@coana-tech/cli 14.12.13 → 14.12.15

package/cli.mjs

@@ -210395,7 +210395,7 @@ function getAllToplevelAncestors(artifactMap, artifactId) {
   findAncestors(artifactId);
   return Array.from(toplevelAncestors);
 }
-async function fetchArtifactsFromSocket(rootWorkingDirectory, manifestsTarHash) {
+async function fetchArtifactsFromSocket(rootWorkingDirectory, manifestsTarHash, mode) {
   logger.info("Fetching artifacts from Socket backend using manifests tar hash", manifestsTarHash);
   try {
     const { artifacts } = await fetchArtifactsFromManifestsTarHash(manifestsTarHash);
@@ -210530,7 +210530,7 @@ async function fetchArtifactsFromSocket(rootWorkingDirectory, manifestsTarHash)
     }
     if (purlsFailedToFindWorkspace.size > 0) {
       logger.warn(`Failed to find workspace for the following purls with vulnerabilities: ${Array.from(purlsFailedToFindWorkspace).join(", ")}.
-This means that we will not do a full reachability analysis for these vulnerabilities, but fallback to the results from the pre-computed reachability analysis.`);
+${mode === "reachability" ? "This means that we will not do a full reachability analysis for these vulnerabilities, but fallback to the results from the pre-computed reachability analysis." : ""}`);
     }
     return {
       artifacts,
@@ -225660,7 +225660,7 @@ async function onlineScan(dependencyTree, apiKey, timeout) {
 }
 
 // dist/version.js
-var version2 = "14.12.13";
+var version2 = "14.12.15";
 
 // dist/cli-core.js
 var { mapValues, omit, partition, pick } = import_lodash15.default;
@@ -225809,7 +225809,7 @@ var CliCore = class {
   async computeAndOutputReportSocketMode(otherModulesCommunicator) {
     logger.info("Fetching artifacts from Socket backend");
     this.sendProgress("SCAN_FOR_VULNERABILITIES", true, ".", ".");
-    const { artifacts, ecosystemToWorkspaceToAnalysisData, ecosystemToWorkspaceToVulnerabilities } = await fetchArtifactsFromSocket(this.rootWorkingDirectory, this.options.manifestsTarHash);
+    const { artifacts, ecosystemToWorkspaceToAnalysisData, ecosystemToWorkspaceToVulnerabilities } = await fetchArtifactsFromSocket(this.rootWorkingDirectory, this.options.manifestsTarHash, "reachability");
     this.sendProgress("SCAN_FOR_VULNERABILITIES", false, ".", ".");
     const subProjects = Object.entries(ecosystemToWorkspaceToAnalysisData).flatMap(([ecosystem, workspaceToAnalysisData]) => {
       return Object.entries(workspaceToAnalysisData).map(([workspace, analysisData]) => {
@@ -226377,7 +226377,7 @@ ${upgrades.map((upgrade) => `	${upgrade.purl} -> ${upgrade.upgradeVersion}`).joi
       }
       try {
         const purlToUpgradeVersion = new Map(supportedUpgrades.map((upgrade) => [upgrade.purl, upgrade.upgradeVersion]));
-        const { artifacts } = await fetchArtifactsFromSocket(path2, options.manifestsTarHash);
+        const { artifacts } = await fetchArtifactsFromSocket(path2, options.manifestsTarHash, "upgrade-purls");
         const ecosystemToSocketArtifactUpgrades = {};
         artifacts.forEach((artifact, idx) => {
           if (!artifact.name)
@@ -226549,7 +226549,7 @@ async function computeFixesAndUpgradePurls(path2, options, logFile) {
 }
 async function computeInputForComputingFixes(path2, options) {
   if (options.manifestsTarHash) {
-    const { artifacts: artifacts2 } = await fetchArtifactsFromSocket(path2, options.manifestsTarHash);
+    const { artifacts: artifacts2 } = await fetchArtifactsFromSocket(path2, options.manifestsTarHash, "autofix");
     const ghsaToVulnerableArtifactIds2 = {};
     for (const [index2, artifact] of artifacts2.entries()) {
       if (!artifact.vulnerabilities)
@@ -226674,6 +226674,9 @@ upgradePurls.name("upgrade-purls").argument("<path>", "File system path to the f
 var computeFixesAndUpgradePurlsCmd = new Command();
 computeFixesAndUpgradePurlsCmd.name("compute-fixes-and-upgrade-purls").argument("<path>", "File system path to the folder containing the project").option("-a, --apply-fixes-to <ghsas...>", 'GHSA IDs to compute fixes for. Use "all" to compute fixes for all vulnerabilities.', []).option("--dry-run", "Show what changes would be made without actually making them", false).option("-g, --glob <pattern>", "Glob pattern to filter workspaces by absolute file path").option("-d, --debug", "Enable debug logging", false).option("-s, --silent", "Silence all debug/warning output", false).option("--range-style <style>", 'Range style to use for the output. Currently only "pin" is supported and it only works for npm.').addOption(new Option("--run-without-docker", "Run package managers without using docker").default(process.env.RUN_WITHOUT_DOCKER === "true").hideHelp()).addOption(new Option("--manifests-tar-hash <hash>", "Hash of the tarball containing all manifest files already uploaded to Socket. If provided, Socket will be used for computing dependency trees.").hideHelp()).version(version2).action(async (path2, options) => {
   process.env.DOCKER_IMAGE_TAG ??= version2;
+  if (options.rangeStyle && options.rangeStyle === "preserve") {
+    options.rangeStyle = void 0;
+  }
   if (options.rangeStyle && options.rangeStyle !== "pin") {
     throw new Error('Range style must be "pin"');
   }
@@ -226692,7 +226695,12 @@ compareReportsCommand.name("compare-reports").argument("<baselineReportPath>", "
   const newReport = await readReport(newReportPath);
   await compareReports(baselineReport, newReport, options);
 });
-program2.name("coana-cli").addCommand(run2, { isDefault: true }).addCommand(applyFixes).addCommand(upgradePurls, { hidden: true }).addCommand(compareReportsCommand).addCommand(computeFixesAndUpgradePurlsCmd, { hidden: true }).configureHelp({ sortSubcommands: true }).version(version2);
+var findVulnerabilities = new Command();
+findVulnerabilities.name("find-vulnerabilities").requiredOption("--manifests-tar-hash <hash>", "Hash of the tarball containing all manifest files already uploaded to Socket.").action(async (options) => {
+  const { artifacts } = await fetchArtifactsFromManifestsTarHash(options.manifestsTarHash);
+  console.log(i5(artifacts.flatMap((a4) => a4.vulnerabilities?.map((v) => v.ghsaId) ?? [])));
+});
+program2.name("coana-cli").addCommand(run2, { isDefault: true }).addCommand(findVulnerabilities).addCommand(applyFixes).addCommand(upgradePurls, { hidden: true }).addCommand(compareReportsCommand).addCommand(computeFixesAndUpgradePurlsCmd, { hidden: true }).configureHelp({ sortSubcommands: true }).version(version2);
 program2.parseAsync();
 var defaultCliOptions = {
   debug: false,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coana-tech/cli",
-  "version": "14.12.13",
+  "version": "14.12.15",
   "description": "Coana CLI",
   "type": "module",
   "bin": {