@coana-tech/cli 14.12.193 → 14.12.195

package/cli.mjs

@@ -234276,6 +234276,118 @@ function assertDefined(value2) {
   return value2;
 }
 
+// dist/internal/validate-external-dependencies.js
+async function validateExternalDependencies(ecosystems, command, manifestFileNames) {
+  const checks = [];
+  const ecosystemSet = new Set(ecosystems);
+  if (ecosystemSet.has("NPM")) {
+    checks.push(...getNpmChecks(command, manifestFileNames));
+  }
+  if (ecosystemSet.has("PIP")) {
+    checks.push(...getPipChecks(command, manifestFileNames));
+  }
+  if (ecosystemSet.has("MAVEN") && command === "run") {
+    checks.push(checkJavaAvailable());
+  }
+  if (ecosystemSet.has("GO")) {
+    checks.push(checkTool("go", "Go (GO)", "Required for Go module management. Install from https://go.dev/dl/"));
+  }
+  if (ecosystemSet.has("NUGET") && command === "run") {
+    checks.push(checkTool("dotnet", ".NET (NUGET)", "Required for .NET analysis. Install from https://dotnet.microsoft.com/download"));
+  }
+  if (ecosystemSet.has("RUST") && command === "compute-fixes-and-upgrade-purls") {
+    checks.push(checkTool("cargo", "Rust (RUST)", "Required for Rust dependency management. Install from https://rustup.rs"));
+  }
+  if (ecosystemSet.has("RUBYGEMS") && command === "compute-fixes-and-upgrade-purls") {
+    checks.push(checkEitherTool("bundle", "bundler", "Ruby (RUBYGEMS)", "bundle (or bundler)", "Required for Ruby dependency management. Install from https://bundler.io"));
+  }
+  const results = await Promise.all(checks);
+  const missing = results.filter((r3) => r3 !== null);
+  if (missing.length > 0) {
+    const grouped = /* @__PURE__ */ new Map();
+    for (const m4 of missing) {
+      if (!grouped.has(m4.ecosystem))
+        grouped.set(m4.ecosystem, []);
+      grouped.get(m4.ecosystem).push(m4);
+    }
+    let message2 = "Missing required external tools for the detected project ecosystems:\n";
+    for (const [ecosystem, tools] of grouped) {
+      message2 += `
+  ${ecosystem}:
+`;
+      for (const tool of tools) {
+        message2 += `    - ${tool.tool}: ${tool.message}
+`;
+      }
+    }
+    message2 += "\nInstall the missing tools and try again.";
+    throw new Error(message2);
+  }
+}
+function getNpmChecks(command, manifestFileNames) {
+  const checks = [];
+  const nexe = isNexeMode();
+  if (command === "run") {
+    if (!nexe) {
+      checks.push(checkTool("npm", "NPM", "Required for NPM dependency management. Install from https://nodejs.org"));
+    }
+  } else {
+    const files = manifestFileNames ?? [];
+    if (files.some((f6) => f6.endsWith("package-lock.json")) && !nexe) {
+      checks.push(checkTool("npm", "NPM", "Required for NPM dependency management. Install from https://nodejs.org"));
+    }
+    if (files.some((f6) => f6.endsWith("pnpm-lock.yaml"))) {
+      checks.push(checkTool("pnpm", "NPM", "Required for pnpm dependency management. Install from https://pnpm.io"));
+    }
+    if (files.some((f6) => f6.endsWith("yarn.lock"))) {
+      checks.push(checkTool("yarn", "NPM", "Required for Yarn dependency management. Install from https://yarnpkg.com"));
+    }
+  }
+  return checks;
+}
+function getPipChecks(command, manifestFileNames) {
+  const checks = [];
+  const nexe = isNexeMode();
+  if (command === "run") {
+    checks.push(checkEitherTool("python3", "python", "Python (PIP)", "python3 (or python)", "Required for Python dependency management. Install from https://python.org"));
+    if (!nexe) {
+      checks.push(checkTool("uv", "Python (PIP)", "Required for Python dependency management. Install from https://docs.astral.sh/uv/"));
+    }
+  } else {
+    const files = manifestFileNames ?? [];
+    if (files.some((f6) => f6.endsWith("uv.lock")) && !nexe) {
+      checks.push(checkTool("uv", "Python (PIP)", "Required for Python dependency management. Install from https://docs.astral.sh/uv/"));
+    }
+  }
+  return checks;
+}
+async function checkTool(command, ecosystem, message2) {
+  const available = await isCommandAvailable(command);
+  if (!available) {
+    return { ecosystem, tool: command, message: message2 };
+  }
+  return null;
+}
+async function checkEitherTool(command1, command2, ecosystem, toolLabel, message2) {
+  const [avail1, avail2] = await Promise.all([isCommandAvailable(command1), isCommandAvailable(command2)]);
+  if (!avail1 && !avail2) {
+    return { ecosystem, tool: toolLabel, message: message2 };
+  }
+  return null;
+}
+var JAVA_HOME_ENV_VARS = ["JAVA_HOME", "JAVA8_HOME", "JAVA11_HOME", "JAVA17_HOME", "JAVA21_HOME"];
+async function checkJavaAvailable() {
+  if (await isCommandAvailable("java"))
+    return null;
+  if (JAVA_HOME_ENV_VARS.some((v) => process.env[v]))
+    return null;
+  return {
+    ecosystem: "Maven (MAVEN)",
+    tool: "java",
+    message: "Required for Java/Maven analysis. Install a JDK from https://adoptium.net"
+  };
+}
+
 // dist/cli-upgrade-purl.js
 var UpgradePurlPartialError = class extends Error {
   subprojectResults;
@@ -234332,6 +234444,10 @@ ${Array.from(upgrades).map(([idx, upgradeVersion]) => `	${prettyPrintPurlUpgrade
         }
         ecosystemToSocketArtifactUpgrades.get(ecosystem).set(idx, upgradeVersion);
       }
+      const detectedEcosystems = Array.from(ecosystemToSocketArtifactUpgrades.keys());
+      if (!options.disableExternalToolChecks) {
+        await validateExternalDependencies(detectedEcosystems, "compute-fixes-and-upgrade-purls", manifestFiles);
+      }
       let anyErrors = false;
       let anySkipped = false;
       const subprojectResults = /* @__PURE__ */ new Map();
@@ -234593,7 +234709,8 @@ async function computeFixesAndUpgradePurls(path9, options, logFile) {
       concurrency: "1",
       include: options.include,
       exclude: options.exclude,
-      rangeStyle: options.rangeStyle
+      rangeStyle: options.rangeStyle,
+      disableExternalToolChecks: options.disableExternalToolChecks
     }, autofixRunId) ?? "fixed-all";
     if (autofixRunId) {
       const allGhsasFailed = fixesFound.length === 0;
@@ -251523,7 +251640,7 @@ async function onlineScan(dependencyTree, apiKey, timeout) {
 }
 
 // dist/version.js
-var version3 = "14.12.193";
+var version3 = "14.12.195";
 
 // dist/cli-core.js
 var { mapValues, omit, partition, pickBy: pickBy2 } = import_lodash15.default;
@@ -251732,6 +251849,10 @@ var CliCore = class {
     this.sendProgress("SCAN_FOR_VULNERABILITIES", true, ".", ".");
     const { artifacts, ecosystemToWorkspaceToAnalysisData, ecosystemToWorkspaceToVulnerabilities } = await fetchArtifactsFromSocket(this.rootWorkingDirectory, this.options.manifestsTarHash, "reachability", this.options.useUnreachableFromPrecomputation, this.options.useOnlyPregeneratedSboms);
     this.sendProgress("SCAN_FOR_VULNERABILITIES", false, ".", ".");
+    const detectedEcosystemsSocket = Object.keys(ecosystemToWorkspaceToAnalysisData);
+    if (!this.options.disableExternalToolChecks) {
+      await validateExternalDependencies(detectedEcosystemsSocket, "run");
+    }
     const subProjects = Object.entries(ecosystemToWorkspaceToAnalysisData).flatMap(([ecosystem, workspaceToAnalysisData]) => {
       return Object.entries(workspaceToAnalysisData).map(([workspace, analysisData]) => {
         return {
@@ -251873,6 +251994,10 @@ var CliCore = class {
     const manager = await ProjectManager.create(this.rootWorkingDirectory, otherModulesCommunicator, this.options.ecosystems, this.options.includeDirs, this.options.excludeDirs, this.options.changedFiles);
     this.sendProgress("CREATE_PROJECT_MANAGER", false);
     const { reachabilitySupport, traditionalScaSupport, noSupport } = manager.getSubprojectsWithWorkspacePaths();
+    const detectedEcosystemsSbom = [...new Set([...reachabilitySupport, ...traditionalScaSupport].map((s6) => s6.ecosystem))];
+    if (!this.options.disableExternalToolChecks) {
+      await validateExternalDependencies(detectedEcosystemsSbom, "run");
+    }
     await this.dashboardAPI.registerSubprojects([...reachabilitySupport, ...traditionalScaSupport, ...noSupport].map((sp) => ({
       ...sp,
       subprojectPath: relative21(this.rootWorkingDirectory, sp.subprojectPath) || "."
@@ -252532,7 +252657,7 @@ async function writeAnalysisDebugInfo(outputFilePath, ecosystemToWorkspaceToVuln
 handleNexeBinaryMode();
 var program2 = new Command();
 var run2 = new Command();
-run2.name("run").argument("<path>", "File system path to folder containing the project").option("-o, --output-dir <path>", "Write json report to <path>/coana-report.json").option("-d, --debug", "Enable debug logging", false).option("-s, --silent", "Silence all debug/warning output", false).option("--silent-spinner", "Silence spinner", "CI" in process.env || !process.stdin.isTTY).option("-p, --print-report", "Print the report to the console", false).option("--offline-database <path>", "Path to a coana-offline-db.json file for running the CLI without internet connectivity", void 0).option("-t, --timeout <timeout>", "Set API <timeout> in milliseconds to Coana backend.", "300000").option("-a, --analysis-timeout <timeout>", "Set <timeout> in seconds for each reachability analysis run").option("--memory-limit <memoryInMB>", "Set memory limit for analysis to <memoryInMB> megabytes of memory.", "8192").option("-c, --concurrency <concurrency>", "Set the maximum number of concurrent reachability analysis runs. It's recommended to choose a concurrency level that ensures that each analysis run has at least the --memory-limit amount of memory available. NPM reachability analysis does not support concurrent execution, so the concurrency level is ignored for NPM.", "1").option("--api-key <key>", "Set the Coana dashboard API key. By setting you also enable the dashboard integration.").addOption(new Option("--write-report-to-file", "Write the report dashboard-compatible report to dashboard-report.json. This report may help the Coana team debug issues with the report insertion mechanism.").default(false).hideHelp()).option("--project-name <repoName>", "Set the name of the repository. Used for dashboard integration.").option("--repo-url <repoUrl>", "Set the URL of the repository. Used for dashboard integration.").option("--include-dirs <relativeDirs...>", "globs for directories to include from the detection of subprojects (space-separated)(use relative paths from the project root). Notice, projects that are not included may still be scanned if they are referenced from included projects.").option("--exclude-dirs <relativeDirs...>", "globs for directories to exclude from the detection of subprojects (space-separated)(use relative paths from the project root). Notice, excluded projects may still be scanned if they are referenced from non-excluded projects.").option("--disable-analysis-splitting", "Limits Coana to at most 1 reachability analysis run per workspace").option("--print-analysis-log-file", "Store log output from the JavaScript/TypeScript reachability analysis in the file js-analysis.log file in the root of each workspace", false).option("--entry-points <entryPoints...>", "List of files to analyze for root workspace. The reachability analysis automatically analyzes all files used by the entry points. If not provided, all JavaScript and TypeScript files are considered entry points. For non-root workspaces, all JavaScript and TypeScript files are analyzed as well.").option("--include-projects-with-no-reachability-support", "Also runs Coana on projects where we support traditional SCA, but does not yet support reachability analysis.", false).option("--ecosystems <ecosystems...>", "List of ecosystems to analyze (space-separated). Currently NPM, PIP, MAVEN, NUGET and GO are supported. Default is all supported ecosystems.").addOption(new Option("--purl-types <purlTypes...>", "List of PURL types to analyze (space-separated). Currently npm, pypi, maven, nuget, golang and cargo are supported. Default is all supported purl types.").hideHelp()).option("--changed-files <files...>", "List of files that have changed. If provided, Coana only analyzes workspaces and modules that contain changed files.").option("--disable-report-submission", "Disable the submission of the report to the Coana dashboard. Used by the pipeline blocking feature.", false).option("--disable-analytics-sharing", "Disable analytics sharing.", false).option("--provider-project <path>", "File system path to folder containing the provider project (Only supported for Maven, Gradle, and SBT)").option("--provider-workspaces <dirs...>", "List of workspaces that build the provided runtime environment (Only supported for Maven, Gradle, and SBT)", (paths) => paths.split(" ")).option("--lightweight-reachability", "Runs Coana in lightweight mode. This increases analysis speed but also raises the risk of Coana misclassifying the reachability of certain complex vulnerabilities. Recommended only for use with Coana Guardrail mode.", false).addOption(new Option("--run-without-docker", "Run package managers and reachability analyzers without using docker").default(process.env.RUN_WITHOUT_DOCKER === "true").hideHelp()).addOption(new Option("--run-env <env>", "Specifies the environment in which the CLI is run. So far only MANAGED_SCAN and UNKNOWN are supported.").default("UNKNOWN").choices(["UNKNOWN", "MANAGED_SCAN"]).hideHelp()).addOption(new Option("--guardrail-mode", "Run Coana in guardrail mode. This mode is used to prevent new reachable vulnerabilities from being introduced into the codebase. Usually run as a CI check when pushing new commits to a pull request.")).option("--ignore-failing-workspaces", "Continue processing when a workspace fails instead of exiting. Failed workspaces will be logged at termination.", false).addOption(new Option("--socket-mode <output-file>", "Run Coana in socket mode and write report to <output-file>").hideHelp()).addOption(new Option("--manifests-tar-hash <hash>", "Hash of the tarball containing all manifest files already uploaded to Socket. If provided, Socket will be used for computing dependency trees.").hideHelp()).option("--skip-cache-usage", "Do not attempt to use cached analysis configuration from previous runs", false).addOption(new Option("--lazy-mode", "Enable lazy analysis mode for JavaScript/TypeScript. This can significantly speed up analysis by only analyzing code that is actually relevant for the vulnerabilities being analyzed.").default(false).hideHelp()).addOption(new Option("--min-severity <severity>", "Set the minimum severity of vulnerabilities to analyze. Supported severities are info, low, moderate, high and critical.").choices(["info", "INFO", "low", "LOW", "moderate", "MODERATE", "high", "HIGH", "critical", "CRITICAL"])).option("--use-unreachable-from-precomputation", "Skip the reachability analysis for vulnerabilities that are already known to be unreachable from the precomputed reachability analysis (Tier 2).", false).addOption(new Option("--use-only-pregenerated-sboms", "Only include artifacts that have CDX or SPDX files in their manifest files.").default(false).hideHelp()).version(version3).configureHelp({ sortOptions: true }).action(async (path9, options) => {
+run2.name("run").argument("<path>", "File system path to folder containing the project").option("-o, --output-dir <path>", "Write json report to <path>/coana-report.json").option("-d, --debug", "Enable debug logging", false).option("-s, --silent", "Silence all debug/warning output", false).option("--silent-spinner", "Silence spinner", "CI" in process.env || !process.stdin.isTTY).option("-p, --print-report", "Print the report to the console", false).option("--offline-database <path>", "Path to a coana-offline-db.json file for running the CLI without internet connectivity", void 0).option("-t, --timeout <timeout>", "Set API <timeout> in milliseconds to Coana backend.", "300000").option("-a, --analysis-timeout <timeout>", "Set <timeout> in seconds for each reachability analysis run").option("--memory-limit <memoryInMB>", "Set memory limit for analysis to <memoryInMB> megabytes of memory.", "8192").option("-c, --concurrency <concurrency>", "Set the maximum number of concurrent reachability analysis runs. It's recommended to choose a concurrency level that ensures that each analysis run has at least the --memory-limit amount of memory available. NPM reachability analysis does not support concurrent execution, so the concurrency level is ignored for NPM.", "1").option("--api-key <key>", "Set the Coana dashboard API key. By setting you also enable the dashboard integration.").addOption(new Option("--write-report-to-file", "Write the report dashboard-compatible report to dashboard-report.json. This report may help the Coana team debug issues with the report insertion mechanism.").default(false).hideHelp()).option("--project-name <repoName>", "Set the name of the repository. Used for dashboard integration.").option("--repo-url <repoUrl>", "Set the URL of the repository. Used for dashboard integration.").option("--include-dirs <relativeDirs...>", "globs for directories to include from the detection of subprojects (space-separated)(use relative paths from the project root). Notice, projects that are not included may still be scanned if they are referenced from included projects.").option("--exclude-dirs <relativeDirs...>", "globs for directories to exclude from the detection of subprojects (space-separated)(use relative paths from the project root). Notice, excluded projects may still be scanned if they are referenced from non-excluded projects.").option("--disable-analysis-splitting", "Limits Coana to at most 1 reachability analysis run per workspace").option("--print-analysis-log-file", "Store log output from the JavaScript/TypeScript reachability analysis in the file js-analysis.log file in the root of each workspace", false).option("--entry-points <entryPoints...>", "List of files to analyze for root workspace. The reachability analysis automatically analyzes all files used by the entry points. If not provided, all JavaScript and TypeScript files are considered entry points. For non-root workspaces, all JavaScript and TypeScript files are analyzed as well.").option("--include-projects-with-no-reachability-support", "Also runs Coana on projects where we support traditional SCA, but does not yet support reachability analysis.", false).option("--ecosystems <ecosystems...>", "List of ecosystems to analyze (space-separated). Currently NPM, PIP, MAVEN, NUGET and GO are supported. Default is all supported ecosystems.").addOption(new Option("--purl-types <purlTypes...>", "List of PURL types to analyze (space-separated). Currently npm, pypi, maven, nuget, golang and cargo are supported. Default is all supported purl types.").hideHelp()).option("--changed-files <files...>", "List of files that have changed. If provided, Coana only analyzes workspaces and modules that contain changed files.").option("--disable-report-submission", "Disable the submission of the report to the Coana dashboard. Used by the pipeline blocking feature.", false).option("--disable-analytics-sharing", "Disable analytics sharing.", false).option("--provider-project <path>", "File system path to folder containing the provider project (Only supported for Maven, Gradle, and SBT)").option("--provider-workspaces <dirs...>", "List of workspaces that build the provided runtime environment (Only supported for Maven, Gradle, and SBT)", (paths) => paths.split(" ")).option("--lightweight-reachability", "Runs Coana in lightweight mode. This increases analysis speed but also raises the risk of Coana misclassifying the reachability of certain complex vulnerabilities. Recommended only for use with Coana Guardrail mode.", false).addOption(new Option("--run-without-docker", "Run package managers and reachability analyzers without using docker").default(process.env.RUN_WITHOUT_DOCKER === "true").hideHelp()).addOption(new Option("--run-env <env>", "Specifies the environment in which the CLI is run. So far only MANAGED_SCAN and UNKNOWN are supported.").default("UNKNOWN").choices(["UNKNOWN", "MANAGED_SCAN"]).hideHelp()).addOption(new Option("--guardrail-mode", "Run Coana in guardrail mode. This mode is used to prevent new reachable vulnerabilities from being introduced into the codebase. Usually run as a CI check when pushing new commits to a pull request.")).option("--ignore-failing-workspaces", "Continue processing when a workspace fails instead of exiting. Failed workspaces will be logged at termination.", false).addOption(new Option("--socket-mode <output-file>", "Run Coana in socket mode and write report to <output-file>").hideHelp()).addOption(new Option("--manifests-tar-hash <hash>", "Hash of the tarball containing all manifest files already uploaded to Socket. If provided, Socket will be used for computing dependency trees.").hideHelp()).option("--skip-cache-usage", "Do not attempt to use cached analysis configuration from previous runs", false).addOption(new Option("--lazy-mode", "Enable lazy analysis mode for JavaScript/TypeScript. This can significantly speed up analysis by only analyzing code that is actually relevant for the vulnerabilities being analyzed.").default(false).hideHelp()).addOption(new Option("--min-severity <severity>", "Set the minimum severity of vulnerabilities to analyze. Supported severities are info, low, moderate, high and critical.").choices(["info", "INFO", "low", "LOW", "moderate", "MODERATE", "high", "HIGH", "critical", "CRITICAL"])).option("--use-unreachable-from-precomputation", "Skip the reachability analysis for vulnerabilities that are already known to be unreachable from the precomputed reachability analysis (Tier 2).", false).addOption(new Option("--use-only-pregenerated-sboms", "Only include artifacts that have CDX or SPDX files in their manifest files.").default(false).hideHelp()).option("--disable-external-tool-checks", "Disable validation of external tools (npm, python, go, etc.) before running analysis.", false).version(version3).configureHelp({ sortOptions: true }).action(async (path9, options) => {
   process.env.DOCKER_IMAGE_TAG ??= version3;
   options.ecosystems = options.ecosystems?.map((e) => e.toUpperCase());
   options.minSeverity = options.minSeverity?.toUpperCase();
@@ -252546,7 +252671,7 @@ applyFixes.name("apply-fixes").argument("<path>", "File system path to the folde
   await applyFix(path9, fixIds, options);
 }).configureHelp({ sortOptions: true });
 var computeFixesAndUpgradePurlsCmd = new Command();
-computeFixesAndUpgradePurlsCmd.name("compute-fixes-and-upgrade-purls").argument("<path>", "File system path to the folder containing the project").option("-a, --apply-fixes-to <ghsas...>", 'GHSA IDs to compute fixes for. Use "all" to compute fixes for all vulnerabilities.', []).option("--dry-run", "Show what changes would be made without actually making them", false).option("-i, --include <patterns...>", "Glob patterns to include workspaces").option("-e, --exclude <patterns...>", "Glob patterns to exclude workspaces").option("-d, --debug", "Enable debug logging", false).option("-s, --silent", "Silence all debug/warning output", false).option("--silent-spinner", "Silence spinner", "CI" in process.env || !process.stdin.isTTY).option("--range-style <style>", 'Range style to use for the output. Currently only "pin" is supported and it only works for npm.').option("--disable-major-updates", "Do not suggest major updates. If only major update are available, the fix will not be applied.", false).option("-o, --output-file <file>", "Writes output to a JSON file").option("--minimum-release-age <minimumReleaseAge>", "Do not allow upgrades to package versions that are newer than minimumReleaseAge. Format is 2m, 5h, 3d or 1w").option("--show-affected-direct-dependencies", "Show the affected direct dependencies for each vulnerability and what upgrades could fix them - does not apply the upgrades.", false).option("--purl-types <purlTypes...>", "List of PURL types to filter artifacts by (space-separated). Only vulnerabilities from artifacts matching these types will be included.").addOption(new Option("--run-without-docker", "Run package managers without using docker").default(process.env.RUN_WITHOUT_DOCKER === "true").hideHelp()).addOption(new Option("--manifests-tar-hash <hash>", "Hash of the tarball containing all manifest files already uploaded to Socket. If provided, Socket will be used for computing dependency trees.").hideHelp()).version(version3).action(async (path9, options) => {
+computeFixesAndUpgradePurlsCmd.name("compute-fixes-and-upgrade-purls").argument("<path>", "File system path to the folder containing the project").option("-a, --apply-fixes-to <ghsas...>", 'GHSA IDs to compute fixes for. Use "all" to compute fixes for all vulnerabilities.', []).option("--dry-run", "Show what changes would be made without actually making them", false).option("-i, --include <patterns...>", "Glob patterns to include workspaces").option("-e, --exclude <patterns...>", "Glob patterns to exclude workspaces").option("-d, --debug", "Enable debug logging", false).option("-s, --silent", "Silence all debug/warning output", false).option("--silent-spinner", "Silence spinner", "CI" in process.env || !process.stdin.isTTY).option("--range-style <style>", 'Range style to use for the output. Currently only "pin" is supported and it only works for npm.').option("--disable-major-updates", "Do not suggest major updates. If only major update are available, the fix will not be applied.", false).option("-o, --output-file <file>", "Writes output to a JSON file").option("--minimum-release-age <minimumReleaseAge>", "Do not allow upgrades to package versions that are newer than minimumReleaseAge. Format is 2m, 5h, 3d or 1w").option("--show-affected-direct-dependencies", "Show the affected direct dependencies for each vulnerability and what upgrades could fix them - does not apply the upgrades.", false).option("--purl-types <purlTypes...>", "List of PURL types to filter artifacts by (space-separated). Only vulnerabilities from artifacts matching these types will be included.").addOption(new Option("--run-without-docker", "Run package managers without using docker").default(process.env.RUN_WITHOUT_DOCKER === "true").hideHelp()).addOption(new Option("--manifests-tar-hash <hash>", "Hash of the tarball containing all manifest files already uploaded to Socket. If provided, Socket will be used for computing dependency trees.").hideHelp()).option("--disable-external-tool-checks", "Disable validation of external tools (npm, python, go, etc.) before running analysis.", false).version(version3).action(async (path9, options) => {
   checkNotWindows();
   process.env.DOCKER_IMAGE_TAG ??= version3;
   if (options.outputFile && !options.outputFile.endsWith(".json")) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coana-tech/cli",
-  "version": "14.12.193",
+  "version": "14.12.195",
   "description": "Coana CLI",
   "type": "module",
   "bin": {

package/reachability-analyzers-cli.mjs

@@ -111073,6 +111073,7 @@ async function runJellyAnalysis(mainProjectRoot, projectRoot, jellyOptions, reac
         ${!!includePackages && (includePackages.length ? ["--include-packages", ...includePackages] : ["--ignore-dependencies"])}
         ${jellyOptions.approx && "--approx"}
         --callstacks-json ${callStackFile}
+        --no-unresolved-vulnerable
         ${parseShellArgs(process.env.JELLY_ADDITIONAL_FLAGS ?? "")}
         ${filesToAnalyze}
       `;
@@ -111155,7 +111156,7 @@ async function runJellyPhantomDependencyAnalysis(projectRoot, options, telemetry
 async function runJellyImportReachabilityAnalysis(mainProjectRoot, projectRoot, vulnerabilities, options, telemetryHandler, analyzerTelemetryHandler) {
   const tmpFolder = await createTmpDirectory("jelly-analysis");
   try {
-    const includePackages = computePackagesOnVulnPath(vulnerabilities, { includeLeafPackages: true });
+    const includePackages = computePackagesOnVulnPath(vulnerabilities);
     const reachableModulesFile = resolve13(tmpFolder, "reachable-modules.json");
     const jellyCmd = cmdt`${await getNodeExecutable(ToolPathResolver.nodeExecutablePath)} --max-old-space-size=${options.memoryLimitInMB}
       ${ToolPathResolver.jellyPath} --max-file-size ${MAX_FILE_SIZE}
@@ -111171,7 +111172,9 @@ async function runJellyImportReachabilityAnalysis(mainProjectRoot, projectRoot,
       telemetryHandler,
       analyzerTelemetryHandler
     });
-    return JSON.parse(await readFile9(reachableModulesFile, "utf-8"));
+    const result = JSON.parse(await readFile9(reachableModulesFile, "utf-8"));
+    result.modules = result.modules.filter((m) => m.package);
+    return result;
   } finally {
     await rm2(tmpFolder, { recursive: true });
   }
@@ -111223,7 +111226,10 @@ var JSCodeAwareVulnerabilityScanner = class _JSCodeAwareVulnerabilityScanner {
     this.socketMode = state.workspaceData.type === "socket";
     const analysisOptionsFromHeuristic = heuristic.getOptions(state.vulnerabilities);
     const includePackages = analysisOptionsFromHeuristic.includePackages;
-    const packagesToInstall = !includePackages ? state.workspaceData.type === "coana" ? Object.values(state.workspaceData.data.dependencyTree.transitiveDependencies).map((dep) => getPackageName(dep)) : state.workspaceData.data.artifacts.map((dep) => getPackageName(dep)) : includePackages;
+    const vulnerablePackageNames = [
+      ...new Set(state.vulnerabilities.flatMap((v) => Object.values(v.vulnChainDetails?.transitiveDependencies ?? {}).filter((d) => d.vulnerable === true).map((d) => d.packageName)))
+    ];
+    const packagesToInstall = !includePackages ? state.workspaceData.type === "coana" ? Object.values(state.workspaceData.data.dependencyTree.transitiveDependencies).map((dep) => getPackageName(dep)) : state.workspaceData.data.artifacts.map((dep) => getPackageName(dep)) : [.../* @__PURE__ */ new Set([...includePackages, ...vulnerablePackageNames])];
     const { failedPackages } = await prepareNpmDependencies(state.rootWorkingDir, this.projectDir, state.workspaceData.type === "coana" ? state.workspaceData.data.dependencyTree.transitiveDependencies : Object.fromEntries(state.workspaceData.data.artifacts.map((d) => [d.id, d])), state.workspaceData.type === "coana" ? state.workspaceData.data.dependencyTree.dependencies ?? [] : state.workspaceData.data.artifacts.filter((a2) => a2.direct).map((a2) => a2.id), packagesToInstall);
     this.packagesExcludedUnrelatedToHeuristic = failedPackages.map((p) => getPackageName(p));
   }
@@ -113642,7 +113648,15 @@ ${e.stack}` : String(e),
             return false;
           }
           return matches.every(([, modGlob]) => {
-            return /[*?{}]/.test(modGlob) ? checkGlob(modGlob) : !reachableModuleNames.has(modGlob);
+            if (/[*?{}]/.test(modGlob))
+              return checkGlob(modGlob);
+            if (reachableModuleNames.has(modGlob))
+              return false;
+            const prefix = modGlob + "/";
+            for (const mod2 of reachableModuleNames)
+              if (mod2.startsWith(prefix))
+                return false;
+            return true;
           });
         }));
         logger.info(`Found ${unreachableVulns.length} ${pluralize(unreachableVulns.length, "vulnerability")} that ${unreachableVulns.length !== 1 ? "are" : "is"} unreachable from the import graph`);

package/repos/coana-tech/jelly-private/dist/bundle/approx.js

@@ -7,11 +7,11 @@ import "./iterator-helpers-polyfill.js";
 import {
   require_hints,
   require_parser
-} from "./chunk-IHOAXGXT.js";
+} from "./chunk-KH5GW7L6.js";
 import {
   require_proxy,
   require_sandbox
-} from "./chunk-AQ5JQOUT.js";
+} from "./chunk-3C2GHBMA.js";
 import {
   __commonJS,
   __name,
@@ -21,7 +21,7 @@ import {
   require_options,
   require_transform,
   require_util
-} from "./chunk-S4OPEAUO.js";
+} from "./chunk-ZFK76MWT.js";
 
 // lib/approx/approx.js
 var require_approx = __commonJS({

package/repos/coana-tech/jelly-private/dist/bundle/{chunk-AQ5JQOUT.js → chunk-3C2GHBMA.js}

@@ -9,7 +9,7 @@ import {
   __name,
   __require,
   require_transform
-} from "./chunk-S4OPEAUO.js";
+} from "./chunk-ZFK76MWT.js";
 
 // lib/approx/proxy.js
 var require_proxy = __commonJS({
@@ -268,4 +268,4 @@ export {
   require_proxy,
   require_sandbox
 };
-//# sourceMappingURL=chunk-AQ5JQOUT.js.map
+//# sourceMappingURL=chunk-3C2GHBMA.js.map

package/repos/coana-tech/jelly-private/dist/bundle/{chunk-IHOAXGXT.js → chunk-KH5GW7L6.js}

@@ -14,7 +14,7 @@ import {
   require_options,
   require_tokens,
   require_util
-} from "./chunk-S4OPEAUO.js";
+} from "./chunk-ZFK76MWT.js";
 
 // lib/parsing/parser.js
 var require_parser = __commonJS({
@@ -516,4 +516,4 @@ export {
   require_patching,
   require_hints
 };
-//# sourceMappingURL=chunk-IHOAXGXT.js.map
+//# sourceMappingURL=chunk-KH5GW7L6.js.map