@coana-tech/cli 14.12.219 → 14.12.220

package/cli.mjs

@@ -251836,7 +251836,7 @@ async function onlineScan(dependencyTree, apiKey, timeout) {
 }
 
 // dist/version.js
-var version3 = "14.12.219";
+var version3 = "14.12.220";
 
 // dist/cli-core.js
 var { mapValues, omit, partition, pickBy: pickBy2 } = import_lodash15.default;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coana-tech/cli",
-  "version": "14.12.219",
+  "version": "14.12.220",
   "description": "Coana CLI",
   "type": "module",
   "bin": {

package/reachability-analyzers-cli.mjs

@@ -113917,9 +113917,22 @@ async function analyzeWithHeuristics(state, vulns, heuristicsInOrder, doNotRecom
           heuristic: getHeuristicFromName(state, b.heuristicName, ecosystem),
           vulnerabilities: b.vulnUrls.map((vUrl) => vulnerabilities.find((v) => v.url === vUrl))
         })), analysisMetadataCollector, true);
+        const originalUrlToReachability = transformVulnsToUrlToReachability(resWithoutExperimentalHeuristic.augmentedVulnerabilities);
+        if (expHeuristicName === "SPARJS_EXPERIMENT") {
+          for (const v of resWithoutExperimentalHeuristic.augmentedVulnerabilities) {
+            if (v.results.type !== "success")
+              continue;
+            const { stacks } = v.results.detectedOccurrences;
+            if (!stacks.length)
+              continue;
+            const pkgsInVulnChain = new Set(Object.values(v.vulnChainDetails.transitiveDependencies).map((d) => d.packageName));
+            if (stacks.every((s2) => s2.some((f2, i4) => i4 > 0 && !pkgsInVulnChain.has(f2.package))))
+              ignoredVulnerabilities.add(v.url);
+          }
+        }
         await Promise.all([
           sendTimeRegressionsToDashboard(expHeuristicName, resWithoutExperimentalHeuristic.analysisMetadata, bucketsToRecompute),
-          sendReachabilityRegressionsToDashboard(resWithoutExperimentalHeuristic.analysisMetadata[0].heuristicName, expHeuristicName, transformVulnsToUrlToReachability(resWithoutExperimentalHeuristic.augmentedVulnerabilities), experimentalUrlToReachability, ignoredVulnerabilities)
+          sendReachabilityRegressionsToDashboard(resWithoutExperimentalHeuristic.analysisMetadata[0].heuristicName, expHeuristicName, originalUrlToReachability, experimentalUrlToReachability, ignoredVulnerabilities)
         ]);
       }
       const vulnsToGetFromExperimental = bucketsNotToRecompute.flatMap((b) => b.vulnUrls);
@@ -114227,8 +114240,8 @@ function findDuplicateVulnsInBuckets(bucketsFromLastAnalysis) {
   }
   return duplicateUrls;
 }
-function transformVulnsToUrlToReachability(oldHeuristicAugmentedVulnerabilities) {
-  return Object.fromEntries(oldHeuristicAugmentedVulnerabilities.map((v) => [
+function transformVulnsToUrlToReachability(augmentedVulnerabilities) {
+  return Object.fromEntries(augmentedVulnerabilities.map((v) => [
     v.url,
     {
       reachability: getVulnReachability(v.results),