@coana-tech/cli 14.12.69 → 14.12.71

package/cli.mjs

@@ -20465,22 +20465,22 @@ var require_conversions = __commonJS({
       var hi = Math.floor(h) % 6;
       var f6 = h - Math.floor(h);
       var p3 = 255 * v * (1 - s6);
-      var q4 = 255 * v * (1 - s6 * f6);
+      var q5 = 255 * v * (1 - s6 * f6);
       var t4 = 255 * v * (1 - s6 * (1 - f6));
       v *= 255;
       switch (hi) {
         case 0:
           return [v, t4, p3];
         case 1:
-          return [q4, v, p3];
+          return [q5, v, p3];
         case 2:
           return [p3, v, t4];
         case 3:
-          return [p3, q4, v];
+          return [p3, q5, v];
         case 4:
           return [t4, p3, v];
         case 5:
-          return [v, p3, q4];
+          return [v, p3, q5];
       }
     };
     convert.hsv.hsl = function(hsv) {
@@ -33631,22 +33631,22 @@ var require_conversions2 = __commonJS({
       const hi = Math.floor(h) % 6;
       const f6 = h - Math.floor(h);
       const p3 = 255 * v * (1 - s6);
-      const q4 = 255 * v * (1 - s6 * f6);
+      const q5 = 255 * v * (1 - s6 * f6);
       const t4 = 255 * v * (1 - s6 * (1 - f6));
       v *= 255;
       switch (hi) {
         case 0:
           return [v, t4, p3];
         case 1:
-          return [q4, v, p3];
+          return [q5, v, p3];
         case 2:
           return [p3, v, t4];
         case 3:
-          return [p3, q4, v];
+          return [p3, q5, v];
         case 4:
           return [t4, p3, v];
         case 5:
-          return [v, p3, q4];
+          return [v, p3, q5];
       }
     };
     convert.hsv.hsl = function(hsv) {
@@ -41848,9 +41848,9 @@ var require_lib8 = __commonJS({
         return equiv$1(query, domain);
       }
       next: for (let i7 = 0, j = 0; i7 < nq; i7++) {
-        const q4 = query[i7];
+        const q5 = query[i7];
         while (j < nd) {
-          if (equiv$1(domain[j++], q4)) {
+          if (equiv$1(domain[j++], q5)) {
             continue next;
           }
         }
@@ -44398,8 +44398,8 @@ var require_lang = __commonJS({
         const root3 = (0, parser_1.createTree)(this.lexer, this.config.parser);
         return (0, parser_1.createCursor)(root3);
       }
-      query(input, q4, context2) {
-        const matcher = (0, query_1.buildRoot)(q4);
+      query(input, q5, context2) {
+        const matcher = (0, query_1.buildRoot)(q5);
         const cursor = typeof input === "string" ? this.parse(input) : input;
         const checkpoint = matcher.match({ cursor, context: context2 });
         const result = checkpoint === null || checkpoint === void 0 ? void 0 : checkpoint.context;
@@ -102356,17 +102356,17 @@ var require_expand = __commonJS({
       let walk = (node, parent2 = {}) => {
         node.queue = [];
         let p3 = parent2;
-        let q4 = parent2.queue;
+        let q5 = parent2.queue;
         while (p3.type !== "brace" && p3.type !== "root" && p3.parent) {
           p3 = p3.parent;
-          q4 = p3.queue;
+          q5 = p3.queue;
         }
         if (node.invalid || node.dollar) {
-          q4.push(append4(q4.pop(), stringify3(node, options)));
+          q5.push(append4(q5.pop(), stringify3(node, options)));
           return;
         }
         if (node.type === "brace" && node.invalid !== true && node.nodes.length === 2) {
-          q4.push(append4(q4.pop(), ["{}"]));
+          q5.push(append4(q5.pop(), ["{}"]));
           return;
         }
         if (node.nodes && node.ranges > 0) {
@@ -102378,7 +102378,7 @@ var require_expand = __commonJS({
           if (range2.length === 0) {
             range2 = stringify3(node, options);
           }
-          q4.push(append4(q4.pop(), range2));
+          q5.push(append4(q5.pop(), range2));
           node.nodes = [];
           return;
         }
@@ -102397,7 +102397,7 @@ var require_expand = __commonJS({
             continue;
           }
           if (child.type === "close") {
-            q4.push(append4(q4.pop(), queue, enclose));
+            q5.push(append4(q5.pop(), queue, enclose));
             continue;
           }
           if (child.value && child.type !== "open") {
@@ -104486,6 +104486,258 @@ var require_micromatch = __commonJS({
   }
 });
 
+// ../fixing-management/src/fixing-management/rubygems/ruby-lang.ts
+var operators3, octdigit, digit, nonzerodigit, hexdigit, bindigit, octinteger, hexinteger, bininteger, decinteger, integer, digitpart, fraction, exponent, pointfloat, exponentfloat, floatnumber, numbers, templates, lexer, parser, lang3;
+var init_ruby_lang = __esm({
+  "../fixing-management/src/fixing-management/rubygems/ruby-lang.ts"() {
+    "use strict";
+    operators3 = /* prettier-ignore */
+    [
+      "+",
+      "-",
+      "*",
+      "/",
+      "%",
+      "**",
+      "+=",
+      "-=",
+      "*=",
+      "/=",
+      "%=",
+      "**=",
+      "==",
+      "!=",
+      "<",
+      "<=",
+      ">",
+      ">=",
+      "<=>",
+      "===",
+      "=~",
+      "!~",
+      "&&",
+      "||",
+      "!",
+      "and",
+      "or",
+      "not",
+      "&",
+      "|",
+      "^",
+      "~",
+      "<<",
+      ">>",
+      "?",
+      "?.",
+      "=",
+      ":",
+      "::",
+      "=>",
+      "->",
+      ",",
+      ";",
+      ".",
+      "..",
+      "..."
+    ];
+    octdigit = "[0-7]";
+    digit = "[0-9]";
+    nonzerodigit = "[1-9]";
+    hexdigit = `(?:${digit}|[a-fA-F])`;
+    bindigit = "[01]";
+    octinteger = `(?:0[oO](?:_?${octdigit})+)`;
+    hexinteger = `(?:0[xX](?:_?${hexdigit})+)`;
+    bininteger = `(?:0[bB](?:_?${bindigit})+)`;
+    decinteger = `(?:${nonzerodigit}(?:_?${digit})*|0)`;
+    integer = `(?:${decinteger}|${octinteger}|${hexinteger}|${bininteger})`;
+    digitpart = `(?:${digit}(?:_?${digit})*)`;
+    fraction = `(?:\\.${digitpart})`;
+    exponent = `(?:[eE][-+]?${digitpart})`;
+    pointfloat = `(?:${digitpart}?${fraction}|${digitpart}\\.)`;
+    exponentfloat = `(?:(?:${digitpart}|${pointfloat})${exponent})`;
+    floatnumber = `(?:${pointfloat}|${exponentfloat})`;
+    numbers = new RegExp(`(?:${integer}|${floatnumber})`);
+    templates = [
+      {
+        type: "var",
+        startsWith: "#",
+        // Match instance vars (#@var), class vars (#@@var), and global vars (#$var)
+        symbols: /(?:@@?|\\$)[a-zA-Z_][a-zA-Z0-9_]*/
+      },
+      { type: "expr", startsWith: "#{", endsWith: "}" }
+    ];
+    lexer = {
+      joinLines: "\\",
+      comments: [
+        { type: "line-comment", startsWith: "#" },
+        { type: "multiline-comment", startsWith: "=begin", endsWith: "=end" }
+      ],
+      // Ruby identifiers: letters, digits, underscores. Can start with letter or underscore
+      // Can end with ? or ! for predicate/mutator methods
+      symbols: /[_a-zA-Z][_a-zA-Z0-9]*[?!]?/,
+      numbers,
+      operators: operators3,
+      brackets: [
+        { startsWith: "{", endsWith: "}" },
+        { startsWith: "[", endsWith: "]" },
+        { startsWith: "(", endsWith: ")" }
+      ],
+      strings: [
+        // Double-quoted strings support interpolation
+        { startsWith: '"', templates, endsWith: '"' },
+        // Single-quoted strings do not support interpolation
+        { startsWith: "'", endsWith: "'" }
+      ]
+    };
+    parser = {
+      useIndentBlocks: false
+    };
+    lang3 = { lexer, parser };
+  }
+});
+
+// ../fixing-management/src/fixing-management/rubygems/gemspec-utils.ts
+var gemspec_utils_exports = {};
+__export(gemspec_utils_exports, {
+  parseGemspec: () => parseGemspec
+});
+function parseGemspec(rootDir, file, sourceText) {
+  const gemspec = { rootDir, file, sourceText };
+  const ctx = { gemspec, dependencies: [], devDependencies: [], mem: /* @__PURE__ */ new Map(), depth: 0 };
+  const parser2 = import_good_enough_parser3.lang.createLang(lang3);
+  const cursor = parser2.parse(sourceText);
+  const result = parser2.query(cursor, treeQuery3, ctx);
+  const dependencies = result ? result.dependencies : [];
+  const devDependencies = result ? result.devDependencies : [];
+  return {
+    rootDir,
+    file,
+    sourceText,
+    dependencies,
+    devDependencies
+  };
+}
+var import_good_enough_parser3, booleanQuery, numberQuery, stringQuery, variableQuery, interpolatedStringQuery, simpleExpressionQuery, concatExpressionQuery, expressionQuery, variableAssignmentQuery, optionQuery, dependencyArgumentQuery, addDependencyQuery, treeQuery3;
+var init_gemspec_utils = __esm({
+  "../fixing-management/src/fixing-management/rubygems/gemspec-utils.ts"() {
+    "use strict";
+    import_good_enough_parser3 = __toESM(require_cjs(), 1);
+    init_ruby_lang();
+    booleanQuery = import_good_enough_parser3.query.alt(
+      import_good_enough_parser3.query.sym(/^true|false$/, (ctx, { value: value2, offset }) => {
+        (ctx.v ??= []).push({ text: value2, offset, gemfile: ctx.gemspec });
+        ctx.exprEndOffset = offset + value2.length;
+        return ctx;
+      })
+    );
+    numberQuery = import_good_enough_parser3.query.num((ctx, { value: value2, offset }) => {
+      (ctx.v ??= []).push({ text: value2, offset, gemfile: ctx.gemspec });
+      ctx.exprEndOffset = offset + value2.length;
+      return ctx;
+    });
+    stringQuery = import_good_enough_parser3.query.str((ctx, { value: value2, offset }) => {
+      (ctx.v ??= []).push({ text: value2, offset, gemfile: ctx.gemspec });
+      ctx.exprEndOffset = offset + value2.length + 1;
+      return ctx;
+    });
+    variableQuery = import_good_enough_parser3.query.sym((ctx, { value: value2, offset }) => {
+      ctx.v = (ctx.v ?? []).concat(ctx.mem.get(value2) ?? [void 0]);
+      ctx.exprEndOffset = offset + value2.length;
+      return ctx;
+    });
+    interpolatedStringQuery = import_good_enough_parser3.query.tree({
+      type: "string-tree",
+      search: import_good_enough_parser3.query.alt(stringQuery, variableQuery),
+      postHandler: (ctx, tree) => {
+        if (tree.type === "string-tree") {
+          ctx.exprEndOffset = tree.endsWith.offset + 1;
+        }
+        return ctx;
+      }
+    });
+    simpleExpressionQuery = import_good_enough_parser3.query.alt(
+      booleanQuery,
+      numberQuery,
+      stringQuery,
+      variableQuery,
+      interpolatedStringQuery
+    );
+    concatExpressionQuery = simpleExpressionQuery.many(import_good_enough_parser3.query.op("+").join(simpleExpressionQuery));
+    expressionQuery = import_good_enough_parser3.query.alt(simpleExpressionQuery, concatExpressionQuery);
+    variableAssignmentQuery = import_good_enough_parser3.query.sym((ctx, { value: value2 }) => {
+      ctx.x = value2;
+      return ctx;
+    }).op("=").join(expressionQuery).handler((ctx) => {
+      ctx.mem.set(ctx.x, ctx.v);
+      ctx.x = void 0;
+      ctx.v = void 0;
+      ctx.exprEndOffset = void 0;
+      return ctx;
+    });
+    optionQuery = import_good_enough_parser3.query.opt(import_good_enough_parser3.query.op(":")).sym((ctx, { value: value2 }) => {
+      ctx.x = value2;
+      return ctx;
+    }).alt(import_good_enough_parser3.query.op(":"), import_good_enough_parser3.query.op("=>")).join(expressionQuery).handler((ctx) => {
+      ctx.currentGem?.specs.push({
+        type: "option",
+        key: ctx.x,
+        value: ctx.v,
+        preceedingCommaOffset: ctx.preceedingCommaOffset
+      });
+      ctx.x = void 0;
+      ctx.v = void 0;
+      ctx.exprEndOffset = void 0;
+      ctx.preceedingCommaOffset = void 0;
+      return ctx;
+    });
+    dependencyArgumentQuery = import_good_enough_parser3.query.alt(
+      // Options (key: value syntax)
+      optionQuery,
+      // Version constraint (positional)
+      expressionQuery.handler((ctx) => {
+        ctx.currentGem?.specs.push({
+          type: "version",
+          value: ctx.v,
+          preceedingCommaOffset: ctx.preceedingCommaOffset,
+          endOfSpecOffset: ctx.exprEndOffset
+        });
+        ctx.v = void 0;
+        ctx.exprEndOffset = void 0;
+        ctx.preceedingCommaOffset = void 0;
+        return ctx;
+      })
+    );
+    addDependencyQuery = import_good_enough_parser3.query.opt(import_good_enough_parser3.query.sym("spec").op(".")).sym(/^add_(runtime_|development_)?dependency$/, (ctx, { value: value2 }) => {
+      ctx.isDevelopmentDependency = value2.includes("development");
+      return ctx;
+    }).join(expressionQuery).handler((ctx) => {
+      ctx.currentGem = { gemfile: ctx.gemspec, name: ctx.v, endOfNameOffset: ctx.exprEndOffset, specs: [] };
+      ctx.v = void 0;
+      ctx.exprEndOffset = void 0;
+      return ctx;
+    }).opt(
+      import_good_enough_parser3.query.many(
+        import_good_enough_parser3.query.op(",", (ctx, { offset }) => {
+          ctx.preceedingCommaOffset = offset;
+          return ctx;
+        }).join(dependencyArgumentQuery)
+      )
+    ).handler((ctx) => {
+      if (ctx.isDevelopmentDependency) {
+        ctx.devDependencies.push(ctx.currentGem);
+      } else {
+        ctx.dependencies.push(ctx.currentGem);
+      }
+      ctx.isDevelopmentDependency = void 0;
+      return ctx;
+    });
+    treeQuery3 = import_good_enough_parser3.query.tree({
+      type: "root-tree",
+      search: import_good_enough_parser3.query.alt(variableAssignmentQuery, addDependencyQuery)
+    });
+  }
+});
+
 // ../../node_modules/.pnpm/@actions+core@1.10.1/node_modules/@actions/core/lib/utils.js
 var require_utils6 = __commonJS({
   "../../node_modules/.pnpm/@actions+core@1.10.1/node_modules/@actions/core/lib/utils.js"(exports2) {
@@ -123041,8 +123293,8 @@ var require_summary = __commonJS({
        *
        * @returns {Summary} summary instance
        */
-      addCodeBlock(code, lang5) {
-        const attrs = Object.assign({}, lang5 && { lang: lang5 });
+      addCodeBlock(code, lang6) {
+        const attrs = Object.assign({}, lang6 && { lang: lang6 });
         const element = this.wrap("pre", this.wrap("code", code), attrs);
         return this.addRaw(element).addEOL();
       }
@@ -151766,17 +152018,17 @@ var require_expand2 = __commonJS({
       const walk = (node, parent2 = {}) => {
         node.queue = [];
         let p3 = parent2;
-        let q4 = parent2.queue;
+        let q5 = parent2.queue;
         while (p3.type !== "brace" && p3.type !== "root" && p3.parent) {
           p3 = p3.parent;
-          q4 = p3.queue;
+          q5 = p3.queue;
         }
         if (node.invalid || node.dollar) {
-          q4.push(append4(q4.pop(), stringify3(node, options)));
+          q5.push(append4(q5.pop(), stringify3(node, options)));
           return;
         }
         if (node.type === "brace" && node.invalid !== true && node.nodes.length === 2) {
-          q4.push(append4(q4.pop(), ["{}"]));
+          q5.push(append4(q5.pop(), ["{}"]));
           return;
         }
         if (node.nodes && node.ranges > 0) {
@@ -151788,7 +152040,7 @@ var require_expand2 = __commonJS({
           if (range2.length === 0) {
             range2 = stringify3(node, options);
           }
-          q4.push(append4(q4.pop(), range2));
+          q5.push(append4(q5.pop(), range2));
           node.nodes = [];
           return;
         }
@@ -151807,7 +152059,7 @@ var require_expand2 = __commonJS({
             continue;
           }
           if (child.type === "close") {
-            q4.push(append4(q4.pop(), queue, enclose));
+            q5.push(append4(q5.pop(), queue, enclose));
             continue;
           }
           if (child.value && child.type !== "open") {
@@ -200441,14 +200693,14 @@ var require_WebClient = __commonJS({
     };
     var __asyncGenerator = exports2 && exports2.__asyncGenerator || function(thisArg, _arguments, generator) {
       if (!Symbol.asyncIterator) throw new TypeError("Symbol.asyncIterator is not defined.");
-      var g = generator.apply(thisArg, _arguments || []), i7, q4 = [];
+      var g = generator.apply(thisArg, _arguments || []), i7, q5 = [];
       return i7 = {}, verb("next"), verb("throw"), verb("return"), i7[Symbol.asyncIterator] = function() {
         return this;
       }, i7;
       function verb(n2) {
         if (g[n2]) i7[n2] = function(v) {
           return new Promise(function(a4, b) {
-            q4.push([n2, v, a4, b]) > 1 || resume(n2, v);
+            q5.push([n2, v, a4, b]) > 1 || resume(n2, v);
           });
         };
       }
@@ -200456,11 +200708,11 @@ var require_WebClient = __commonJS({
         try {
           step(g[n2](v));
         } catch (e) {
-          settle2(q4[0][3], e);
+          settle2(q5[0][3], e);
         }
       }
       function step(r3) {
-        r3.value instanceof __await ? Promise.resolve(r3.value.v).then(fulfill, reject) : settle2(q4[0][2], r3);
+        r3.value instanceof __await ? Promise.resolve(r3.value.v).then(fulfill, reject) : settle2(q5[0][2], r3);
       }
       function fulfill(value2) {
         resume("next", value2);
@@ -200469,7 +200721,7 @@ var require_WebClient = __commonJS({
         resume("throw", value2);
       }
       function settle2(f6, v) {
-        if (f6(v), q4.shift(), q4.length) resume(q4[0][0], q4[0][1]);
+        if (f6(v), q5.shift(), q5.length) resume(q5[0][0], q5[0][1]);
       }
     };
     var __asyncValues = exports2 && exports2.__asyncValues || function(o7) {
@@ -225675,142 +225927,36 @@ var import_picomatch9 = __toESM(require_picomatch2(), 1);
 import assert12 from "node:assert";
 
 // ../fixing-management/src/fixing-management/rubygems/gemfile-utils.ts
-var import_good_enough_parser3 = __toESM(require_cjs(), 1);
-
-// ../fixing-management/src/fixing-management/rubygems/ruby-lang.ts
-var operators3 = (
-  /* prettier-ignore */
-  [
-    "+",
-    "-",
-    "*",
-    "/",
-    "%",
-    "**",
-    "+=",
-    "-=",
-    "*=",
-    "/=",
-    "%=",
-    "**=",
-    "==",
-    "!=",
-    "<",
-    "<=",
-    ">",
-    ">=",
-    "<=>",
-    "===",
-    "=~",
-    "!~",
-    "&&",
-    "||",
-    "!",
-    "and",
-    "or",
-    "not",
-    "&",
-    "|",
-    "^",
-    "~",
-    "<<",
-    ">>",
-    "?",
-    "?.",
-    "=",
-    ":",
-    "::",
-    "=>",
-    "->",
-    ",",
-    ";",
-    ".",
-    "..",
-    "..."
-  ]
-);
-var octdigit = "[0-7]";
-var digit = "[0-9]";
-var nonzerodigit = "[1-9]";
-var hexdigit = `(?:${digit}|[a-fA-F])`;
-var bindigit = "[01]";
-var octinteger = `(?:0[oO](?:_?${octdigit})+)`;
-var hexinteger = `(?:0[xX](?:_?${hexdigit})+)`;
-var bininteger = `(?:0[bB](?:_?${bindigit})+)`;
-var decinteger = `(?:${nonzerodigit}(?:_?${digit})*|0)`;
-var integer = `(?:${decinteger}|${octinteger}|${hexinteger}|${bininteger})`;
-var digitpart = `(?:${digit}(?:_?${digit})*)`;
-var fraction = `(?:\\.${digitpart})`;
-var exponent = `(?:[eE][-+]?${digitpart})`;
-var pointfloat = `(?:${digitpart}?${fraction}|${digitpart}\\.)`;
-var exponentfloat = `(?:(?:${digitpart}|${pointfloat})${exponent})`;
-var floatnumber = `(?:${pointfloat}|${exponentfloat})`;
-var numbers = new RegExp(`(?:${integer}|${floatnumber})`);
-var templates = [
-  {
-    type: "var",
-    startsWith: "#",
-    // Match instance vars (#@var), class vars (#@@var), and global vars (#$var)
-    symbols: /(?:@@?|\\$)[a-zA-Z_][a-zA-Z0-9_]*/
-  },
-  { type: "expr", startsWith: "#{", endsWith: "}" }
-];
-var lexer = {
-  joinLines: "\\",
-  comments: [
-    { type: "line-comment", startsWith: "#" },
-    { type: "multiline-comment", startsWith: "=begin", endsWith: "=end" }
-  ],
-  // Ruby identifiers: letters, digits, underscores. Can start with letter or underscore
-  // Can end with ? or ! for predicate/mutator methods
-  symbols: /[_a-zA-Z][_a-zA-Z0-9]*[?!]?/,
-  numbers,
-  operators: operators3,
-  brackets: [
-    { startsWith: "{", endsWith: "}" },
-    { startsWith: "[", endsWith: "]" },
-    { startsWith: "(", endsWith: ")" }
-  ],
-  strings: [
-    // Double-quoted strings support interpolation
-    { startsWith: '"', templates, endsWith: '"' },
-    // Single-quoted strings do not support interpolation
-    { startsWith: "'", endsWith: "'" }
-  ]
-};
-var parser = {
-  useIndentBlocks: false
-};
-var lang3 = { lexer, parser };
-
-// ../fixing-management/src/fixing-management/rubygems/gemfile-utils.ts
+var import_good_enough_parser4 = __toESM(require_cjs(), 1);
+init_ruby_lang();
 import { resolve as resolve32, dirname as dirname17, relative as relative12 } from "node:path";
-import { existsSync as existsSync14, readFileSync as readFileSync3 } from "node:fs";
-var booleanQuery = import_good_enough_parser3.query.alt(
-  import_good_enough_parser3.query.sym(/^true|false$/, (ctx, { value: value2, offset }) => {
+import { existsSync as existsSync14, readFileSync as readFileSync3, readdirSync as readdirSync4 } from "node:fs";
+init_gemspec_utils();
+var booleanQuery2 = import_good_enough_parser4.query.alt(
+  import_good_enough_parser4.query.sym(/^true|false$/, (ctx, { value: value2, offset }) => {
     (ctx.v ??= []).push({ text: value2, offset, gemfile: ctx.gemfile });
     ctx.exprEndOffset = offset + value2.length;
     return ctx;
   })
 );
-var numberQuery = import_good_enough_parser3.query.num((ctx, { value: value2, offset }) => {
+var numberQuery2 = import_good_enough_parser4.query.num((ctx, { value: value2, offset }) => {
   (ctx.v ??= []).push({ text: value2, offset, gemfile: ctx.gemfile });
   ctx.exprEndOffset = offset + value2.length;
   return ctx;
 });
-var stringQuery = import_good_enough_parser3.query.str((ctx, { value: value2, offset }) => {
+var stringQuery2 = import_good_enough_parser4.query.str((ctx, { value: value2, offset }) => {
   (ctx.v ??= []).push({ text: value2, offset, gemfile: ctx.gemfile });
   ctx.exprEndOffset = offset + value2.length + 1;
   return ctx;
 });
-var variableQuery = import_good_enough_parser3.query.sym((ctx, { value: value2, offset }) => {
+var variableQuery2 = import_good_enough_parser4.query.sym((ctx, { value: value2, offset }) => {
   ctx.v = (ctx.v ?? []).concat(ctx.mem.get(value2) ?? [void 0]);
   ctx.exprEndOffset = offset + value2.length;
   return ctx;
 });
-var interpolatedStringQuery = import_good_enough_parser3.query.tree({
+var interpolatedStringQuery2 = import_good_enough_parser4.query.tree({
   type: "string-tree",
-  search: import_good_enough_parser3.query.alt(stringQuery, variableQuery),
+  search: import_good_enough_parser4.query.alt(stringQuery2, variableQuery2),
   postHandler: (ctx, tree) => {
     if (tree.type === "string-tree") {
       ctx.exprEndOffset = tree.endsWith.offset + 1;
@@ -225818,29 +225964,29 @@ var interpolatedStringQuery = import_good_enough_parser3.query.tree({
     return ctx;
   }
 });
-var simpleExpressionQuery = import_good_enough_parser3.query.alt(
-  booleanQuery,
-  numberQuery,
-  stringQuery,
-  variableQuery,
-  interpolatedStringQuery
+var simpleExpressionQuery2 = import_good_enough_parser4.query.alt(
+  booleanQuery2,
+  numberQuery2,
+  stringQuery2,
+  variableQuery2,
+  interpolatedStringQuery2
 );
-var concatExpressionQuery = simpleExpressionQuery.many(import_good_enough_parser3.query.op("+").join(simpleExpressionQuery));
-var expressionQuery = import_good_enough_parser3.query.alt(simpleExpressionQuery, concatExpressionQuery);
-var variableAssignmentQuery = import_good_enough_parser3.query.sym((ctx, { value: value2 }) => {
+var concatExpressionQuery2 = simpleExpressionQuery2.many(import_good_enough_parser4.query.op("+").join(simpleExpressionQuery2));
+var expressionQuery2 = import_good_enough_parser4.query.alt(simpleExpressionQuery2, concatExpressionQuery2);
+var variableAssignmentQuery2 = import_good_enough_parser4.query.sym((ctx, { value: value2 }) => {
   ctx.x = value2;
   return ctx;
-}).op("=").join(expressionQuery).handler((ctx) => {
+}).op("=").join(expressionQuery2).handler((ctx) => {
   ctx.mem.set(ctx.x, ctx.v);
   ctx.x = void 0;
   ctx.v = void 0;
   ctx.exprEndOffset = void 0;
   return ctx;
 });
-var optionQuery = import_good_enough_parser3.query.opt(import_good_enough_parser3.query.op(":")).sym((ctx, { value: value2 }) => {
+var optionQuery2 = import_good_enough_parser4.query.opt(import_good_enough_parser4.query.op(":")).sym((ctx, { value: value2 }) => {
   ctx.x = value2;
   return ctx;
-}).alt(import_good_enough_parser3.query.op(":"), import_good_enough_parser3.query.op("=>")).join(expressionQuery).handler((ctx) => {
+}).alt(import_good_enough_parser4.query.op(":"), import_good_enough_parser4.query.op("=>")).join(expressionQuery2).handler((ctx) => {
   ctx.currentGem?.specs.push({
     type: "option",
     key: ctx.x,
@@ -225853,11 +225999,11 @@ var optionQuery = import_good_enough_parser3.query.opt(import_good_enough_parser
   ctx.preceedingCommaOffset = void 0;
   return ctx;
 });
-var gemArgumentQuery = import_good_enough_parser3.query.alt(
+var gemArgumentQuery = import_good_enough_parser4.query.alt(
   // Options (key: value syntax): gem 'name', github: 'rails/rails', git: '...', etc.
-  optionQuery,
+  optionQuery2,
   // Version constraint (positional): gem 'name', '~> 1.0' or MY_VERSION or "~> " + VERSION
-  expressionQuery.handler((ctx) => {
+  expressionQuery2.handler((ctx) => {
     ctx.currentGem?.specs.push({
       type: "version",
       value: ctx.v,
@@ -225870,14 +226016,14 @@ var gemArgumentQuery = import_good_enough_parser3.query.alt(
     return ctx;
   })
 );
-var gemQuery = import_good_enough_parser3.query.sym("gem").join(expressionQuery).handler((ctx) => {
+var gemQuery = import_good_enough_parser4.query.sym("gem").join(expressionQuery2).handler((ctx) => {
   ctx.currentGem = { gemfile: ctx.gemfile, name: ctx.v, endOfNameOffset: ctx.exprEndOffset, specs: [] };
   ctx.v = void 0;
   ctx.exprEndOffset = void 0;
   return ctx;
 }).opt(
-  import_good_enough_parser3.query.many(
-    import_good_enough_parser3.query.op(",", (ctx, { offset }) => {
+  import_good_enough_parser4.query.many(
+    import_good_enough_parser4.query.op(",", (ctx, { offset }) => {
       ctx.preceedingCommaOffset = offset;
       return ctx;
     }).join(gemArgumentQuery)
@@ -225886,7 +226032,7 @@ var gemQuery = import_good_enough_parser3.query.sym("gem").join(expressionQuery)
   ctx.gems.push(ctx.currentGem);
   return ctx;
 });
-var evalGemfileQuery = import_good_enough_parser3.query.sym("eval_gemfile").join(expressionQuery).handler((ctx) => {
+var evalGemfileQuery = import_good_enough_parser4.query.sym("eval_gemfile").join(expressionQuery2).handler((ctx) => {
   const pathEvaluated = evaluate4(ctx.v);
   ctx.v = void 0;
   ctx.exprEndOffset = void 0;
@@ -225901,36 +226047,125 @@ var evalGemfileQuery = import_good_enough_parser3.query.sym("eval_gemfile").join
   const file = relative12(rootDir, resolve32(rootDir, dirname17(ctx.gemfile.file), pathEvaluated));
   if (!existsSync14(resolve32(rootDir, file))) return ctx;
   const sourceText = readFileSync3(resolve32(rootDir, file), "utf-8");
-  const parser2 = import_good_enough_parser3.lang.createLang(lang3);
+  const parser2 = import_good_enough_parser4.lang.createLang(lang3);
   const cursor = parser2.parse(sourceText);
-  const otherCtx = parser2.query(cursor, treeQuery3, {
+  const otherCtx = parser2.query(cursor, treeQuery4, {
     gemfile: { rootDir, file, sourceText },
     gems: ctx.gems,
+    gemspecs: ctx.gemspecs,
     mem: ctx.mem,
     depth: ctx.depth + 1
   });
   if (otherCtx) {
     ctx.gems = otherCtx.gems;
+    ctx.gemspecs = otherCtx.gemspecs;
     ctx.mem = otherCtx.mem;
   }
   return ctx;
 });
-var treeQuery3 = import_good_enough_parser3.query.tree({
+var gemspecOptionQuery = import_good_enough_parser4.query.opt(import_good_enough_parser4.query.op(":")).sym((ctx, { value: value2 }) => {
+  ctx.x = value2;
+  return ctx;
+}).alt(import_good_enough_parser4.query.op(":"), import_good_enough_parser4.query.op("=>")).join(expressionQuery2).handler((ctx) => {
+  if (!ctx.currentGem) {
+    ctx.currentGem = { gemfile: ctx.gemfile, name: [], endOfNameOffset: 0, specs: [] };
+  }
+  ctx.currentGem.specs.push({
+    type: "option",
+    key: ctx.x,
+    value: ctx.v,
+    preceedingCommaOffset: ctx.preceedingCommaOffset ?? 0
+  });
+  ctx.x = void 0;
+  ctx.v = void 0;
+  ctx.exprEndOffset = void 0;
+  ctx.preceedingCommaOffset = void 0;
+  return ctx;
+});
+var gemspecQuery = import_good_enough_parser4.query.sym("gemspec").opt(
+  import_good_enough_parser4.query.alt(
+    // First option (no leading comma)
+    gemspecOptionQuery,
+    // Multiple options (with commas)
+    import_good_enough_parser4.query.many(
+      import_good_enough_parser4.query.op(",", (ctx, { offset }) => {
+        ctx.preceedingCommaOffset = offset;
+        return ctx;
+      }).join(gemspecOptionQuery)
+    )
+  )
+).handler((ctx) => {
+  if (ctx.depth > 50) {
+    logger.warn(
+      `Recursion limit hit while evaluating gemspec: ${relative12(ctx.gemfile.rootDir, resolve32(ctx.gemfile.rootDir, ctx.gemfile.file))}`
+    );
+    ctx.currentGem = void 0;
+    return ctx;
+  }
+  const rootDir = ctx.gemfile.rootDir;
+  const gemfileDir = dirname17(ctx.gemfile.file);
+  let gemspecPath;
+  let gemspecName;
+  if (ctx.currentGem) {
+    for (const spec of ctx.currentGem.specs) {
+      if (spec.type === "option") {
+        const value2 = evaluate4(spec.value);
+        if (spec.key === "path" && value2 !== void 0) {
+          gemspecPath = value2;
+        } else if (spec.key === "name" && value2 !== void 0) {
+          gemspecName = value2;
+        }
+      }
+    }
+    ctx.currentGem = void 0;
+  }
+  const searchDir = gemspecPath ? resolve32(rootDir, gemfileDir, gemspecPath) : resolve32(rootDir, gemfileDir);
+  if (!existsSync14(searchDir)) return ctx;
+  let gemspecFiles = [];
+  try {
+    const entries = readdirSync4(searchDir);
+    gemspecFiles = entries.filter((entry) => {
+      if (!entry.endsWith(".gemspec")) return false;
+      if (gemspecName && entry !== `${gemspecName}.gemspec`) return false;
+      return true;
+    });
+  } catch (e) {
+    logger.warn(`Failed to read directory ${searchDir}: ${e}`);
+    return ctx;
+  }
+  if (gemspecFiles.length === 0) return ctx;
+  const gemspecFile = gemspecFiles[0];
+  const gemspecFullPath = resolve32(searchDir, gemspecFile);
+  const gemspecRelativePath = relative12(rootDir, gemspecFullPath);
+  try {
+    const sourceText = readFileSync3(gemspecFullPath, "utf-8");
+    const gemspec = parseGemspec(rootDir, gemspecRelativePath, sourceText);
+    ctx.gemspecs.push(gemspec);
+    ctx.gems.push(...gemspec.dependencies);
+    ctx.gems.push(...gemspec.devDependencies);
+  } catch (e) {
+    logger.warn(`Failed to parse gemspec ${gemspecRelativePath}: ${e}`);
+  }
+  return ctx;
+});
+var treeQuery4 = import_good_enough_parser4.query.tree({
   type: "root-tree",
-  search: import_good_enough_parser3.query.alt(variableAssignmentQuery, gemQuery, evalGemfileQuery)
+  search: import_good_enough_parser4.query.alt(variableAssignmentQuery2, gemQuery, evalGemfileQuery, gemspecQuery)
 });
 function parseGemfile(rootDir, file, sourceText) {
   const gemfile = { rootDir, file, sourceText };
-  const ctx = { gemfile, gems: [], mem: /* @__PURE__ */ new Map(), depth: 0 };
-  const parser2 = import_good_enough_parser3.lang.createLang(lang3);
+  const ctx = { gemfile, gems: [], gemspecs: [], mem: /* @__PURE__ */ new Map(), depth: 0 };
+  const parser2 = import_good_enough_parser4.lang.createLang(lang3);
   const cursor = parser2.parse(sourceText);
-  const result = parser2.query(cursor, treeQuery3, ctx);
+  const result = parser2.query(cursor, treeQuery4, ctx);
   const gems = result ? result.gems : [];
+  const gemspecs = result ? result.gemspecs : [];
   return {
     rootDir,
     file,
     sourceText,
-    gems
+    gems,
+    gemspecs
   };
 }
 function evaluate4(v) {
@@ -225961,10 +226196,12 @@ function parseGemfileLock(content) {
   const gems = /* @__PURE__ */ new Map();
   const plugins = /* @__PURE__ */ new Map();
   const directDependencies = /* @__PURE__ */ new Set();
+  const pathDependencies = /* @__PURE__ */ new Map();
   const lines = content.split("\n");
   let currentSection = null;
   let inSpecsSubsection = false;
   let gemSpecIndentLevel = null;
+  let currentPathGem = null;
   for (let i7 = 0; i7 < lines.length; i7++) {
     const line = lines[i7];
     if (line.length > 0 && !line.startsWith(" ")) {
@@ -226020,6 +226257,16 @@ function parseGemfileLock(content) {
               offset: lineOffset + line.indexOf("(") + 1
             });
           }
+          if (currentSection === "PATH") {
+            currentPathGem = name;
+            if (!pathDependencies.has(name)) {
+              pathDependencies.set(name, /* @__PURE__ */ new Set());
+            }
+          }
+        } else if (currentIndent > gemSpecIndentLevel) {
+          if (currentSection === "PATH" && currentPathGem) {
+            pathDependencies.get(currentPathGem)?.add(name);
+          }
         }
       }
     } else if (currentSection === "DEPENDENCIES") {
@@ -226030,7 +226277,7 @@ function parseGemfileLock(content) {
       }
     }
   }
-  return { gits, paths, gems, plugins, directDependencies };
+  return { gits, paths, gems, plugins, directDependencies, pathDependencies };
 }
 
 // ../fixing-management/src/fixing-management/rubygems/rubygems-socket-upgrade-manager.ts
@@ -226249,20 +226496,38 @@ var RubygemsSocketUpgradeManager = class {
           if (ctxt.wsFilter && !ctxt.wsFilter(dirname18(mf.file) || ".")) continue;
           const lockfileContent = await readFile27(resolve33(this.rootDir, mf.file), "utf-8");
           const gemfileLock = parseGemfileLock(lockfileContent);
-          if (!gemfileLock.gems.has(artifact.name)) {
+          const pathGems = [];
+          for (const [pathGemName, deps] of gemfileLock.pathDependencies) {
+            if (deps.has(artifact.name)) {
+              pathGems.push(pathGemName);
+            }
+          }
+          const isInGemSection = gemfileLock.gems.has(artifact.name);
+          if (!isInGemSection && pathGems.length === 0) {
             ctxt.statusUpdater?.({
               status: "error",
               file: mf.file,
               artifacts: [idx],
-              message: "Gem not found in GEM section of lockfile -- other sources are not supported."
+              message: "Gem not found in GEM section or PATH dependencies of lockfile -- other sources are not supported."
             });
             continue;
           }
           const gemfileName = relative13(this.rootDir, resolve33(this.rootDir, dirname18(mf.file), "Gemfile"));
-          gemfileToLockfile.set(resolve33(this.rootDir, gemfileName), resolve33(this.rootDir, mf.file));
-          if (gemfileLock.directDependencies.has(artifact.name)) {
+          gemfileToLockfile.set(gemfileName, mf.file);
+          if (pathGems.length > 0) {
+            const { gemspecPatches, gemfilePatches } = await this.handleGemspecDependency(
+              gemfileName,
+              pathGems,
+              artifact.name,
+              idx,
+              upgradeVersion,
+              ctxt
+            );
+            directPatches.push(...gemspecPatches);
+            transitivePatches.push(...gemfilePatches);
+          } else if (gemfileLock.directDependencies.has(artifact.name) && isInGemSection) {
             directPatches.push(...await this.handleGemfile(gemfileName, idx, upgradeVersion, ctxt));
-          } else {
+          } else if (!gemfileLock.directDependencies.has(artifact.name)) {
             transitivePatches.push(await this.createAddGemPatch(gemfileName, idx, upgradeVersion, ctxt));
           }
         } else {
@@ -226298,7 +226563,7 @@ var RubygemsSocketUpgradeManager = class {
     );
     const lockfileToArtifacts = {};
     for (const { file, artifacts } of appliedTemporaryPatches) {
-      const lockfile2 = gemfileToLockfile.get(resolve33(this.rootDir, file));
+      const lockfile2 = gemfileToLockfile.get(file);
       if (lockfile2 !== void 0) (lockfileToArtifacts[lockfile2] ??= []).push(...artifacts);
     }
     await asyncForEach(Object.entries(lockfileToArtifacts), async ([file, artifacts]) => {
@@ -226363,6 +226628,92 @@ var RubygemsSocketUpgradeManager = class {
       }
     });
   }
+  /**
+   * Handle gemspec file updates for PATH dependencies
+   * Returns { gemspecPatches, gemfilePatches }
+   * gemspecPatches: patches to gemspec files (should be in directPatches - re-applied after restore)
+   * gemfilePatches: temporary patches to Gemfile (should be in transitivePatches - not re-applied)
+   */
+  async handleGemspecDependency(gemfilePath, pathGemNames, dependencyName, idx, upgradeVersion, ctxt) {
+    const gemspecPatches = [];
+    const gemfilePatches = [];
+    const artifact = ctxt.artifacts[idx];
+    try {
+      const gemfileContent = await readFile27(resolve33(this.rootDir, gemfilePath), "utf-8");
+      const gemfile = parseGemfile(this.rootDir, gemfilePath, gemfileContent);
+      const gemspecFiles = /* @__PURE__ */ new Set();
+      for (const gem of gemfile.gems) {
+        if (gem.gemfile.file !== gemfilePath && gem.gemfile.file.endsWith(".gemspec")) {
+          gemspecFiles.add(gem.gemfile.file);
+        }
+      }
+      if (gemspecFiles.size === 0) {
+        ctxt.statusUpdater?.({
+          status: "error",
+          file: gemfilePath,
+          artifacts: [idx],
+          message: `Could not find gemspec file for PATH gem(s): ${pathGemNames.join(", ")}. Make sure the Gemfile has a 'gemspec' directive.`
+        });
+        gemfilePatches.push(await this.createAddGemPatch(gemfilePath, idx, upgradeVersion, ctxt));
+        return { gemspecPatches, gemfilePatches };
+      }
+      let foundInGemspec = false;
+      for (const gemspecFile of gemspecFiles) {
+        try {
+          const gemspecContent = await readFile27(resolve33(this.rootDir, gemspecFile), "utf-8");
+          const { parseGemspec: parseGemspec2 } = await Promise.resolve().then(() => (init_gemspec_utils(), gemspec_utils_exports));
+          const gemspec = parseGemspec2(this.rootDir, gemspecFile, gemspecContent);
+          for (const gem of gemspec.dependencies) {
+            if (evaluate4(gem.name) === dependencyName) {
+              foundInGemspec = true;
+              const [version3] = artifact.version.split("-");
+              const versionSpecs = gem.specs.filter((spec) => spec.type === "version");
+              const evaluatedSpecOpts = versionSpecs.map((spec) => evaluate4(spec.value));
+              if (evaluatedSpecOpts.includes(void 0)) {
+                ctxt.statusUpdater?.({
+                  status: "error",
+                  file: gemspecFile,
+                  artifacts: [idx],
+                  message: `Failed to evaluate version constraint in gemspec`
+                });
+                continue;
+              }
+              const evaluatedSpecs = evaluatedSpecOpts.filter((spec) => spec !== void 0);
+              if (rubygemsVersionSatisfiesConstraints(version3, evaluatedSpecs)) {
+                gemspecPatches.push(
+                  ...createRubygemVersionPatches(gem, idx, upgradeVersion, ctxt.rangeStyle, ctxt.statusUpdater)
+                );
+              }
+            }
+          }
+        } catch (error) {
+          ctxt.statusUpdater?.({
+            status: "error",
+            file: gemspecFile,
+            artifacts: [idx],
+            message: `Failed to parse gemspec: ${error instanceof Error ? error.message : String(error)}`
+          });
+        }
+      }
+      if (!foundInGemspec) {
+        ctxt.statusUpdater?.({
+          status: "error",
+          file: gemfilePath,
+          artifacts: [idx],
+          message: `Could not find ${dependencyName} in any gemspec file`
+        });
+      }
+      gemfilePatches.push(await this.createAddGemPatch(gemfilePath, idx, upgradeVersion, ctxt));
+    } catch (error) {
+      ctxt.statusUpdater?.({
+        status: "error",
+        file: gemfilePath,
+        artifacts: [idx],
+        message: `Failed to handle gemspec dependency: ${error instanceof Error ? error.message : String(error)}`
+      });
+    }
+    return { gemspecPatches, gemfilePatches };
+  }
   /**
    * Handle Gemfile updates for direct dependencies
    */
@@ -229593,6 +229944,7 @@ async function fetchArtifactsFromSocket(rootWorkingDirectory, manifestsTarHash,
           for (const vuln of artifact.vulnerabilities) {
             const vulnerability = {
               url: vuln.ghsaId,
+              severity: vuln.severity,
               purlType: artifact.type,
               range: vuln.range,
               name: artifact.name ?? "",
@@ -230538,6 +230890,9 @@ function toSocketReachabilitySchema(vulnerability) {
   if (codeAwareScanResult.type === "noAnalysisCheck") {
     return { type: "undeterminable_reachability" };
   }
+  if (codeAwareScanResult.type === "unknown") {
+    return { type: "unknown", reason: codeAwareScanResult.message ?? "Unknown reason" };
+  }
   if (codeAwareScanResult.type === "analysisError") {
     return { type: "error", error: codeAwareScanResult.message };
   }
@@ -244128,7 +244483,7 @@ var { root: root2 } = static_exports;
 
 // ../utils/src/maven-utils.ts
 var import_lodash14 = __toESM(require_lodash(), 1);
-import { existsSync as existsSync22, readdirSync as readdirSync4, statSync as statSync3 } from "fs";
+import { existsSync as existsSync22, readdirSync as readdirSync5, statSync as statSync3 } from "fs";
 import { join as join25 } from "path";
 
 // ../utils/src/download-utils.ts
@@ -245500,10 +245855,20 @@ async function onlineScan(dependencyTree, apiKey, timeout) {
 }
 
 // dist/version.js
-var version2 = "14.12.69";
+var version2 = "14.12.71";
 
 // dist/cli-core.js
 var { mapValues, omit, partition, pick } = import_lodash15.default;
+var SEVERITY_ORDER = {
+  INFO: 0,
+  LOW: 1,
+  MODERATE: 2,
+  HIGH: 3,
+  CRITICAL: 4
+};
+function shouldAnalyzeBasedOnSeverity(vulnSeverity, minSeverity) {
+  return SEVERITY_ORDER[vulnSeverity] >= SEVERITY_ORDER[minSeverity];
+}
 var CliCore = class {
   options;
   spinner;
@@ -245957,13 +246322,28 @@ Subproject: ${subproject}`);
       const vulnerabilities = workspaceToVulnerabilities[workspacePath] ?? [];
       try {
         const dataForAnalysis = workspacePathToDataForAnalysis[workspacePath];
-        const augmentedVulnerabilities = reachabilitySupported && !this.shouldExcludeAnalyzingWorkspace(subprojectPath, workspacePath) ? await this.runReachabilityAnalysis(otherModulesCommunicator, subprojectPath, workspacePath, dataForAnalysis, ecosystem, vulnerabilities) : vulnerabilities.map((v) => ({
+        const [vulnerabilitiesToAnalyze, vulnerabilitiesBelowThreshold] = this.options.minSeverity ? partition(vulnerabilities, (v) => !v.severity || shouldAnalyzeBasedOnSeverity(v.severity, this.options.minSeverity)) : [vulnerabilities, []];
+        const vulnerabilitiesBelowThresholdWithResults = vulnerabilitiesBelowThreshold.map((v) => ({
+          ...v,
+          results: {
+            type: "unknown",
+            message: `Reachability analysis not run since the severity of the vulnerability (${v.severity}) is lower than the min severity threshold: ${this.options.minSeverity}`
+          }
+        }));
+        if (vulnerabilitiesBelowThreshold.length > 0) {
+          logger.info(`Reachability analysis not run for ${vulnerabilitiesBelowThreshold.length} vulnerabilities with severity level ${this.options.minSeverity} in workspace ${workspacePath}`);
+        }
+        const augmentedVulnerabilitiesToAnalyze = reachabilitySupported && !this.shouldExcludeAnalyzingWorkspace(subprojectPath, workspacePath) ? await this.runReachabilityAnalysis(otherModulesCommunicator, subprojectPath, workspacePath, dataForAnalysis, ecosystem, vulnerabilitiesToAnalyze) : vulnerabilitiesToAnalyze.map((v) => ({
           ...v,
           results: {
             type: "otherError",
             message: `Reachability analysis for languages using ${ecosystem} not supported yet`
           }
         }));
+        const augmentedVulnerabilities = [
+          ...augmentedVulnerabilitiesToAnalyze,
+          ...vulnerabilitiesBelowThresholdWithResults
+        ];
         return [workspacePath, augmentedVulnerabilities];
       } catch (e) {
         logger.error(`Reachability analysis failed for workspace ${workspacePath} in subproject ${subprojectPath}: ${e.message}`);
@@ -246214,9 +246594,10 @@ async function getGitDataToMetadataIfAvailable(rootWorkingDirectory) {
 // dist/index.js
 var program2 = new Command();
 var run2 = new Command();
-run2.name("run").argument("<path>", "File system path to folder containing the project").option("-o, --output-dir <path>", "Write json report to <path>/coana-report.json").option("-d, --debug", "Enable debug logging", false).option("-s, --silent", "Silence all debug/warning output", false).option("--silent-spinner", "Silence spinner", "CI" in process.env || !process.stdin.isTTY).option("-p, --print-report", "Print the report to the console", false).option("--offline-database <path>", "Path to a coana-offline-db.json file for running the CLI without internet connectivity", void 0).option("-t, --timeout <timeout>", "Set API <timeout> in milliseconds to Coana backend.", "300000").option("-a, --analysis-timeout <timeout>", "Set <timeout> in seconds for each reachability analysis run").option("--memory-limit <memoryInMB>", "Set memory limit for analysis to <memoryInMB> megabytes of memory.", "8192").option("-c, --concurrency <concurrency>", "Set the maximum number of concurrent reachability analysis runs. It's recommended to choose a concurrency level that ensures that each analysis run has at least the --memory-limit amount of memory available.", "1").option("--api-key <key>", "Set the Coana dashboard API key. By setting you also enable the dashboard integration.").addOption(new Option("--write-report-to-file", "Write the report dashboard-compatible report to dashboard-report.json. This report may help the Coana team debug issues with the report insertion mechanism.").default(false).hideHelp()).option("--project-name <repoName>", "Set the name of the repository. Used for dashboard integration.").option("--repo-url <repoUrl>", "Set the URL of the repository. Used for dashboard integration.").option("--include-dirs <relativeDirs...>", "globs for directories to include from the detection of subprojects (space-separated)(use relative paths from the project root). Notice, projects that are not included may still be scanned if they are referenced from included projects.").option("--exclude-dirs <relativeDirs...>", "globs for directories to exclude from the detection of subprojects (space-separated)(use relative paths from the project root). Notice, excluded projects may still be scanned if they are referenced from non-excluded projects.").option("--disable-analysis-splitting", "Limits Coana to at most 1 reachability analysis run per workspace").option("--print-analysis-log-file", "Store log output from the JavaScript/TypeScript reachability analysis in the file js-analysis.log file in the root of each workspace", false).option("--entry-points <entryPoints...>", "List of files to analyze for root workspace. The reachability analysis automatically analyzes all files used by the entry points. If not provided, all JavaScript and TypeScript files are considered entry points. For non-root workspaces, all JavaScript and TypeScript files are analyzed as well.").option("--include-projects-with-no-reachability-support", "Also runs Coana on projects where we support traditional SCA, but does not yet support reachability analysis.", false).option("--ecosystems <ecosystems...>", "List of ecosystems to analyze (space-separated). Currently NPM, PIP, MAVEN, NUGET and GO are supported. Default is all supported ecosystems.").addOption(new Option("--purl-types <purlTypes...>", "List of PURL types to analyze (space-separated). Currently npm, pypi, maven, nuget, golang and cargo are supported. Default is all supported purl types.").hideHelp()).option("--changed-files <files...>", "List of files that have changed. If provided, Coana only analyzes workspaces and modules that contain changed files.").option("--disable-report-submission", "Disable the submission of the report to the Coana dashboard. Used by the pipeline blocking feature.", false).option("--disable-analytics-sharing", "Disable analytics sharing.", false).option("--provider-project <path>", "File system path to folder containing the provider project (Only supported for Maven, Gradle, and SBT)").option("--provider-workspaces <dirs...>", "List of workspaces that build the provided runtime environment (Only supported for Maven, Gradle, and SBT)", (paths) => paths.split(" ")).option("--lightweight-reachability", "Runs Coana in lightweight mode. This increases analysis speed but also raises the risk of Coana misclassifying the reachability of certain complex vulnerabilities. Recommended only for use with Coana Guardrail mode.", false).addOption(new Option("--run-without-docker", "Run package managers and reachability analyzers without using docker").default(process.env.RUN_WITHOUT_DOCKER === "true").hideHelp()).addOption(new Option("--run-env <env>", "Specifies the environment in which the CLI is run. So far only MANAGED_SCAN and UNKNOWN are supported.").default("UNKNOWN").choices(["UNKNOWN", "MANAGED_SCAN"]).hideHelp()).addOption(new Option("--guardrail-mode", "Run Coana in guardrail mode. This mode is used to prevent new reachable vulnerabilities from being introduced into the codebase. Usually run as a CI check when pushing new commits to a pull request.")).option("--ignore-failing-workspaces", "Continue processing when a workspace fails instead of exiting. Failed workspaces will be logged at termination.", false).addOption(new Option("--socket-mode <output-file>", "Run Coana in socket mode and write report to <output-file>").hideHelp()).addOption(new Option("--manifests-tar-hash <hash>", "Hash of the tarball containing all manifest files already uploaded to Socket. If provided, Socket will be used for computing dependency trees.").hideHelp()).option("--skip-cache-usage", "Do not attempt to use cached analysis configuration from previous runs", false).version(version2).configureHelp({ sortOptions: true }).action(async (path2, options) => {
+run2.name("run").argument("<path>", "File system path to folder containing the project").option("-o, --output-dir <path>", "Write json report to <path>/coana-report.json").option("-d, --debug", "Enable debug logging", false).option("-s, --silent", "Silence all debug/warning output", false).option("--silent-spinner", "Silence spinner", "CI" in process.env || !process.stdin.isTTY).option("-p, --print-report", "Print the report to the console", false).option("--offline-database <path>", "Path to a coana-offline-db.json file for running the CLI without internet connectivity", void 0).option("-t, --timeout <timeout>", "Set API <timeout> in milliseconds to Coana backend.", "300000").option("-a, --analysis-timeout <timeout>", "Set <timeout> in seconds for each reachability analysis run").option("--memory-limit <memoryInMB>", "Set memory limit for analysis to <memoryInMB> megabytes of memory.", "8192").option("-c, --concurrency <concurrency>", "Set the maximum number of concurrent reachability analysis runs. It's recommended to choose a concurrency level that ensures that each analysis run has at least the --memory-limit amount of memory available.", "1").option("--api-key <key>", "Set the Coana dashboard API key. By setting you also enable the dashboard integration.").addOption(new Option("--write-report-to-file", "Write the report dashboard-compatible report to dashboard-report.json. This report may help the Coana team debug issues with the report insertion mechanism.").default(false).hideHelp()).option("--project-name <repoName>", "Set the name of the repository. Used for dashboard integration.").option("--repo-url <repoUrl>", "Set the URL of the repository. Used for dashboard integration.").option("--include-dirs <relativeDirs...>", "globs for directories to include from the detection of subprojects (space-separated)(use relative paths from the project root). Notice, projects that are not included may still be scanned if they are referenced from included projects.").option("--exclude-dirs <relativeDirs...>", "globs for directories to exclude from the detection of subprojects (space-separated)(use relative paths from the project root). Notice, excluded projects may still be scanned if they are referenced from non-excluded projects.").option("--disable-analysis-splitting", "Limits Coana to at most 1 reachability analysis run per workspace").option("--print-analysis-log-file", "Store log output from the JavaScript/TypeScript reachability analysis in the file js-analysis.log file in the root of each workspace", false).option("--entry-points <entryPoints...>", "List of files to analyze for root workspace. The reachability analysis automatically analyzes all files used by the entry points. If not provided, all JavaScript and TypeScript files are considered entry points. For non-root workspaces, all JavaScript and TypeScript files are analyzed as well.").option("--include-projects-with-no-reachability-support", "Also runs Coana on projects where we support traditional SCA, but does not yet support reachability analysis.", false).option("--ecosystems <ecosystems...>", "List of ecosystems to analyze (space-separated). Currently NPM, PIP, MAVEN, NUGET and GO are supported. Default is all supported ecosystems.").addOption(new Option("--purl-types <purlTypes...>", "List of PURL types to analyze (space-separated). Currently npm, pypi, maven, nuget, golang and cargo are supported. Default is all supported purl types.").hideHelp()).option("--changed-files <files...>", "List of files that have changed. If provided, Coana only analyzes workspaces and modules that contain changed files.").option("--disable-report-submission", "Disable the submission of the report to the Coana dashboard. Used by the pipeline blocking feature.", false).option("--disable-analytics-sharing", "Disable analytics sharing.", false).option("--provider-project <path>", "File system path to folder containing the provider project (Only supported for Maven, Gradle, and SBT)").option("--provider-workspaces <dirs...>", "List of workspaces that build the provided runtime environment (Only supported for Maven, Gradle, and SBT)", (paths) => paths.split(" ")).option("--lightweight-reachability", "Runs Coana in lightweight mode. This increases analysis speed but also raises the risk of Coana misclassifying the reachability of certain complex vulnerabilities. Recommended only for use with Coana Guardrail mode.", false).addOption(new Option("--run-without-docker", "Run package managers and reachability analyzers without using docker").default(process.env.RUN_WITHOUT_DOCKER === "true").hideHelp()).addOption(new Option("--run-env <env>", "Specifies the environment in which the CLI is run. So far only MANAGED_SCAN and UNKNOWN are supported.").default("UNKNOWN").choices(["UNKNOWN", "MANAGED_SCAN"]).hideHelp()).addOption(new Option("--guardrail-mode", "Run Coana in guardrail mode. This mode is used to prevent new reachable vulnerabilities from being introduced into the codebase. Usually run as a CI check when pushing new commits to a pull request.")).option("--ignore-failing-workspaces", "Continue processing when a workspace fails instead of exiting. Failed workspaces will be logged at termination.", false).addOption(new Option("--socket-mode <output-file>", "Run Coana in socket mode and write report to <output-file>").hideHelp()).addOption(new Option("--manifests-tar-hash <hash>", "Hash of the tarball containing all manifest files already uploaded to Socket. If provided, Socket will be used for computing dependency trees.").hideHelp()).option("--skip-cache-usage", "Do not attempt to use cached analysis configuration from previous runs", false).addOption(new Option("--min-severity <severity>", "Set the minimum severity of vulnerabilities to analyze. Supported severities are info, low, moderate, high and critical.").choices(["info", "INFO", "low", "LOW", "moderate", "MODERATE", "high", "HIGH", "critical", "CRITICAL"])).version(version2).configureHelp({ sortOptions: true }).action(async (path2, options) => {
   process.env.DOCKER_IMAGE_TAG ??= version2;
   options.ecosystems = options.ecosystems?.map((e) => e.toUpperCase());
+  options.minSeverity = options.minSeverity?.toUpperCase();
   options.purlTypes = options.purlTypes?.map((e) => e.toLowerCase());
   await new CliCore(path2, options).main();
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coana-tech/cli",
-  "version": "14.12.69",
+  "version": "14.12.71",
   "description": "Coana CLI",
   "type": "module",
   "bin": {

package/repos/coana-tech/class-graph-analysis/dist/bundle/class-graph-analysis-cli.mjs

@@ -14150,7 +14150,7 @@ var SourceResolutionManager = class {
       for (const sourceDir of src ?? []) {
         const isDirectory = (await stat(sourceDir)).isDirectory();
         const baseDir = isDirectory ? sourceDir : "";
-        const files = isDirectory ? await glob(this.include ?? "**", { cwd: sourceDir, ignore: this.exclude, nodir: true }) : [sourceDir];
+        const files = isDirectory ? await glob(this.include, { cwd: sourceDir, ignore: this.exclude, nodir: true }) : [sourceDir];
         for (const file of files) {
           promiseFns.push(async () => {
             const resolver = this.resolverCb(file);
@@ -14174,7 +14174,7 @@ var SourceResolutionManager = class {
       for (const sourceDir of src ?? []) {
         const isDirectory = (await stat(sourceDir)).isDirectory();
         const baseDir = isDirectory ? sourceDir : ".";
-        const files = isDirectory ? await glob(this.include ?? "**", { cwd: sourceDir, ignore: this.exclude, nodir: true }) : [sourceDir];
+        const files = isDirectory ? await glob(this.include, { cwd: sourceDir, ignore: this.exclude, nodir: true }) : [sourceDir];
         for (const file of files) {
           promiseFns.push(async () => {
             const resolver = this.resolverCb(file);
@@ -14537,7 +14537,7 @@ async function createJvmResolverCallback(resources) {
 async function runJvmDirectDependencyAnalysis(options, resources) {
   const resolverCb = await createJvmResolverCallback(resources);
   const runner = new ClassGraphRunner({
-    srcResolutionManager: new SourceResolutionManager(resolverCb, new JvmResolutionContextProvider()),
+    srcResolutionManager: new SourceResolutionManager(resolverCb, new JvmResolutionContextProvider(), "**", void 0),
     binResolutionManager: resources.alucard ? new AlucardResolutionManager(resources.alucard, options.timeoutInSeconds) : void 0,
     ...options
   });
@@ -14546,7 +14546,7 @@ async function runJvmDirectDependencyAnalysis(options, resources) {
 async function runJvmReachabilityAnalysis(options, resources) {
   const resolverCb = await createJvmResolverCallback(resources);
   const runner = new ClassGraphRunner({
-    srcResolutionManager: new SourceResolutionManager(resolverCb, new JvmResolutionContextProvider()),
+    srcResolutionManager: new SourceResolutionManager(resolverCb, new JvmResolutionContextProvider(), "**", void 0),
     binResolutionManager: resources.alucard ? new AlucardResolutionManager(resources.alucard, options.timeoutInSeconds) : void 0,
     apps: options.apps,
     deps: options.deps,
@@ -24253,9 +24253,8 @@ async function createDotnetResolverCallback(resources) {
 }
 async function runDotnetDirectDependencyAnalysis(options, resources) {
   const resolverCb = await createDotnetResolverCallback(resources);
-  const srcExcludeDirs = ["bin", "obj"];
   const runner = new ClassGraphRunner({
-    srcResolutionManager: new SourceResolutionManager(resolverCb, new DotnetResolutionContextProvider(), srcExcludeDirs),
+    srcResolutionManager: new SourceResolutionManager(resolverCb, new DotnetResolutionContextProvider(), "**", "{**/,}{bin,obj}/**"),
     binResolutionManager: resources.cocoa ? new CocoaResolutionManager(resources.cocoa, options.timeoutInSeconds) : void 0,
     ...options
   });
@@ -24263,9 +24262,8 @@ async function runDotnetDirectDependencyAnalysis(options, resources) {
 }
 async function runDotnetReachabilityAnalysis(options, resources) {
   const resolverCb = await createDotnetResolverCallback(resources);
-  const srcExcludeDirs = ["{**/,}bin/**", "{**/,}obj/**"];
   const runner = new ClassGraphRunner({
-    srcResolutionManager: new SourceResolutionManager(resolverCb, new DotnetResolutionContextProvider(), srcExcludeDirs),
+    srcResolutionManager: new SourceResolutionManager(resolverCb, new DotnetResolutionContextProvider(), "**", "{**/,}{bin,obj}/**"),
     binResolutionManager: resources.cocoa ? new CocoaResolutionManager(resources.cocoa, options.timeoutInSeconds) : void 0,
     apps: options.apps,
     deps: options.deps,
@@ -26252,16 +26250,15 @@ async function createRustResolverCallback(resources) {
 async function runRustDirectDependencyAnalysis(options, resources = {}) {
   const resolverCb = await createRustResolverCallback(resources);
   const runner = new ClassGraphRunner({
-    srcResolutionManager: new SourceResolutionManager(resolverCb, new RustResolutionContextProvider()),
+    srcResolutionManager: new SourceResolutionManager(resolverCb, new RustResolutionContextProvider(), "**", "{**/,}bin/**"),
     ...options
   });
   return await runner.runDirectDependencyAnalysis();
 }
 async function runRustReachabilityAnalysis(options, resources = {}) {
   const resolverCb = await createRustResolverCallback(resources);
-  const srcExcludeDirs = ["bin"];
   const runner = new ClassGraphRunner({
-    srcResolutionManager: new SourceResolutionManager(resolverCb, new RustResolutionContextProvider(), srcExcludeDirs),
+    srcResolutionManager: new SourceResolutionManager(resolverCb, new RustResolutionContextProvider(), "**", "{**/,}bin/**"),
     apps: options.apps,
     deps: options.deps,
     timeoutInSeconds: options.timeoutInSeconds