@coana-tech/cli 14.12.188 → 14.12.190

package/cli.mjs

@@ -235872,7 +235872,8 @@ async function fetchArtifactsFromSocket(rootWorkingDirectory, manifestsTarHash,
               vulnerabilityAccessPaths: vuln.reachabilityData?.undeterminableReachability ? vuln.reachabilityData.publicComment ?? "" : vuln.reachabilityData?.pattern ?? null,
               ecosystem,
               artifactId: artifact.id,
-              precomputedReachabilityResult: vuln.reachabilityData?.precomputedReachabilityResult ?? null
+              precomputedReachabilityResult: vuln.reachabilityData?.precomputedReachabilityResult ?? null,
+              activationStatus: vuln.reachabilityData?.activationStatus ?? null
             };
             const vulnId = `${ecosystem}-${workspace}-${artifact.namespace}-${artifact.name}-${artifact.version}-${vulnerability.url}`;
             if (!ecosystemWorkspaceVulnIds.has(vulnId)) {
@@ -236550,9 +236551,45 @@ function displayWorkspaceDiagnosticsSummaryInternal(diagnosticsEntries, vulns) {
 }
 
 // dist/internal/socket-report-socket-dependency-tree.js
+function filterOrphanedArtifacts(artifacts) {
+  const reachable = /* @__PURE__ */ new Set();
+  const queue = [];
+  for (const artifact of artifacts) {
+    if (artifact.direct) {
+      reachable.add(artifact.id);
+      queue.push(artifact.id);
+    }
+  }
+  const depsById = new Map(artifacts.map((a4) => [a4.id, a4.dependencies ?? []]));
+  while (queue.length > 0) {
+    const id = queue.pop();
+    for (const dep of depsById.get(id) ?? []) {
+      if (!reachable.has(dep)) {
+        reachable.add(dep);
+        queue.push(dep);
+      }
+    }
+  }
+  const removedIds = /* @__PURE__ */ new Set();
+  const filtered = artifacts.filter((a4) => {
+    if (a4.direct || reachable.has(a4.id))
+      return true;
+    removedIds.add(a4.id);
+    return false;
+  });
+  if (removedIds.size > 0) {
+    logger.debug(`Filtered out ${removedIds.size} orphaned component(s) not reachable from any direct dependency`);
+  }
+  return { filtered, removedIds };
+}
 function toSocketFactsSocketDependencyTree(artifacts, vulnerabilities, tier1ReachabilityScanId, workspaceDiagnostics) {
+  const { filtered: filteredArtifacts, removedIds: orphanedArtifactIds } = filterOrphanedArtifacts(artifacts);
+  artifacts = filteredArtifacts;
   const artifactIdToArtifact = Object.fromEntries(artifacts.map((artifact) => [artifact.id, artifact]));
   for (const vulnerability of vulnerabilities) {
+    if (vulnerability.artifactId && orphanedArtifactIds.has(vulnerability.artifactId)) {
+      continue;
+    }
     const component = artifactIdToArtifact[vulnerability.artifactId];
     if (!component) {
       throw new Error(`Component not found for vulnerability ${vulnerability.purl}`);
@@ -236562,9 +236599,12 @@ function toSocketFactsSocketDependencyTree(artifacts, vulnerabilities, tier1Reac
     if (!reachabilityForGHSA) {
       reachabilityForGHSA = {
         ghsa_id: vulnerability.vulnerabilityUrl.replace("https://github.com/advisories/", ""),
-        reachability: []
+        reachability: [],
+        ...vulnerability.activationStatus ? { activation_status: vulnerability.activationStatus } : {}
       };
       component.reachability.push(reachabilityForGHSA);
+    } else if (vulnerability.activationStatus && !reachabilityForGHSA.activation_status) {
+      reachabilityForGHSA.activation_status = vulnerability.activationStatus;
     }
     if (vulnerability.codeAwareScanResult.type === "precomputed") {
       reachabilityForGHSA.reachability.push(vulnerability.codeAwareScanResult);
@@ -251483,7 +251523,7 @@ async function onlineScan(dependencyTree, apiKey, timeout) {
 }
 
 // dist/version.js
-var version3 = "14.12.188";
+var version3 = "14.12.190";
 
 // dist/cli-core.js
 var { mapValues, omit, partition, pickBy: pickBy2 } = import_lodash15.default;
@@ -252275,7 +252315,8 @@ Subproject: ${subproject}`);
         reachability,
         purl: v.purl,
         purlType: v.purlType,
-        artifactId: v.artifactId
+        artifactId: v.artifactId,
+        activationStatus: v.activationStatus
       };
     });
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coana-tech/cli",
-  "version": "14.12.188",
+  "version": "14.12.190",
   "description": "Coana CLI",
   "type": "module",
   "bin": {