@coana-tech/cli 14.12.209 → 14.12.211

package/cli.mjs

@@ -251742,7 +251742,7 @@ async function onlineScan(dependencyTree, apiKey, timeout) {
 }
 
 // dist/version.js
-var version3 = "14.12.209";
+var version3 = "14.12.211";
 
 // dist/cli-core.js
 var { mapValues, omit, partition, pickBy: pickBy2 } = import_lodash15.default;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coana-tech/cli",
-  "version": "14.12.209",
+  "version": "14.12.211",
   "description": "Coana CLI",
   "type": "module",
   "bin": {

package/reachability-analyzers-cli.mjs

@@ -110928,6 +110928,9 @@ function convertToArtifactForInstallation(dep) {
 }
 
 // dist/whole-program-code-aware-vulnerability-scanner/js/heuristics.js
+var largeIndirectionBoundOptions = {
+  maxIndirections: 1024
+};
 var lazyIndirectionBoundOptions = {
   maxIndirections: 5
 };
@@ -111863,7 +111866,9 @@ var SparJSAnalysisEngine = class extends JSAnalysisEngine {
           --reachable-json ${affectedPackagesFile}
           ${getExcludes(mainProjectRoot, projectRoot, reachabilityAnalysisOptions)}
           --diagnostics-json ${diagnosticsFile}
-          --max-indirections ${maxIndirections}
+          --max-indirections=${/* XXX: maxIndirections is tuned for --lazy mode, which SparJS doesn't support,
+       * so we use a value that's better for non-lazy analysis. */
+      maxIndirections ? largeIndirectionBoundOptions.maxIndirections : void 0}
           ${!!includePackages && (includePackages.length ? ["--include-packages", ...includePackages] : ["--ignore-dependencies"])}
           ${/* XXX: Requires Node 22+ */
       approx && "--approx"}
@@ -112034,7 +112039,7 @@ var JSCodeAwareVulnerabilityScanner = class _JSCodeAwareVulnerabilityScanner {
       ...new Set(state.vulnerabilities.flatMap((v) => Object.values(v.vulnChainDetails?.transitiveDependencies ?? {}).filter((d) => d.vulnerable === true).map((d) => d.packageName)))
     ];
     const packagesToInstall = !includePackages ? state.workspaceData.type === "coana" ? Object.values(state.workspaceData.data.dependencyTree.transitiveDependencies).map((dep) => getPackageName(dep)) : state.workspaceData.data.artifacts.map((dep) => getPackageName(dep)) : [.../* @__PURE__ */ new Set([...includePackages, ...vulnerablePackageNames])];
-    const { failedPackages } = await prepareNpmDependencies(state.rootWorkingDir, this.projectDir, state.workspaceData.type === "coana" ? state.workspaceData.data.dependencyTree.transitiveDependencies : Object.fromEntries(state.workspaceData.data.artifacts.map((d) => [d.id, d])), state.workspaceData.type === "coana" ? state.workspaceData.data.dependencyTree.dependencies ?? [] : state.workspaceData.data.artifacts.filter((a2) => a2.direct).map((a2) => a2.id), packagesToInstall);
+    const { failedPackages } = await prepareNpmDependencies(state.subprojectDir, this.projectDir, state.workspaceData.type === "coana" ? state.workspaceData.data.dependencyTree.transitiveDependencies : Object.fromEntries(state.workspaceData.data.artifacts.map((d) => [d.id, d])), state.workspaceData.type === "coana" ? state.workspaceData.data.dependencyTree.dependencies ?? [] : state.workspaceData.data.artifacts.filter((a2) => a2.direct).map((a2) => a2.id), packagesToInstall);
     this.packagesExcludedUnrelatedToHeuristic = failedPackages.map((p) => getPackageName(p));
   }
   async runAnalysis(vulnerabilities, heuristic, timeoutInSeconds, experiment, telemetryHandler, analyzerTelemetryHandler) {
@@ -113914,8 +113919,8 @@ async function analyzeWithHeuristics(state, vulns, heuristicsInOrder, doNotRecom
     const bucketsFromLastAnalysisAndCliVersion = await dashboardAPI.getBucketsForLastReport(relative9(state.rootWorkingDir, state.subprojectDir) || ".", state.workspacePath, vulnerabilities[0].ecosystem ?? "NPM", COANA_REPORT_ID, apiKey);
     if (!bucketsFromLastAnalysisAndCliVersion)
       return void 0;
-    const { cliVersion: cliVersion2, buckets: bucketsFromLastAnalysis } = bucketsFromLastAnalysisAndCliVersion;
-    if (bucketsFromLastAnalysis.some((b) => b.heuristicName === heuristics.IGNORE_DEPENDENCIES_AND_MAX_ROUNDS_3.name))
+    const { cliVersion: cliVersion2, buckets: rawBucketsFromLastAnalysis } = bucketsFromLastAnalysisAndCliVersion;
+    if (rawBucketsFromLastAnalysis.some((b) => b.heuristicName === heuristics.IGNORE_DEPENDENCIES_AND_MAX_ROUNDS_3.name))
       return;
     try {
       if ((0, import_semver4.lt)(cliVersion2, CLI_VERSION_TO_USE_CACHING_FROM[ecosystem] ?? CLI_VERSION_TO_USE_CACHING_FROM_DEFAULT))
@@ -113923,6 +113928,7 @@ async function analyzeWithHeuristics(state, vulns, heuristicsInOrder, doNotRecom
     } catch (e) {
       return void 0;
     }
+    const bucketsFromLastAnalysis = rawBucketsFromLastAnalysis.filter((b) => b.heuristicName !== "IMPORT_REACHABILITY");
     const duplicateUrls = findDuplicateVulnsInBuckets(bucketsFromLastAnalysis);
     if (duplicateUrls.length > 0) {
       sendWarningToDashboard(`Assertion error: Detected bucket(s) with non-unique vulnerability URLs. Non-unique URLs: ${duplicateUrls.join(" ")}.`, {