@coana-tech/cli 14.12.159 → 14.12.161

package/cli.mjs

@@ -69910,7 +69910,7 @@ var require_lockfile = __commonJS({
               }
               const file = _ref22;
               if (yield exists2(file)) {
-                return readFile36(file);
+                return readFile38(file);
               }
             }
             return null;
@@ -69929,7 +69929,7 @@ var require_lockfile = __commonJS({
         })();
         let readJsonAndFile = exports3.readJsonAndFile = (() => {
           var _ref24 = (0, (_asyncToGenerator2 || _load_asyncToGenerator()).default)(function* (loc) {
-            const file = yield readFile36(loc);
+            const file = yield readFile38(loc);
             try {
               return {
                 object: (0, (_map || _load_map()).default)(JSON.parse(stripBOM2(file))),
@@ -70169,7 +70169,7 @@ var require_lockfile = __commonJS({
           };
         })();
         exports3.copy = copy;
-        exports3.readFile = readFile36;
+        exports3.readFile = readFile38;
         exports3.readFileRaw = readFileRaw;
         exports3.normalizeOS = normalizeOS;
         var _fs;
@@ -70267,7 +70267,7 @@ var require_lockfile = __commonJS({
             });
           });
         }
-        function readFile36(loc) {
+        function readFile38(loc) {
           return _readFile(loc, "utf8").then(normalizeOS);
         }
         function readFileRaw(loc) {
@@ -199895,7 +199895,7 @@ var {
 } = import_index.default;
 
 // dist/index.js
-import { mkdir as mkdir7, mkdtemp as mkdtemp2, readFile as readFile35, rm as rm3, writeFile as writeFile17 } from "fs/promises";
+import { mkdir as mkdir7, mkdtemp as mkdtemp2, readFile as readFile37, rm as rm3, writeFile as writeFile17 } from "fs/promises";
 import { tmpdir as tmpdir5 } from "os";
 import { dirname as dirname26, join as join35, resolve as resolve44 } from "path";
 
@@ -205220,53 +205220,131 @@ var Spinner = class _Spinner {
 
 // ../utils/src/telemetry/telemetry-collector.ts
 import { execFile } from "child_process";
-import { platform } from "os";
+import { readFile as readFile3 } from "fs/promises";
+import { platform } from "process";
 import { promisify } from "util";
 var execFileAsync = promisify(execFile);
-var TelemetryCollector = class {
+var TelemetryCollector = class _TelemetryCollector {
+  constructor(pid) {
+    this.pid = pid;
+  }
+  previousCpuState;
+  clockTicksPerSecond;
+  pageSize;
+  isCollecting = false;
+  static create(pid) {
+    if (!Number.isInteger(pid) || pid <= 0 || !["darwin", "linux", "win32"].includes(platform)) return void 0;
+    return new _TelemetryCollector(pid);
+  }
   /**
-   * Collect memory metrics for a child process by PID.
-   * Uses OS-specific commands to query memory usage.
-   *
-   * @param pid - The process ID to query
-   * @returns TelemetryMetrics or undefined if the process doesn't exist or query fails
+   * Collect metrics for the child process.
+   * Uses OS-specific methods to query memory and CPU usage.
    */
-  async collectChildProcessMetrics(pid) {
-    if (!Number.isInteger(pid) || pid <= 0) {
+  async collectChildProcessMetrics() {
+    if (this.isCollecting) {
       return void 0;
     }
+    this.isCollecting = true;
     try {
-      const currentPlatform = platform();
-      if (currentPlatform === "darwin" || currentPlatform === "linux") {
-        return await this.collectUnixProcessMetrics(pid);
+      if (platform === "darwin") {
+        return await this.collectDarwinProcessMetrics();
+      }
+      if (platform === "linux") {
+        return await this.collectLinuxProcessMetrics();
+      }
+      if (platform === "win32") {
+        return await this.collectWindowsProcessMetrics();
       }
       return void 0;
     } catch {
       return void 0;
+    } finally {
+      this.isCollecting = false;
     }
   }
   /**
-   * Collect metrics for a Unix-like system (macOS, Linux) using ps command.
+   * Collect metrics on macOS using ps command.
    */
-  async collectUnixProcessMetrics(pid) {
+  async collectDarwinProcessMetrics() {
     try {
-      const { stdout } = await execFileAsync("ps", ["-o", "rss=,pcpu=", "-p", String(pid)], {
+      const { stdout } = await execFileAsync("ps", ["-o", "rss=,pcpu=", "-p", String(this.pid)], {
         timeout: 5e3
       });
+      const parts = stdout.trim().split(/\s+/);
+      if (parts.length < 2) return void 0;
+      const rssKb = parseInt(parts[0], 10);
+      const cpuPercent = parseFloat(parts[1]);
+      if (isNaN(rssKb) || isNaN(cpuPercent)) return void 0;
+      return {
+        rss: rssKb * 1024,
+        // Convert KB to bytes
+        // Note: cpuPercent can exceed 100% on multi-core systems (e.g., 250% = 2.5 cores used)
+        cpuPercent
+      };
+    } catch {
+      return void 0;
+    }
+  }
+  /**
+   * Collect metrics on Linux using /proc filesystem.
+   * This works on all Linux distributions including Alpine (BusyBox).
+   */
+  async collectLinuxProcessMetrics() {
+    try {
+      const statmContent = await readFile3(`/proc/${this.pid}/statm`, "utf-8");
+      const statmParts = statmContent.trim().split(/\s+/);
+      if (statmParts.length < 2) {
+        return void 0;
+      }
+      const residentPages = parseInt(statmParts[1], 10);
+      if (isNaN(residentPages)) {
+        return void 0;
+      }
+      const pageSize = await this.getPageSize();
+      const rssBytes = residentPages * pageSize;
+      const statContent = await readFile3(`/proc/${this.pid}/stat`, "utf-8");
+      const cpuPercent = await this.calculateCpuPercent(statContent);
+      return {
+        rss: rssBytes,
+        cpuPercent
+      };
+    } catch {
+      return void 0;
+    }
+  }
+  /**
+   * Collect metrics on Windows using PowerShell.
+   * Uses Get-Process for memory and CPU time tracking for CPU%.
+   */
+  async collectWindowsProcessMetrics() {
+    try {
+      const psScript = "$p = Get-Process -Id $args[0] -ErrorAction Stop; @{WorkingSet64=$p.WorkingSet64; TotalMs=$p.TotalProcessorTime.TotalMilliseconds} | ConvertTo-Json";
+      const { stdout } = await execFileAsync(
+        "powershell",
+        ["-NoProfile", "-Command", psScript, String(this.pid)],
+        { timeout: 5e3 }
+      );
       const trimmed = stdout.trim();
       if (!trimmed) {
         return void 0;
       }
-      const parts = trimmed.split(/\s+/);
-      if (parts.length < 2) {
+      const data2 = JSON.parse(trimmed);
+      const rssBytes = data2.WorkingSet64;
+      const totalCpuMs = data2.TotalMs;
+      if (typeof rssBytes !== "number" || typeof totalCpuMs !== "number") {
         return void 0;
       }
-      const rssKb = parseInt(parts[0], 10);
-      const cpuPercent = parseFloat(parts[1]);
-      if (isNaN(rssKb) || isNaN(cpuPercent)) {
-        return void 0;
+      const now = Date.now();
+      const currentState = { totalCpuTime: totalCpuMs, timestamp: now };
+      let cpuPercent = 0;
+      if (this.previousCpuState) {
+        const timeDeltaMs = now - this.previousCpuState.timestamp;
+        const cpuTimeDelta = totalCpuMs - this.previousCpuState.totalCpuTime;
+        if (timeDeltaMs > 0 && cpuTimeDelta >= 0) {
+          cpuPercent = Math.max(0, cpuTimeDelta / timeDeltaMs * 100);
+        }
       }
-      const rssBytes = rssKb * 1024;
+      this.previousCpuState = currentState;
       return {
         rss: rssBytes,
         cpuPercent
@@ -205275,6 +205353,74 @@ var TelemetryCollector = class {
       return void 0;
     }
   }
+  /**
+   * Calculate CPU percentage from /proc/<pid>/stat.
+   * Requires tracking state between calls to compute the delta.
+   */
+  async calculateCpuPercent(statContent) {
+    try {
+      const lastParen = statContent.lastIndexOf(")");
+      if (lastParen === -1) {
+        return 0;
+      }
+      const fieldsAfterComm = statContent.slice(lastParen + 2).split(/\s+/);
+      const utime = parseInt(fieldsAfterComm[11], 10);
+      const stime = parseInt(fieldsAfterComm[12], 10);
+      if (isNaN(utime) || isNaN(stime)) {
+        return 0;
+      }
+      const totalCpuTime = utime + stime;
+      const now = Date.now();
+      const clockTicks = await this.getClockTicksPerSecond();
+      const currentState = { totalCpuTime, timestamp: now };
+      if (!this.previousCpuState) {
+        this.previousCpuState = currentState;
+        return 0;
+      }
+      const timeDeltaMs = now - this.previousCpuState.timestamp;
+      const cpuTimeDelta = totalCpuTime - this.previousCpuState.totalCpuTime;
+      this.previousCpuState = currentState;
+      if (timeDeltaMs <= 0 || cpuTimeDelta < 0) {
+        return 0;
+      }
+      const cpuPercent = cpuTimeDelta * 1e3 * 100 / (clockTicks * timeDeltaMs);
+      return Math.max(0, cpuPercent);
+    } catch {
+      return 0;
+    }
+  }
+  /**
+   * Get the system page size in bytes (cached after first call).
+   */
+  async getPageSize() {
+    if (this.pageSize !== void 0) {
+      return this.pageSize;
+    }
+    try {
+      const { stdout } = await execFileAsync("getconf", ["PAGE_SIZE"], { timeout: 1e3 });
+      const parsed = parseInt(stdout.trim(), 10);
+      this.pageSize = isNaN(parsed) ? 4096 : parsed;
+    } catch {
+      this.pageSize = 4096;
+    }
+    return this.pageSize;
+  }
+  /**
+   * Get the number of clock ticks per second (used for CPU time conversion).
+   */
+  async getClockTicksPerSecond() {
+    if (this.clockTicksPerSecond !== void 0) {
+      return this.clockTicksPerSecond;
+    }
+    try {
+      const { stdout } = await execFileAsync("getconf", ["CLK_TCK"], { timeout: 1e3 });
+      const ticks = parseInt(stdout.trim(), 10);
+      this.clockTicksPerSecond = isNaN(ticks) ? 100 : ticks;
+    } catch {
+      this.clockTicksPerSecond = 100;
+    }
+    return this.clockTicksPerSecond;
+  }
 };
 
 // ../utils/src/telemetry/analyzer-telemetry-server.ts
@@ -205376,14 +205522,14 @@ function startHeartbeat(options) {
   return () => clearInterval(timer);
 }
 var DEFAULT_TELEMETRY_INTERVAL_MS = 5e3;
-function startTelemetry(pid, handler) {
-  const collector = new TelemetryCollector();
+function startTelemetry(subprocess, handler) {
+  const collector = TelemetryCollector.create(subprocess.pid);
+  if (!collector) return;
+  handler.onInit?.(subprocess);
   const intervalMs = handler.intervalMs ?? DEFAULT_TELEMETRY_INTERVAL_MS;
   const collectAndReport = async () => {
-    const metrics = await collector.collectChildProcessMetrics(pid);
-    if (metrics) {
-      handler.onTelemetry(metrics);
-    }
+    const metrics = await collector.collectChildProcessMetrics();
+    if (metrics) handler.onTelemetry(metrics);
   };
   collectAndReport().catch((err) => {
     logger.debug("Initial telemetry collection failed:", err);
@@ -205395,6 +205541,48 @@ function startTelemetry(pid, handler) {
   timer.unref?.();
   return () => clearInterval(timer);
 }
+function wrapWithMemoryLimit(cmd, options) {
+  const memoryLimitKiB = Math.ceil(options.memoryLimitInMB * 1024);
+  if (memoryLimitKiB <= 0)
+    throw new Error(`memoryLimitInMB * 1024 must be a positive number, got: ${memoryLimitKiB}`);
+  switch (process.platform) {
+    case "darwin":
+      {
+        const prevHandler = options.telemetryHandler;
+        let subprocess;
+        options.telemetryHandler = {
+          intervalMs: prevHandler?.intervalMs ?? 2e3,
+          onInit: (sp) => {
+            subprocess = sp;
+            prevHandler?.onInit?.(sp);
+          },
+          onTelemetry(metrics) {
+            if (subprocess?.exitCode === null && metrics.rss >= memoryLimitKiB * 1024) {
+              logger.debug(
+                `Memory limit of ${options.memoryLimitInMB} MiB exceeded (RSS: ${(metrics.rss / 1024 / 1024).toFixed(
+                  2
+                )} MiB). Terminating process.`
+              );
+              subprocess.kill(options.killSignal ?? "SIGTERM");
+              subprocess = void 0;
+            }
+            prevHandler?.onTelemetry(metrics);
+          }
+        };
+      }
+      break;
+    case "linux":
+      return [
+        "sh",
+        ...typeof cmd === "string" ? ["-c", `ulimit -v ${memoryLimitKiB} && eval "$1"`, "_", cmd] : ["-c", `ulimit -v ${memoryLimitKiB} && exec "$@"`, "_", ...cmd]
+      ];
+    default:
+      logger.debug(
+        `Memory limit enforcement is not supported on platform: ${process.platform}. Ignoring memory limit option.`
+      );
+  }
+  return cmd;
+}
 async function execNeverFail(cmd, dir, options) {
   const stopHeartbeat = options?.heartbeat ? startHeartbeat(options.heartbeat) : void 0;
   let stopTelemetry;
@@ -205404,6 +205592,8 @@ async function execNeverFail(cmd, dir, options) {
     analyzerTelemetryServer = new AnalyzerTelemetryServer(options.analyzerTelemetryHandler);
     analyzerTelemetryFilePath = await analyzerTelemetryServer.start();
   }
+  if (options?.memoryLimitInMB !== void 0)
+    cmd = wrapWithMemoryLimit(cmd, options);
   try {
     return await new Promise((resolve45) => {
       let args2;
@@ -205418,9 +205608,8 @@ async function execNeverFail(cmd, dir, options) {
           resolve45({ error, stdout, stderr });
         }
       );
-      if (options?.telemetryHandler && childProcess.pid) {
-        stopTelemetry = startTelemetry(childProcess.pid, options.telemetryHandler);
-      }
+      if (options?.telemetryHandler && childProcess.pid)
+        stopTelemetry = startTelemetry(childProcess, options.telemetryHandler);
       if (options?.pipe) {
         childProcess.stdout?.on("data", (data2) => {
           Spinner.instance().suspend(() => {
@@ -212545,7 +212734,7 @@ function splitLines(text3) {
 
 // ../fixing-management/src/fixing-management/utils/socket-patch-utils.ts
 import { existsSync as existsSync3 } from "node:fs";
-import { readFile as readFile3, writeFile as writeFile3 } from "node:fs/promises";
+import { readFile as readFile4, writeFile as writeFile3 } from "node:fs/promises";
 import { resolve as resolve4 } from "node:path";
 
 // ../utils/src/version-comparison/version-satisfies.ts
@@ -214068,7 +214257,7 @@ async function applyPatches(ecosystem, rootDir, patches, ctxt, patchAppliedMessa
     if (!existsSync3(fullPath)) {
       await writeFile3(fullPath, "", "utf-8");
     }
-    let fileContent = await readFile3(fullPath, "utf-8");
+    let fileContent = await readFile4(fullPath, "utf-8");
     const groupedPatches = groupPatches(rootDir, patches2);
     const resolvedPatches = resolveConflicts(ecosystem, groupedPatches, ctxt);
     const sortedPatches = resolvedPatches.sort(
@@ -214176,7 +214365,7 @@ function resolveConflicts(ecosystem, patches, ctxt) {
 
 // ../utils/src/go-mod-utils.ts
 import { dirname as dirname6, resolve as resolve5 } from "node:path";
-import { readFile as readFile4 } from "node:fs/promises";
+import { readFile as readFile5 } from "node:fs/promises";
 
 // ../utils/src/go-mod-parser.ts
 function recordError(state, message2, col) {
@@ -214872,7 +215061,7 @@ function parseGoMod(content, options = {}) {
 // ../utils/src/go-mod-utils.ts
 async function parseGoModFile(rootDir, goModPath) {
   const fullPath = resolve5(rootDir, goModPath);
-  const content = await readFile4(fullPath, "utf-8");
+  const content = await readFile5(fullPath, "utf-8");
   const result = parseGoMod(content, { includeOffsets: true });
   return {
     ...result,
@@ -215225,12 +215414,12 @@ replace ${modulePath} ${currentVersion} => ${modulePath} ${newVersion}
 
 // ../fixing-management/src/fixing-management/maven/gradle-fixing-manager.ts
 import { existsSync as existsSync6 } from "node:fs";
-import { readFile as readFile8 } from "node:fs/promises";
+import { readFile as readFile9 } from "node:fs/promises";
 import { join as join7, resolve as resolve9 } from "node:path";
 
 // ../fixing-management/src/fixing-management/utils/coana-patch-application.ts
 import { existsSync as existsSync4 } from "node:fs";
-import { readFile as readFile5, writeFile as writeFile4 } from "node:fs/promises";
+import { readFile as readFile6, writeFile as writeFile4 } from "node:fs/promises";
 import { resolve as resolve7 } from "node:path";
 function detectPatchConflicts(rootDir, patchResults) {
   const patchesByFile = /* @__PURE__ */ new Map();
@@ -215363,7 +215552,7 @@ async function applyPatchResults(ecosystem, rootDir, patchResults) {
     if (!existsSync4(filePath)) {
       await writeFile4(filePath, "", "utf-8");
     }
-    let fileContent = await readFile5(filePath, "utf-8");
+    let fileContent = await readFile6(filePath, "utf-8");
     for (const patch of sortedPatches) {
       const start = patch.offset;
       const end2 = patch.offset + (patch.oldText?.length ?? 0);
@@ -215375,7 +215564,7 @@ async function applyPatchResults(ecosystem, rootDir, patchResults) {
 
 // ../fixing-management/src/fixing-management/maven/gradle-build-file-helper.ts
 var import_good_enough_parser = __toESM(require_cjs(), 1);
-import { readFile as readFile6 } from "node:fs/promises";
+import { readFile as readFile7 } from "node:fs/promises";
 
 // ../fixing-management/src/fixing-management/maven/utils.ts
 import { existsSync as existsSync5 } from "node:fs";
@@ -215597,7 +215786,7 @@ var treeQuery = import_good_enough_parser.query.tree({
 });
 async function findDependencyDeclsAndCatalogFiles(filePath) {
   const gradleLang = import_good_enough_parser.lang.createLang("groovy");
-  const cursor = gradleLang.parse(await readFile6(filePath, "utf-8"));
+  const cursor = gradleLang.parse(await readFile7(filePath, "utf-8"));
   const ctx = gradleLang.query(cursor, treeQuery, {
     mem: {},
     depDecls: [],
@@ -215633,7 +215822,7 @@ ${getConstraintsBlockString(groupId, artifactId, classifier, version4, indentati
 }
 
 // ../fixing-management/src/fixing-management/maven/gradle-version-catalog-helper.ts
-import { readFile as readFile7 } from "node:fs/promises";
+import { readFile as readFile8 } from "node:fs/promises";
 
 // ../utils/src/toml-utils.ts
 var tomlParser = __toESM(require_lib10(), 1);
@@ -215900,7 +216089,7 @@ function parseDependencyObject(valueNode) {
   };
 }
 async function findVersionCatalogDeclarations(filePath) {
-  const catalogData = parseVersionCatalog(await readFile7(filePath, "utf-8"));
+  const catalogData = parseVersionCatalog(await readFile8(filePath, "utf-8"));
   return {
     depDecls: catalogData.dependencies,
     versionDecls: catalogData.versions
@@ -216105,7 +216294,7 @@ var GradleFixingManager = class {
         newText: constraintStr + "\n"
       };
     } else {
-      const fileContent = await readFile8(targetBuildFile, "utf-8");
+      const fileContent = await readFile9(targetBuildFile, "utf-8");
       const indentationSize = getIndentationSize(fileContent);
       const prependNewline = fileContent.split("\n").some((line) => !line.trim());
       const finalConstraintStr = getDependencyConstraintString(
@@ -216292,7 +216481,7 @@ var GradleFixingManager = class {
   async createConstraintsForFile(buildFile, fixes) {
     const { dependenciesBlocks, constraintsBlocks } = await findDependencyDeclsAndCatalogFiles(buildFile);
     const fileType = buildFile.endsWith(".kts") ? "kotlin" : "groovy";
-    const fileContent = existsSync6(buildFile) ? await readFile8(buildFile, "utf-8") : "";
+    const fileContent = existsSync6(buildFile) ? await readFile9(buildFile, "utf-8") : "";
     const indentationSize = getIndentationSize(fileContent);
     const constraintDeclarations = fixes.map(({ dependencyDetails, fixedVersion }) => {
       const [groupId, artifactId] = dependencyDetails.packageName.split(":");
@@ -216399,7 +216588,7 @@ import { resolve as resolve11 } from "node:path";
 
 // ../utils/src/pom-utils.ts
 var import_parse_xml2 = __toESM(require_dist(), 1);
-import { readFile as readFile9 } from "node:fs/promises";
+import { readFile as readFile10 } from "node:fs/promises";
 import { existsSync as existsSync7 } from "node:fs";
 import { resolve as resolve10, join as join8, relative as relative3, dirname as dirname8 } from "node:path";
 
@@ -216535,7 +216724,7 @@ async function loadPom(rootDir, pomFile, validateFile, visited = /* @__PURE__ */
   if (!validatedPomFile || !existsSync7(validatedPomFile)) return void 0;
   if (visited.has(validatedPomFile)) return void 0;
   visited.add(validatedPomFile);
-  const sourceText = await readFile9(validatedPomFile, "utf-8");
+  const sourceText = await readFile10(validatedPomFile, "utf-8");
   const xml2 = (0, import_parse_xml2.parseXml)(sourceText, { includeOffsets: true });
   const indentation = inferIndentationFromParsedXml(xml2, sourceText);
   const pom = {
@@ -217823,11 +218012,11 @@ import { dirname as dirname10, resolve as resolve14 } from "node:path";
 import assert7 from "node:assert";
 
 // ../fixing-management/src/fixing-management/maven/gradle-lockfile-utils.ts
-import { readFile as readFile10 } from "node:fs/promises";
+import { readFile as readFile11 } from "node:fs/promises";
 import { resolve as resolve13 } from "node:path";
 async function loadLockFile(rootDir, lockfilePath) {
   const file = resolve13(rootDir, lockfilePath);
-  return { rootDir, file, sourceText: await readFile10(file, "utf-8") };
+  return { rootDir, file, sourceText: await readFile11(file, "utf-8") };
 }
 
 // ../fixing-management/src/fixing-management/maven/handlers/gradle-lockfile-upgrade-handler.ts
@@ -217898,13 +218087,13 @@ var GradleLockfileUpgradeHandler = class {
 
 // ../fixing-management/src/fixing-management/maven/handlers/sbt-upgrade-handler.ts
 import { existsSync as existsSync8 } from "node:fs";
-import { readFile as readFile12 } from "node:fs/promises";
+import { readFile as readFile13 } from "node:fs/promises";
 import { basename as basename4, dirname as dirname11, resolve as resolve15 } from "node:path";
 import assert8 from "node:assert";
 
 // ../fixing-management/src/fixing-management/maven/sbt-project-utils.ts
 var import_good_enough_parser2 = __toESM(require_cjs(), 1);
-import { readFile as readFile11 } from "node:fs/promises";
+import { readFile as readFile12 } from "node:fs/promises";
 var pathQuery2 = import_good_enough_parser2.query.sym((ctx, { offset, value: value2 }) => {
   return { ...ctx, pathOffset: offset, pathValue: value2 };
 }).many(
@@ -218081,7 +218270,7 @@ var treeQuery2 = import_good_enough_parser2.query.tree({
 });
 async function loadSbtProject(filePath, acc = { mem: {}, moduleIds: [] }) {
   const scalaLang = import_good_enough_parser2.lang.createLang("scala");
-  const cursor = scalaLang.parse(await readFile11(filePath, "utf-8"));
+  const cursor = scalaLang.parse(await readFile12(filePath, "utf-8"));
   return scalaLang.query(cursor, treeQuery2, acc) ?? acc;
 }
 function evaluate2(v) {
@@ -218224,7 +218413,7 @@ ${indent(1, indentationSize)}`)}
     } else {
       let fileContent;
       try {
-        fileContent = await readFile12(dependencyOverridesFile, "utf-8");
+        fileContent = await readFile13(dependencyOverridesFile, "utf-8");
       } catch (error) {
         ctxt.statusUpdater?.({
           status: "error",
@@ -218353,7 +218542,7 @@ var MavenSocketUpgradeManager = class {
 
 // ../fixing-management/src/fixing-management/maven/sbt-fixing-manager.ts
 import { existsSync as existsSync9 } from "node:fs";
-import { readFile as readFile13 } from "node:fs/promises";
+import { readFile as readFile14 } from "node:fs/promises";
 import { join as join9 } from "node:path";
 var SbtFixingManager = class {
   constructor(rootDir, subprojectPath, otherModulesCommunicator) {
@@ -218555,7 +218744,7 @@ var SbtFixingManager = class {
 `
       };
     } else {
-      const fileContent = await readFile13(workspaceBuildSbtPath, "utf-8");
+      const fileContent = await readFile14(workspaceBuildSbtPath, "utf-8");
       const prependNewline = fileContent.split("\n").some((line) => !line.trim());
       return {
         file: workspaceBuildSbtPath,
@@ -218634,7 +218823,7 @@ ${indent(1, indentationSize)}`)}
         newText: overrideText
       };
     } else {
-      const fileContent = await readFile13(workspaceBuildSbtPath, "utf-8");
+      const fileContent = await readFile14(workspaceBuildSbtPath, "utf-8");
       const indentationSize = getIndentationSize(fileContent);
       const prependNewline = fileContent.length > 0 && !fileContent.endsWith("\n\n");
       const overrideText = `dependencyOverrides ++= Seq(
@@ -218653,7 +218842,7 @@ ${indent(1, indentationSize)}`)}
 
 // ../fixing-management/src/fixing-management/npm/npm-socket-upgrade-manager.ts
 import { existsSync as existsSync15 } from "fs";
-import { readFile as readFile18 } from "fs/promises";
+import { readFile as readFile20 } from "fs/promises";
 import assert10 from "node:assert";
 import { dirname as dirname14, join as join14, relative as relative9, resolve as resolve24 } from "path";
 
@@ -224295,53 +224484,131 @@ var Spinner2 = class _Spinner {
 
 // ../utils/dist/telemetry/telemetry-collector.js
 import { execFile as execFile3 } from "child_process";
-import { platform as platform7 } from "os";
+import { readFile as readFile15 } from "fs/promises";
+import { platform as platform7 } from "process";
 import { promisify as promisify2 } from "util";
 var execFileAsync2 = promisify2(execFile3);
-var TelemetryCollector2 = class {
+var TelemetryCollector2 = class _TelemetryCollector {
+  pid;
+  previousCpuState;
+  clockTicksPerSecond;
+  pageSize;
+  isCollecting = false;
+  constructor(pid) {
+    this.pid = pid;
+  }
+  static create(pid) {
+    if (!Number.isInteger(pid) || pid <= 0 || !["darwin", "linux", "win32"].includes(platform7))
+      return void 0;
+    return new _TelemetryCollector(pid);
+  }
   /**
-   * Collect memory metrics for a child process by PID.
-   * Uses OS-specific commands to query memory usage.
-   *
-   * @param pid - The process ID to query
-   * @returns TelemetryMetrics or undefined if the process doesn't exist or query fails
+   * Collect metrics for the child process.
+   * Uses OS-specific methods to query memory and CPU usage.
    */
-  async collectChildProcessMetrics(pid) {
-    if (!Number.isInteger(pid) || pid <= 0) {
+  async collectChildProcessMetrics() {
+    if (this.isCollecting) {
       return void 0;
     }
+    this.isCollecting = true;
     try {
-      const currentPlatform = platform7();
-      if (currentPlatform === "darwin" || currentPlatform === "linux") {
-        return await this.collectUnixProcessMetrics(pid);
+      if (platform7 === "darwin") {
+        return await this.collectDarwinProcessMetrics();
+      }
+      if (platform7 === "linux") {
+        return await this.collectLinuxProcessMetrics();
+      }
+      if (platform7 === "win32") {
+        return await this.collectWindowsProcessMetrics();
       }
       return void 0;
     } catch {
       return void 0;
+    } finally {
+      this.isCollecting = false;
     }
   }
   /**
-   * Collect metrics for a Unix-like system (macOS, Linux) using ps command.
+   * Collect metrics on macOS using ps command.
    */
-  async collectUnixProcessMetrics(pid) {
+  async collectDarwinProcessMetrics() {
     try {
-      const { stdout } = await execFileAsync2("ps", ["-o", "rss=,pcpu=", "-p", String(pid)], {
+      const { stdout } = await execFileAsync2("ps", ["-o", "rss=,pcpu=", "-p", String(this.pid)], {
         timeout: 5e3
       });
+      const parts = stdout.trim().split(/\s+/);
+      if (parts.length < 2)
+        return void 0;
+      const rssKb = parseInt(parts[0], 10);
+      const cpuPercent = parseFloat(parts[1]);
+      if (isNaN(rssKb) || isNaN(cpuPercent))
+        return void 0;
+      return {
+        rss: rssKb * 1024,
+        // Convert KB to bytes
+        // Note: cpuPercent can exceed 100% on multi-core systems (e.g., 250% = 2.5 cores used)
+        cpuPercent
+      };
+    } catch {
+      return void 0;
+    }
+  }
+  /**
+   * Collect metrics on Linux using /proc filesystem.
+   * This works on all Linux distributions including Alpine (BusyBox).
+   */
+  async collectLinuxProcessMetrics() {
+    try {
+      const statmContent = await readFile15(`/proc/${this.pid}/statm`, "utf-8");
+      const statmParts = statmContent.trim().split(/\s+/);
+      if (statmParts.length < 2) {
+        return void 0;
+      }
+      const residentPages = parseInt(statmParts[1], 10);
+      if (isNaN(residentPages)) {
+        return void 0;
+      }
+      const pageSize = await this.getPageSize();
+      const rssBytes = residentPages * pageSize;
+      const statContent = await readFile15(`/proc/${this.pid}/stat`, "utf-8");
+      const cpuPercent = await this.calculateCpuPercent(statContent);
+      return {
+        rss: rssBytes,
+        cpuPercent
+      };
+    } catch {
+      return void 0;
+    }
+  }
+  /**
+   * Collect metrics on Windows using PowerShell.
+   * Uses Get-Process for memory and CPU time tracking for CPU%.
+   */
+  async collectWindowsProcessMetrics() {
+    try {
+      const psScript = "$p = Get-Process -Id $args[0] -ErrorAction Stop; @{WorkingSet64=$p.WorkingSet64; TotalMs=$p.TotalProcessorTime.TotalMilliseconds} | ConvertTo-Json";
+      const { stdout } = await execFileAsync2("powershell", ["-NoProfile", "-Command", psScript, String(this.pid)], { timeout: 5e3 });
       const trimmed = stdout.trim();
       if (!trimmed) {
         return void 0;
       }
-      const parts = trimmed.split(/\s+/);
-      if (parts.length < 2) {
+      const data2 = JSON.parse(trimmed);
+      const rssBytes = data2.WorkingSet64;
+      const totalCpuMs = data2.TotalMs;
+      if (typeof rssBytes !== "number" || typeof totalCpuMs !== "number") {
         return void 0;
       }
-      const rssKb = parseInt(parts[0], 10);
-      const cpuPercent = parseFloat(parts[1]);
-      if (isNaN(rssKb) || isNaN(cpuPercent)) {
-        return void 0;
+      const now = Date.now();
+      const currentState = { totalCpuTime: totalCpuMs, timestamp: now };
+      let cpuPercent = 0;
+      if (this.previousCpuState) {
+        const timeDeltaMs = now - this.previousCpuState.timestamp;
+        const cpuTimeDelta = totalCpuMs - this.previousCpuState.totalCpuTime;
+        if (timeDeltaMs > 0 && cpuTimeDelta >= 0) {
+          cpuPercent = Math.max(0, cpuTimeDelta / timeDeltaMs * 100);
+        }
       }
-      const rssBytes = rssKb * 1024;
+      this.previousCpuState = currentState;
       return {
         rss: rssBytes,
         cpuPercent
@@ -224350,6 +224617,74 @@ var TelemetryCollector2 = class {
       return void 0;
     }
   }
+  /**
+   * Calculate CPU percentage from /proc/<pid>/stat.
+   * Requires tracking state between calls to compute the delta.
+   */
+  async calculateCpuPercent(statContent) {
+    try {
+      const lastParen = statContent.lastIndexOf(")");
+      if (lastParen === -1) {
+        return 0;
+      }
+      const fieldsAfterComm = statContent.slice(lastParen + 2).split(/\s+/);
+      const utime = parseInt(fieldsAfterComm[11], 10);
+      const stime = parseInt(fieldsAfterComm[12], 10);
+      if (isNaN(utime) || isNaN(stime)) {
+        return 0;
+      }
+      const totalCpuTime = utime + stime;
+      const now = Date.now();
+      const clockTicks = await this.getClockTicksPerSecond();
+      const currentState = { totalCpuTime, timestamp: now };
+      if (!this.previousCpuState) {
+        this.previousCpuState = currentState;
+        return 0;
+      }
+      const timeDeltaMs = now - this.previousCpuState.timestamp;
+      const cpuTimeDelta = totalCpuTime - this.previousCpuState.totalCpuTime;
+      this.previousCpuState = currentState;
+      if (timeDeltaMs <= 0 || cpuTimeDelta < 0) {
+        return 0;
+      }
+      const cpuPercent = cpuTimeDelta * 1e3 * 100 / (clockTicks * timeDeltaMs);
+      return Math.max(0, cpuPercent);
+    } catch {
+      return 0;
+    }
+  }
+  /**
+   * Get the system page size in bytes (cached after first call).
+   */
+  async getPageSize() {
+    if (this.pageSize !== void 0) {
+      return this.pageSize;
+    }
+    try {
+      const { stdout } = await execFileAsync2("getconf", ["PAGE_SIZE"], { timeout: 1e3 });
+      const parsed = parseInt(stdout.trim(), 10);
+      this.pageSize = isNaN(parsed) ? 4096 : parsed;
+    } catch {
+      this.pageSize = 4096;
+    }
+    return this.pageSize;
+  }
+  /**
+   * Get the number of clock ticks per second (used for CPU time conversion).
+   */
+  async getClockTicksPerSecond() {
+    if (this.clockTicksPerSecond !== void 0) {
+      return this.clockTicksPerSecond;
+    }
+    try {
+      const { stdout } = await execFileAsync2("getconf", ["CLK_TCK"], { timeout: 1e3 });
+      const ticks = parseInt(stdout.trim(), 10);
+      this.clockTicksPerSecond = isNaN(ticks) ? 100 : ticks;
+    } catch {
+      this.clockTicksPerSecond = 100;
+    }
+    return this.clockTicksPerSecond;
+  }
 };
 
 // ../utils/dist/telemetry/analyzer-telemetry-server.js
@@ -224452,14 +224787,16 @@ function startHeartbeat2(options) {
   return () => clearInterval(timer);
 }
 var DEFAULT_TELEMETRY_INTERVAL_MS2 = 5e3;
-function startTelemetry2(pid, handler) {
-  const collector = new TelemetryCollector2();
+function startTelemetry2(subprocess, handler) {
+  const collector = TelemetryCollector2.create(subprocess.pid);
+  if (!collector)
+    return;
+  handler.onInit?.(subprocess);
   const intervalMs = handler.intervalMs ?? DEFAULT_TELEMETRY_INTERVAL_MS2;
   const collectAndReport = async () => {
-    const metrics = await collector.collectChildProcessMetrics(pid);
-    if (metrics) {
+    const metrics = await collector.collectChildProcessMetrics();
+    if (metrics)
       handler.onTelemetry(metrics);
-    }
   };
   collectAndReport().catch((err) => {
     logger.debug("Initial telemetry collection failed:", err);
@@ -224471,6 +224808,42 @@ function startTelemetry2(pid, handler) {
   timer.unref?.();
   return () => clearInterval(timer);
 }
+function wrapWithMemoryLimit2(cmd, options) {
+  const memoryLimitKiB = Math.ceil(options.memoryLimitInMB * 1024);
+  if (memoryLimitKiB <= 0)
+    throw new Error(`memoryLimitInMB * 1024 must be a positive number, got: ${memoryLimitKiB}`);
+  switch (process.platform) {
+    case "darwin":
+      {
+        const prevHandler = options.telemetryHandler;
+        let subprocess;
+        options.telemetryHandler = {
+          intervalMs: prevHandler?.intervalMs ?? 2e3,
+          onInit: (sp) => {
+            subprocess = sp;
+            prevHandler?.onInit?.(sp);
+          },
+          onTelemetry(metrics) {
+            if (subprocess?.exitCode === null && metrics.rss >= memoryLimitKiB * 1024) {
+              logger.debug(`Memory limit of ${options.memoryLimitInMB} MiB exceeded (RSS: ${(metrics.rss / 1024 / 1024).toFixed(2)} MiB). Terminating process.`);
+              subprocess.kill(options.killSignal ?? "SIGTERM");
+              subprocess = void 0;
+            }
+            prevHandler?.onTelemetry(metrics);
+          }
+        };
+      }
+      break;
+    case "linux":
+      return [
+        "sh",
+        ...typeof cmd === "string" ? ["-c", `ulimit -v ${memoryLimitKiB} && eval "$1"`, "_", cmd] : ["-c", `ulimit -v ${memoryLimitKiB} && exec "$@"`, "_", ...cmd]
+      ];
+    default:
+      logger.debug(`Memory limit enforcement is not supported on platform: ${process.platform}. Ignoring memory limit option.`);
+  }
+  return cmd;
+}
 async function execNeverFail3(cmd, dir, options) {
   const stopHeartbeat = options?.heartbeat ? startHeartbeat2(options.heartbeat) : void 0;
   let stopTelemetry;
@@ -224480,6 +224853,8 @@ async function execNeverFail3(cmd, dir, options) {
     analyzerTelemetryServer = new AnalyzerTelemetryServer2(options.analyzerTelemetryHandler);
     analyzerTelemetryFilePath = await analyzerTelemetryServer.start();
   }
+  if (options?.memoryLimitInMB !== void 0)
+    cmd = wrapWithMemoryLimit2(cmd, options);
   try {
     return await new Promise((resolve45) => {
       let args2;
@@ -224490,9 +224865,8 @@ async function execNeverFail3(cmd, dir, options) {
       const childProcess = execFile4(cmd, args2, { ...options, env, cwd: dir, maxBuffer: 1024 * 1024 * 1024, shell: args2 === void 0, timeout }, (error, stdout, stderr) => {
         resolve45({ error, stdout, stderr });
       });
-      if (options?.telemetryHandler && childProcess.pid) {
-        stopTelemetry = startTelemetry2(childProcess.pid, options.telemetryHandler);
-      }
+      if (options?.telemetryHandler && childProcess.pid)
+        stopTelemetry = startTelemetry2(childProcess, options.telemetryHandler);
       if (options?.pipe) {
         childProcess.stdout?.on("data", (data2) => {
           Spinner2.instance().suspend(() => {
@@ -224708,12 +225082,12 @@ async function getWorkspacePathsFromPnpmLockFile(lockFileDir, useDotWhenNoWorksp
 // ../fixing-management/src/fixing-management/npm/yarn-utils.ts
 var lockfile = __toESM(require_lockfile(), 1);
 var import_parsers = __toESM(require_lib26(), 1);
-import { readFile as readFile14 } from "fs/promises";
+import { readFile as readFile16 } from "fs/promises";
 import { resolve as resolve19 } from "path";
 async function getYarnType(projectDir) {
   const yarnLockLocation = resolve19(projectDir, "yarn.lock");
   try {
-    const content = await readFile14(yarnLockLocation, "utf8");
+    const content = await readFile16(yarnLockLocation, "utf8");
     if (!content || content.length === 0) {
       return void 0;
     }
@@ -224734,7 +225108,7 @@ async function getYarnType(projectDir) {
 }
 
 // ../fixing-management/src/fixing-management/npm/npm-fixing-manager.ts
-import { readFile as readFile15, writeFile as writeFile6 } from "fs/promises";
+import { readFile as readFile17, writeFile as writeFile6 } from "fs/promises";
 import { relative as relative5, resolve as resolve20 } from "path";
 
 // ../fixing-management/src/fixing-management/npm/npm-ecosystem-fixing-manager.ts
@@ -224796,7 +225170,7 @@ var NpmFixingManager = class extends NpmEcosystemFixingManager {
   }
   async applySecurityFixesSpecificPackageManager(fixes) {
     const pkgLockLocation = resolve20(this.rootDir, this.subprojectPath, "package-lock.json");
-    const packageLockContent = await readFile15(pkgLockLocation, "utf-8");
+    const packageLockContent = await readFile17(pkgLockLocation, "utf-8");
     const getPackageName = (pkgPath) => {
       const strings = pkgPath.split("node_modules/");
       return strings[strings.length - 1];
@@ -224834,7 +225208,7 @@ var NpmFixingManager = class extends NpmEcosystemFixingManager {
 };
 
 // ../fixing-management/src/fixing-management/npm/pnpm-fixing-manager.ts
-import { readFile as readFile16, writeFile as writeFile7 } from "fs/promises";
+import { readFile as readFile18, writeFile as writeFile7 } from "fs/promises";
 import { relative as relative6, resolve as resolve21 } from "path";
 var import_yaml = __toESM(require_dist10(), 1);
 var import_lockfile_file2 = __toESM(require_lib25(), 1);
@@ -224986,7 +225360,7 @@ function getVersionNumber(version4) {
   return match2 ? `${match2[1]}` : version4;
 }
 async function readYamlFile(workspaceYamlFile) {
-  const workspaceYamlString = await readFile16(workspaceYamlFile, "utf8");
+  const workspaceYamlString = await readFile18(workspaceYamlFile, "utf8");
   const parser2 = new import_yaml.Parser();
   const [ast] = parser2.parse(workspaceYamlString);
   return ast;
@@ -225023,7 +225397,7 @@ function updateCatalog(update3, map2) {
 }
 
 // ../fixing-management/src/fixing-management/npm/yarn-fixing-manager.ts
-import { readFile as readFile17, writeFile as writeFile8 } from "fs/promises";
+import { readFile as readFile19, writeFile as writeFile8 } from "fs/promises";
 import { relative as relative8, resolve as resolve23 } from "path";
 
 // ../utils/src/package-utils.ts
@@ -225131,7 +225505,7 @@ var YarnFixingManager = class extends NpmEcosystemFixingManager {
     logger.debug("Installation completed.");
   }
   async getYarnLockObj(filePath) {
-    const fileString = await readFile17(filePath, "utf8");
+    const fileString = await readFile19(filePath, "utf8");
     const yarnType = await this.getYarnType();
     return yarnType === "classic" ? (0, import_yarnlock_parse_raw.parseYarnLockRawV1)(fileString) : (0, import_yarnlock_parse_raw.parseYarnLockRawV2)(fileString);
   }
@@ -225449,7 +225823,7 @@ var NpmSocketUpgradeManager = class {
     const patches = [];
     let packageJsonContent;
     try {
-      packageJsonContent = await readFile18(resolve24(this.rootDir, mf.file), "utf-8");
+      packageJsonContent = await readFile20(resolve24(this.rootDir, mf.file), "utf-8");
     } catch (error) {
       ctxt.statusUpdater?.({
         status: "error",
@@ -225512,7 +225886,7 @@ var RushFixingManager = class {
 };
 
 // ../fixing-management/src/fixing-management/nuget/nuget-fixing-manager.ts
-import { readFile as readFile19, writeFile as writeFile9 } from "fs/promises";
+import { readFile as readFile21, writeFile as writeFile9 } from "fs/promises";
 import { join as join15 } from "path";
 
 // ../utils/src/nuget-utils.ts
@@ -225615,14 +225989,14 @@ var NugetFixingManager = class {
         if (projectFiles.length !== 1)
           throw new Error("Applying fixes to workspaces with more than 1 project file currently not supported");
         const projectFilePath = join15(this.getAbsWsPath(wsPath), projectFiles[0]);
-        const initialProjectFile = await readFile19(projectFilePath, "utf-8");
+        const initialProjectFile = await readFile21(projectFilePath, "utf-8");
         const initialLockFile = await this.restoreWorkspaceAndParseLockFile(wsPath);
         await applySeries(fixesWithId, async ({ fixId, vulnerabilityFixes }) => {
           await this.applySecurityFixesForWorkspace(wsPath, projectFilePath, vulnerabilityFixes, dependencyTree);
           signalFixApplied2?.(fixId, this.subprojectPath, wsPath, vulnerabilityFixes);
         });
-        const finalProjectFile = await readFile19(projectFilePath, "utf-8");
-        const finalLockFile = JSON.parse(await readFile19(this.getLockFilePath(wsPath), "utf-8"));
+        const finalProjectFile = await readFile21(projectFilePath, "utf-8");
+        const finalLockFile = JSON.parse(await readFile21(this.getLockFilePath(wsPath), "utf-8"));
         await writeFile9(projectFilePath, initialProjectFile);
         await writeFile9(this.getLockFilePath(wsPath), JSON.stringify(initialLockFile, null, 2));
         return { projectFile: finalProjectFile, lockFile: finalLockFile };
@@ -225654,7 +226028,7 @@ var NugetFixingManager = class {
     }
   }
   async applySecurityFixesForWorkspace(wsPath, projectFilePath, vulnFixes, dependencyTree) {
-    const initialProjectFile = await readFile19(projectFilePath, "utf-8");
+    const initialProjectFile = await readFile21(projectFilePath, "utf-8");
     const initialLockFile = await this.restoreWorkspaceAndParseLockFile(wsPath);
     const typeCache = new Cache();
     const requestedCache = new Cache();
@@ -225744,7 +226118,7 @@ var NugetFixingManager = class {
   async restoreWorkspaceAndParseLockFile(wsPath) {
     const succeeded = await execAndLogOnFailure2("dotnet restore --use-lock-file", this.getAbsWsPath(wsPath));
     if (!succeeded) throw new Error(`Error applying fix - could not restore project ${this.subprojectPath}/${wsPath}`);
-    return JSON.parse(await readFile19(this.getLockFilePath(wsPath), "utf-8"));
+    return JSON.parse(await readFile21(this.getLockFilePath(wsPath), "utf-8"));
   }
   getLockFilePath(wsPath, lockFileName = "packages.lock.json") {
     return join15(this.getAbsWsPath(wsPath), lockFileName);
@@ -225822,7 +226196,7 @@ import { dirname as dirname16, resolve as resolve26 } from "node:path";
 
 // ../utils/src/nuget-project-utils.ts
 var import_parse_xml3 = __toESM(require_dist(), 1);
-import { readFile as readFile20 } from "node:fs/promises";
+import { readFile as readFile22 } from "node:fs/promises";
 import { dirname as dirname15, join as join17, relative as relative10, resolve as resolve25, basename as basename8, extname } from "node:path";
 import { existsSync as existsSync16 } from "node:fs";
 
@@ -227380,7 +227754,7 @@ async function loadNuGetProjectOrTarget(rootDir, projectFile, mainProject, visit
   if (!validatedProjectPath || !existsSync16(validatedProjectPath)) return void 0;
   if (visited.has(validatedProjectPath)) return void 0;
   visited.set(validatedProjectPath);
-  const sourceText = await readFile20(validatedProjectPath, "utf-8");
+  const sourceText = await readFile22(validatedProjectPath, "utf-8");
   const xml2 = (0, import_parse_xml3.parseXml)(sourceText, { includeOffsets: true });
   const indentation = inferIndentationFromParsedXml2(xml2, sourceText);
   const currentProject = {
@@ -227453,7 +227827,7 @@ async function loadNuGetProjectOrTarget(rootDir, projectFile, mainProject, visit
 async function loadPackagesConfig(rootDir, file, validateFile) {
   const validatedConfigPath = validateFile(resolve25(rootDir, file));
   if (!validatedConfigPath || !existsSync16(validatedConfigPath)) return void 0;
-  const sourceText = await readFile20(validatedConfigPath, "utf-8");
+  const sourceText = await readFile22(validatedConfigPath, "utf-8");
   const configXml = (0, import_parse_xml3.parseXml)(sourceText, { includeOffsets: true });
   const packages = extractPackagesFromXml(configXml, sourceText);
   return {
@@ -228274,17 +228648,17 @@ import { dirname as dirname18, relative as relative11, resolve as resolve28 } fr
 var import_picomatch6 = __toESM(require_picomatch2(), 1);
 var import_semver4 = __toESM(require_semver2(), 1);
 import assert12 from "node:assert";
-import { readFile as readFile22, writeFile as writeFile10 } from "node:fs/promises";
+import { readFile as readFile24, writeFile as writeFile10 } from "node:fs/promises";
 
 // ../utils/src/cargo-utils.ts
-import { readFile as readFile21 } from "node:fs/promises";
+import { readFile as readFile23 } from "node:fs/promises";
 import { dirname as dirname17, resolve as resolve27 } from "node:path";
 var import_picomatch5 = __toESM(require_picomatch2(), 1);
 async function getCargoTomlFilesForCargoLockFile(rootDir, cargoLockFile, cargoTomlFiles) {
   const lockDir = dirname17(cargoLockFile);
   const rootTomlFile = cargoTomlFiles.find((file) => dirname17(file) === lockDir);
   if (!rootTomlFile) return void 0;
-  const rootTomlContent = await readFile21(resolve27(rootDir, rootTomlFile), "utf-8");
+  const rootTomlContent = await readFile23(resolve27(rootDir, rootTomlFile), "utf-8");
   const toml = parseTOML2(rootTomlContent);
   if (!toml) return void 0;
   const memberPatterns = [];
@@ -228381,7 +228755,7 @@ var CargoSocketUpgradeManager = class {
       const path9 = resolve28(this.rootDir, file);
       if (!restoreMap.has(path9)) {
         restoreMap.set(path9, {
-          content: await readFile22(path9, "utf-8"),
+          content: await readFile24(path9, "utf-8"),
           artifacts: []
         });
       }
@@ -228445,7 +228819,7 @@ var CargoSocketUpgradeManager = class {
     const fullPath = resolve28(this.rootDir, mf.file);
     let content;
     try {
-      content = await readFile22(fullPath, "utf-8");
+      content = await readFile24(fullPath, "utf-8");
     } catch (error) {
       ctxt.statusUpdater?.({
         status: "error",
@@ -228545,7 +228919,7 @@ var CargoSocketUpgradeManager = class {
     const fullPath = resolve28(this.rootDir, tomlFile);
     let content;
     try {
-      content = await readFile22(fullPath, "utf-8");
+      content = await readFile24(fullPath, "utf-8");
     } catch (error) {
       ctxt.statusUpdater?.({
         status: "error",
@@ -228631,7 +229005,7 @@ ${newDependencyLine}`
 var import_picomatch8 = __toESM(require_picomatch2(), 1);
 import { dirname as dirname20, join as join19, resolve as resolve31 } from "node:path";
 import assert13 from "node:assert";
-import { readFile as readFile25 } from "node:fs/promises";
+import { readFile as readFile27 } from "node:fs/promises";
 
 // ../fixing-management/src/fixing-management/pip/pip-requirements-parser.ts
 function parsePipRequirementsFileLoosely(src, _options) {
@@ -228984,7 +229358,7 @@ function createPep508VersionPatches(file, idx, requirement, oldVersion, upgradeV
 
 // ../utils/src/pip-utils.ts
 import { existsSync as existsSync17 } from "node:fs";
-import { readFile as readFile24 } from "node:fs/promises";
+import { readFile as readFile26 } from "node:fs/promises";
 import { dirname as dirname19, resolve as resolve30 } from "node:path";
 import util4 from "node:util";
 
@@ -228993,7 +229367,7 @@ var import_lodash6 = __toESM(require_lodash(), 1);
 var import_semver5 = __toESM(require_semver2(), 1);
 import { execFileSync } from "child_process";
 import { constants as constants3 } from "fs";
-import { access as access3, readFile as readFile23 } from "fs/promises";
+import { access as access3, readFile as readFile25 } from "fs/promises";
 import { join as join18, resolve as resolve29 } from "path";
 import util3 from "util";
 var { once: once2 } = import_lodash6.default;
@@ -229016,14 +229390,14 @@ function normalizePackageName(packageName) {
   return packageName.replace(/[-_.]+/g, "-").toLowerCase();
 }
 async function isSetupPySetuptools(file) {
-  const content = await readFile24(file, "utf-8");
+  const content = await readFile26(file, "utf-8");
   return content.includes("setup(") && (/^\s*from\s+(?:setuptools|distutils\.core)\s+import\s+.*setup/m.test(content) || /^\s*import\s+(?:setuptools|distutils\.core)/m.test(content));
 }
 async function getPyprojectTomlFilesForLockFile(rootDir, uvLockfile, pyprojectFiles) {
   const lockDir = dirname19(uvLockfile);
   const rootTomlFile = pyprojectFiles.find((file) => dirname19(file) === lockDir);
   if (!rootTomlFile) return void 0;
-  const rootTomlContent = await readFile24(resolve30(rootDir, rootTomlFile), "utf-8");
+  const rootTomlContent = await readFile26(resolve30(rootDir, rootTomlFile), "utf-8");
   const toml = parseTOML2(rootTomlContent);
   if (!toml) return void 0;
   const memberPatterns = [];
@@ -229196,7 +229570,7 @@ var PipSocketUpgradeManager = class {
     const fullPath = resolve31(this.rootDir, lockFile);
     let content;
     try {
-      content = await readFile25(fullPath, "utf-8");
+      content = await readFile27(fullPath, "utf-8");
     } catch {
       return;
     }
@@ -229254,7 +229628,7 @@ var PipSocketUpgradeManager = class {
     const fullPath = resolve31(this.rootDir, lockFile);
     let content;
     try {
-      content = await readFile25(fullPath, "utf-8");
+      content = await readFile27(fullPath, "utf-8");
     } catch {
       return;
     }
@@ -229294,7 +229668,7 @@ var PipSocketUpgradeManager = class {
     assert13(artifact.name);
     assert13(artifact.version);
     const fullPath = resolve31(this.rootDir, lockFile);
-    const content = await readFile25(fullPath, "utf-8");
+    const content = await readFile27(fullPath, "utf-8");
     const packageName = normalizePackageName(artifact.name);
     const patches = [];
     const toml = parseTOML2(content);
@@ -229423,7 +229797,7 @@ var PipSocketUpgradeManager = class {
     const refStart = ref.start;
     const refEnd = ref.end;
     try {
-      const content = await readFile25(fullPath, "utf-8");
+      const content = await readFile27(fullPath, "utf-8");
       const requirements = parsePipRequirementsFileLoosely(content, { includeLocations: true });
       const foundRequirement = requirements.filter((req) => req.data.type === "ProjectName").find((req) => refStart <= req.location.startIdx && req.location.endIdx <= refEnd);
       if (foundRequirement) {
@@ -229473,7 +229847,7 @@ var PipSocketUpgradeManager = class {
     assert13(artifact.version);
     const patches = [];
     try {
-      const content = await readFile25(fullPath, "utf-8");
+      const content = await readFile27(fullPath, "utf-8");
       const newText = `${artifact.name}==${upgradeVersion}`;
       patches.push({
         file: requirementsFile,
@@ -229501,7 +229875,7 @@ ${newText}
     const fullPath = resolve31(this.rootDir, tomlFile);
     let content;
     try {
-      content = await readFile25(fullPath, "utf-8");
+      content = await readFile27(fullPath, "utf-8");
     } catch (error) {
       ctxt.statusUpdater?.({
         status: "error",
@@ -229647,7 +230021,7 @@ ${newText}
     assert13(artifact.version);
     const patches = [];
     try {
-      const content = await readFile25(resolve31(this.rootDir, pyprojectToml), "utf-8");
+      const content = await readFile27(resolve31(this.rootDir, pyprojectToml), "utf-8");
       const toml = parseTOML2(content);
       if (!toml) {
         return patches;
@@ -229714,7 +230088,7 @@ function parseSourceString(source) {
 async function buildDependencyTreesFromUvLock(rootDir, uvLockFile) {
   let lockToml;
   try {
-    const lockContent = await readFile25(resolve31(rootDir, uvLockFile), "utf-8");
+    const lockContent = await readFile27(resolve31(rootDir, uvLockFile), "utf-8");
     lockToml = parseTOML2(lockContent);
   } catch {
     return void 0;
@@ -230185,7 +230559,7 @@ function parseGemfileLock(content) {
 }
 
 // ../fixing-management/src/fixing-management/rubygems/rubygems-socket-upgrade-manager.ts
-import { readFile as readFile26, writeFile as writeFile11 } from "node:fs/promises";
+import { readFile as readFile28, writeFile as writeFile11 } from "node:fs/promises";
 
 // ../fixing-management/src/fixing-management/rubygems/rubygems-patch-utils.ts
 function createRubygemVersionPatches(gem, idx, upgradeVersion, rangeStyle, statusUpdater) {
@@ -230398,7 +230772,7 @@ var RubygemsSocketUpgradeManager = class {
       for (const mf of artifact.manifestFiles ?? []) {
         if (this.gemfileLockMatcher(mf.file)) {
           if (ctxt.wsFilter && !ctxt.wsFilter(dirname22(mf.file) || ".")) continue;
-          const lockfileContent = await readFile26(resolve33(this.rootDir, mf.file), "utf-8");
+          const lockfileContent = await readFile28(resolve33(this.rootDir, mf.file), "utf-8");
           const gemfileLock = parseGemfileLock(lockfileContent);
           const pathGems = [];
           for (const [pathGemName, deps] of gemfileLock.pathDependencies) {
@@ -230449,7 +230823,7 @@ var RubygemsSocketUpgradeManager = class {
       const path9 = resolve33(this.rootDir, file);
       if (!restoreMap.has(path9)) {
         restoreMap.set(path9, {
-          content: await readFile26(path9, "utf-8"),
+          content: await readFile28(path9, "utf-8"),
           artifacts: []
         });
       }
@@ -230541,7 +230915,7 @@ var RubygemsSocketUpgradeManager = class {
     const gemfilePatches = [];
     const artifact = ctxt.artifacts[idx];
     try {
-      const gemfileContent = await readFile26(resolve33(this.rootDir, gemfilePath), "utf-8");
+      const gemfileContent = await readFile28(resolve33(this.rootDir, gemfilePath), "utf-8");
       const gemfile = parseGemfile(this.rootDir, gemfilePath, gemfileContent);
       const gemspecFiles = /* @__PURE__ */ new Set();
       for (const gem of gemfile.gems) {
@@ -230562,7 +230936,7 @@ var RubygemsSocketUpgradeManager = class {
       let foundInGemspec = false;
       for (const gemspecFile of gemspecFiles) {
         try {
-          const gemspecContent = await readFile26(resolve33(this.rootDir, gemspecFile), "utf-8");
+          const gemspecContent = await readFile28(resolve33(this.rootDir, gemspecFile), "utf-8");
           const { parseGemspec: parseGemspec2 } = await Promise.resolve().then(() => (init_gemspec_utils(), gemspec_utils_exports));
           const gemspec = parseGemspec2(this.rootDir, gemspecFile, gemspecContent);
           for (const gem of gemspec.dependencies) {
@@ -230627,7 +231001,7 @@ var RubygemsSocketUpgradeManager = class {
     const [version4] = artifact.version.split("-");
     const patches = [];
     try {
-      const sourceText = await readFile26(resolve33(this.rootDir, file), "utf-8");
+      const sourceText = await readFile28(resolve33(this.rootDir, file), "utf-8");
       const gemfile = parseGemfile(this.rootDir, file, sourceText);
       for (const gem of gemfile.gems) {
         if (evaluate4(gem.name) !== packageName) continue;
@@ -230673,7 +231047,7 @@ var RubygemsSocketUpgradeManager = class {
     const patches = [];
     let content;
     try {
-      content = await readFile26(resolve33(this.rootDir, file), "utf-8");
+      content = await readFile28(resolve33(this.rootDir, file), "utf-8");
     } catch (error) {
       ctxt.statusUpdater?.({
         status: "error",
@@ -230947,7 +231321,7 @@ function flattenDockerSpec({
 var import_winston2 = __toESM(require_winston(), 1);
 import { Console as Console2 } from "console";
 import { createWriteStream as createWriteStream3 } from "fs";
-import { readFile as readFile27 } from "fs/promises";
+import { readFile as readFile29 } from "fs/promises";
 
 // ../web-compat-utils/dist/util-formatter.js
 import { format as format3 } from "util";
@@ -231150,7 +231524,7 @@ var CLILogger2 = class {
     await this.finish();
     let logContent;
     try {
-      logContent = await readFile27(logFilePath, "utf-8");
+      logContent = await readFile29(logFilePath, "utf-8");
     } catch (e) {
       console.error("Error reading log file", e);
     }
@@ -231195,13 +231569,13 @@ async function detectVariantMaven(projectDir) {
 // ../docker-management/src/maven/gradle-version-detector.ts
 import { existsSync as existsSync20 } from "fs";
 import { join as join23 } from "path";
-import { readFile as readFile28 } from "fs/promises";
+import { readFile as readFile30 } from "fs/promises";
 async function detectVariantGradle(projectDir) {
   return sanitizeJvmVariant("GRADLE", projectDir, await detect(projectDir));
 }
 async function detect(projectDir) {
   const gradleWrapperPropertiesPath = join23(projectDir, "gradle", "wrapper", "gradle-wrapper.properties");
-  const gradleWrapperProperties = existsSync20(gradleWrapperPropertiesPath) ? (await readFile28(gradleWrapperPropertiesPath, "utf-8")).split("\n").map((line) => line.trim()).filter((line) => !line.startsWith("#")).filter((line) => line) : void 0;
+  const gradleWrapperProperties = existsSync20(gradleWrapperPropertiesPath) ? (await readFile30(gradleWrapperPropertiesPath, "utf-8")).split("\n").map((line) => line.trim()).filter((line) => !line.startsWith("#")).filter((line) => line) : void 0;
   if (!gradleWrapperProperties) return void 0;
   const distributionUrlRegex = /.*gradle-(\d+(\.\d+(\.\d+)?)?)/;
   for (const prop2 of gradleWrapperProperties) {
@@ -231217,13 +231591,13 @@ async function detect(projectDir) {
 // ../docker-management/src/maven/sbt-version-detector.ts
 import { existsSync as existsSync21 } from "fs";
 import { join as join24 } from "path";
-import { readFile as readFile29 } from "fs/promises";
+import { readFile as readFile31 } from "fs/promises";
 async function detectVariantSbt(projectDir) {
   return sanitizeJvmVariant("SBT", projectDir, await detect2(projectDir));
 }
 async function detect2(projectDir) {
   const sbtBuildPropertiesPath = join24(projectDir, "project", "build.properties");
-  const sbtBuildProperties = existsSync21(sbtBuildPropertiesPath) ? (await readFile29(sbtBuildPropertiesPath, "utf-8")).split("\n").map((line) => line.trim()).filter((line) => !line.startsWith("#")).filter((line) => line) : void 0;
+  const sbtBuildProperties = existsSync21(sbtBuildPropertiesPath) ? (await readFile31(sbtBuildPropertiesPath, "utf-8")).split("\n").map((line) => line.trim()).filter((line) => !line.startsWith("#")).filter((line) => line) : void 0;
   if (!sbtBuildProperties) return void 0;
   for (const prop2 of sbtBuildProperties) {
     const [key, value2] = prop2.split("=");
@@ -231337,7 +231711,7 @@ async function findReachabilityAnalyzersDockerImage(ecosystem) {
 // ../other-modules-communicator/src/other-modules-communicator.ts
 var import_lodash12 = __toESM(require_lodash(), 1);
 import { rmSync } from "fs";
-import { mkdir as mkdir5, readFile as readFile30, writeFile as writeFile12 } from "fs/promises";
+import { mkdir as mkdir5, readFile as readFile32, writeFile as writeFile12 } from "fs/promises";
 import assert15 from "node:assert";
 import { platform as platform8 } from "os";
 import { join as join27, posix as posix2, relative as relative16, sep as sep3 } from "path";
@@ -231839,7 +232213,7 @@ var OtherModulesCommunicator = class {
         COANA_API_KEY: this.apiKey.type === "present" ? this.apiKey.value : ""
       }
     );
-    return JSON.parse(await readFile30(outputFilePathThisProcess, "utf-8")).result;
+    return JSON.parse(await readFile32(outputFilePathThisProcess, "utf-8")).result;
   }
   async runReachabilityAnalyzerCommand(commandName, ecosystem, subprojectPath, workspacePath, args2, env, rootWorkingDirOverride, displaySubprojectPath) {
     const tmpDir = await this.getTmpDirForSubproject(displaySubprojectPath ?? subprojectPath);
@@ -231913,7 +232287,7 @@ var OtherModulesCommunicator = class {
       rootWorkingDirOverride,
       displaySubprojectPath
     );
-    return JSON.parse(await readFile30(outputFilePathThisProcess, "utf-8")).result;
+    return JSON.parse(await readFile32(outputFilePathThisProcess, "utf-8")).result;
   }
   async runInDocker(ecosystem, image, entryPoint, commandName, args2, subprojectPath, tmpDir, env = process.env) {
     if (!await pullDockerImage(image)) return false;
@@ -233295,7 +233669,7 @@ import { join as join29, relative as relative17, resolve as resolve38 } from "pa
 
 // ../project-management/src/project-management/ecosystem-management/ecosystem-specs.ts
 import { existsSync as existsSync23 } from "fs";
-import { readdir as readdir5, readFile as readFile31 } from "fs/promises";
+import { readdir as readdir5, readFile as readFile33 } from "fs/promises";
 import { join as join28, sep as sep4 } from "path";
 var specs = {
   NPM: [
@@ -233374,7 +233748,7 @@ function packageManagerIfPackageJSONExistsAndValid(packageManager) {
     if (!existsSync23(join28(projectDir, "package.json"))) return void 0;
     const packageJSONPath = join28(projectDir, "package.json");
     try {
-      JSON.parse(await readFile31(packageJSONPath, "utf-8"));
+      JSON.parse(await readFile33(packageJSONPath, "utf-8"));
       return packageManager;
     } catch (e) {
       throw new InvalidProjectFileError(projectDir, "package.json");
@@ -234854,7 +235228,7 @@ var DEFAULT_REPORT_FILENAME_BASE = "coana-report";
 
 // dist/internal/exclude-dirs-from-configuration-files.js
 import { existsSync as existsSync25 } from "fs";
-import { readFile as readFile32 } from "fs/promises";
+import { readFile as readFile34 } from "fs/promises";
 import { basename as basename10, resolve as resolve41 } from "path";
 var import_yaml2 = __toESM(require_dist11(), 1);
 async function inferExcludeDirsFromConfigurationFiles(rootWorkingDir) {
@@ -234868,7 +235242,7 @@ async function inferExcludeDirsFromConfigurationFiles(rootWorkingDir) {
 }
 async function inferExcludeDirsFromSocketConfig(socketConfigFile) {
   try {
-    const config3 = (0, import_yaml2.parse)(await readFile32(socketConfigFile, "utf8"));
+    const config3 = (0, import_yaml2.parse)(await readFile34(socketConfigFile, "utf8"));
     const version4 = config3.version;
     const ignorePaths = config3[version4 === 1 ? "ignore" : "projectIgnorePaths"];
     if (!ignorePaths)
@@ -234885,7 +235259,7 @@ async function inferExcludeDirsFromSocketConfig(socketConfigFile) {
 // dist/internal/manifest-upload.js
 var import_fast_glob = __toESM(require_out4(), 1);
 var import_ignore3 = __toESM(require_ignore(), 1);
-import { readFile as readFile33 } from "fs/promises";
+import { readFile as readFile35 } from "fs/promises";
 import { join as join31 } from "path";
 var DEFAULT_IGNORE_PATTERNS = [
   "**/node_modules/**",
@@ -234901,7 +235275,7 @@ var DEFAULT_IGNORE_PATTERNS = [
 async function loadGitignore(rootDir) {
   try {
     const gitignorePath = join31(rootDir, ".gitignore");
-    const content = await readFile33(gitignorePath, "utf-8");
+    const content = await readFile35(gitignorePath, "utf-8");
     return (0, import_ignore3.default)().add(content);
   } catch {
     return void 0;
@@ -236016,7 +236390,7 @@ function toSocketFactsSocketDependencyTree(artifacts, vulnerabilities, tier1Reac
 }
 
 // dist/internal/vulnerability-scanning.js
-import { readFile as readFile34 } from "fs/promises";
+import { readFile as readFile36 } from "fs/promises";
 
 // ../security-auditor/security-auditor-builder/src/mongo-connection.ts
 var import_mongodb = __toESM(require_lib31(), 1);
@@ -250885,7 +251259,7 @@ async function scanForVulnerabilities(dependencyTree, offlineVulnerabilityScanne
 }
 async function offlineScan(dependencyTree, offlineVulnerabilityScannerDBPath) {
   logger.info("using offline vulnerability scanner db");
-  const offlineVulnerabilityScannerDB = JSON.parse(await readFile34(offlineVulnerabilityScannerDBPath, "utf-8"));
+  const offlineVulnerabilityScannerDB = JSON.parse(await readFile36(offlineVulnerabilityScannerDBPath, "utf-8"));
   const { ecosystemToUrlToVulnerabilityDetails, vulnerabilityDatabase } = offlineVulnerabilityScannerDB;
   const coanaSupportedVulnerabilitiesLoader = CoanaSupportedVulnerabilitiesLoader.create(ecosystemToUrlToVulnerabilityDetails);
   const vulnerabilityAccessPathLoader = CoanaSupportedVulnerabilitiesLoader.create(ecosystemToUrlToVulnerabilityDetails);
@@ -250903,7 +251277,7 @@ async function onlineScan(dependencyTree, apiKey, timeout) {
 }
 
 // dist/version.js
-var version3 = "14.12.159";
+var version3 = "14.12.161";
 
 // dist/cli-core.js
 var { mapValues, omit, partition, pickBy: pickBy2 } = import_lodash15.default;
@@ -251979,7 +252353,7 @@ async function initializeComputeFixesAndUpgradePurls(path9, options) {
 var compareReportsCommand = new Command();
 compareReportsCommand.name("compare-reports").argument("<baselineReportPath>", "Path to the baseline report").argument("<newReportPath>", "Path to the new report").option("--api-key <key>", "Set the Coana dashboard API key.").option("-d, --debug", "Enable debug logging", false).option("--no-pr-comment", "Disable pull request comments (only relevant when run from a PR)", true).option("--no-block", "Do not fail with a non-zero exit code when new reachable vulnerabilities are detected", true).option("--ignore-undeterminable-reachability", "Ignore vulnerabilities with undeterminable reachability", false).action(async (baselineReportPath, newReportPath, options) => {
   async function readReport(reportPath) {
-    return JSON.parse(await readFile35(reportPath, "utf-8"));
+    return JSON.parse(await readFile37(reportPath, "utf-8"));
   }
   const baselineReport = await readReport(baselineReportPath);
   const newReport = await readReport(newReportPath);