuristics.IMPORT_REACHABILITY.name;
       const detectedOccurrences = {