@coana-tech/cli 14.9.22 → 14.9.24

package/cli.mjs

@@ -212320,7 +212320,7 @@ async function onlineScan(dependencyTree, apiKey, timeout) {
 }
 
 // dist/version.js
-var version2 = "14.9.22";
+var version2 = "14.9.24";
 
 // ../../node_modules/.pnpm/axios@1.9.0/node_modules/axios/lib/helpers/bind.js
 function bind2(fn2, thisArg) {
@@ -215646,14 +215646,20 @@ async function scanForVulnerabilitiesSocketMode(dependencyTree) {
     const data2 = {
       components: Object.keys(purlStringsToIdentifier).map((purl) => ({ purl }))
     };
-    const componentsString = (await axios_default2.post(url3, data2, {
+    const componentsResponse = (await axios_default2.post(url3, data2, {
       headers: {
         "Content-Type": "application/json",
         Accept: "application/json",
         Authorization: `Basic ${btoa(`${process.env.SOCKET_CLI_API_TOKEN}:`)}`
       }
     })).data;
-    components = JSON.parse(`[${componentsString.trim().replace(/\n/g, ",")}]`);
+    if (typeof componentsResponse === "object") {
+      components = [componentsResponse];
+    } else if (typeof componentsResponse === "string") {
+      components = JSON.parse(`[${componentsResponse.trim().replace(/\n/g, ",")}]`);
+    } else {
+      throw new Error(`Unexpected response type from Socket API: ${typeof componentsResponse}`);
+    }
   } catch (e) {
     logger.error("Failed to scan for vulnerabilities in socket mode");
     logger.error("error", e);
@@ -215812,11 +215818,11 @@ function getNamespaceAndName(ecosystem, packageName) {
 }
 
 // dist/internal/socket-report.js
-function toSocketFacts(report, dependencyTrees) {
+function toSocketFacts(report, dependencyTrees, subPjToWsPathToDirectDependencies) {
   const components = [];
   const purlToIndex = /* @__PURE__ */ new Map();
   for (const dependencyTree of dependencyTrees) {
-    const depIdentifierToPurl = Object.fromEntries(Object.entries(dependencyTree.dependencyTree.transitiveDependencies).map(([depIdentifier, dep]) => {
+    const depIdentifierToPurl = Object.fromEntries(Object.entries(dependencyTree.dependencyTree.transitiveDependencies).filter(([_depIdentifier, dep]) => dep.purlObj).map(([depIdentifier, dep]) => {
       const purl = dep.purlObj.purlString;
       if (purl && !purlToIndex.has(purl)) {
         purlToIndex.set(purl, components.length);
@@ -215831,8 +215837,10 @@ function toSocketFacts(report, dependencyTrees) {
           artifact_id: depTreeNode.purlObj.artifact_id,
           artifactId: depTreeNode.purlObj.artifactId,
           qualifiers: depTreeNode.purlObj.qualifiers,
-          // direct: false, // TODO: add direct flag
-          // dev: false, // TODO: add dev flag
+          direct: false,
+          // Use false as default, and set to true if actually direct
+          dev: true,
+          // Use true as default, and set to false if the artifact is found as prod, prod&dev or missing for any dependency chain.
           dependencies: []
         };
       }
@@ -215840,15 +215848,40 @@ function toSocketFacts(report, dependencyTrees) {
     }));
     for (const [depIdentifier, purl] of Object.entries(depIdentifierToPurl)) {
       const depTreeNode = dependencyTree.dependencyTree.transitiveDependencies[depIdentifier];
+      if (!depTreeNode.purlObj) {
+        continue;
+      }
       const component = components[purlToIndex.get(purl)];
       depTreeNode.dependencies?.forEach((dep) => {
         const depPurl = depIdentifierToPurl[dep];
         const depIndex = purlToIndex.get(depPurl);
-        if (!component.dependencies?.includes(depIndex.toString())) {
+        if (depIndex && !component.dependencies?.includes(depIndex.toString())) {
           component.dependencies.push(depIndex.toString());
         }
       });
     }
+    for (const depIdentifier of dependencyTree.dependencyTree.dependencies ?? []) {
+      const depTreeNode = dependencyTree.dependencyTree.transitiveDependencies[depIdentifier];
+      const component = components[purlToIndex.get(depTreeNode.purlObj.purlString)];
+      component.direct = true;
+    }
+    for (const depIdentifier of dependencyTree.dependencyTree.dependencies ?? []) {
+      let updateDependencyType2 = function(id) {
+        if (visitedIds.has(id.toString()))
+          return;
+        visitedIds.add(id.toString());
+        const component = components[id];
+        if (dependencyType !== "dev") {
+          component.dev = false;
+        }
+        component.dependencies?.forEach((depId) => updateDependencyType2(parseInt(depId)));
+      };
+      var updateDependencyType = updateDependencyType2;
+      const depTreeNode = dependencyTree.dependencyTree.transitiveDependencies[depIdentifier];
+      const dependencyType = subPjToWsPathToDirectDependencies[dependencyTree.subprojectPath][dependencyTree.workspacePath][depTreeNode.packageName];
+      const visitedIds = /* @__PURE__ */ new Set();
+      updateDependencyType2(purlToIndex.get(depTreeNode.purlObj.purlString));
+    }
   }
   for (const vulnerability of report.vulnerabilities) {
     const component = components[purlToIndex.get(vulnerability.purl)];
@@ -216015,9 +216048,9 @@ var CliCore = class {
         const gitData = await getGitDataToMetadataIfAvailable(this.rootWorkingDirectory);
         this.reportId = await createReport(this.options.repoUrl, this.options.projectName, version2, gitData?.sha, gitData?.branchName, omit(this.options, "apiKey", "print-report", "repoUrl", "projectName", "writeReportToFile"), this.apiKey, this.options.runEnv);
       }
-      const report = await this.computeReport();
+      const { report, subPjToWsPathToDirectDependencies } = await this.computeReport();
       logger.info("Report computed successfully");
-      await this.outputAndShareReport(report);
+      await this.outputAndShareReport(report, subPjToWsPathToDirectDependencies);
       this.spinner.stop();
       return report;
     } catch (e) {
@@ -216046,13 +216079,13 @@ var CliCore = class {
     if (this.reportId)
       await sendLogToDashboard(await this.getLogContent(), this.reportId, this.apiKey);
   }
-  async outputAndShareReport(report) {
+  async outputAndShareReport(report, subPjToWsPathToDirectDependencies) {
     const outputDir = this.options.outputDir;
     if (this.options.socketMode) {
       if (!this.reportDependencyTrees) {
         throw new Error("Dependency trees should be available when using --socket-mode");
       }
-      const socketReport = toSocketFacts(report, this.reportDependencyTrees);
+      const socketReport = toSocketFacts(report, this.reportDependencyTrees, subPjToWsPathToDirectDependencies);
       const outputFile = resolve24(this.options.socketMode);
       await writeFile10(outputFile, JSON.stringify(socketReport, null, 2));
       logger.info(kleur_default.green(`Socket report written to: ${outputFile}`));
@@ -216140,7 +216173,16 @@ var CliCore = class {
       vulnerabilities: allVulnerabilities,
       ...await this.createMetadataForReport(startTime)
     };
-    return report;
+    const reportAndSubPjToWsPathToDirectDependencies = {
+      report,
+      subPjToWsPathToDirectDependencies: workspacesOutput.reduce((acc, { subprojectPath, workspacePath, directDependencies }) => {
+        if (!acc[subprojectPath])
+          acc[subprojectPath] = {};
+        acc[subprojectPath][workspacePath] = directDependencies;
+        return acc;
+      }, {})
+    };
+    return reportAndSubPjToWsPathToDirectDependencies;
   }
   async updateSpinnerTextOnNewSubproject(subprojectAndWsPath, numberSubprojects, index2) {
     this.spinner.start();
@@ -216293,8 +216335,6 @@ var CliCore = class {
           ];
         } catch (e) {
           logger.error(`Scanning for vulnerabilities failed for subproject ${subprojectPath} in workspace ${workspacePath}`);
-          logger.error(JSON.stringify(dependencyTree, null, 2));
-          await new Promise((resolve25) => setTimeout(resolve25, 1e4));
           throw e;
         } finally {
           this.sendProgress("SCAN_FOR_VULNERABILITIES", false, subprojectPath, workspacePath);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coana-tech/cli",
-  "version": "14.9.22",
+  "version": "14.9.24",
   "description": "Coana CLI",
   "type": "module",
   "bin": {