@socketsecurity/cli-with-sentry 0.14.93 → 0.14.95

package/dist/module-sync/shadow-bin.js

@@ -1,22 +1,11 @@
 'use strict'
 
-function _socketInterop(e) {
-  let c = 0
-  for (const k in e ?? {}) {
-    c = c === 0 && k === 'default' ? 1 : 0
-    if (!c && k !== '__esModule') {
-      break
-    }
-  }
-  return c ? e.default : e
-}
-
 const process = require('node:process')
 const debug = require('@socketsecurity/registry/lib/debug')
 const npm = require('@socketsecurity/registry/lib/npm')
 const spawn = require('@socketsecurity/registry/lib/spawn')
 const path = require('node:path')
-const cmdShim = _socketInterop(require('cmd-shim'))
+const vendor = require('./vendor.js')
 const shadowNpmPaths = require('./shadow-npm-paths.js')
 const constants = require('./constants.js')
 
@@ -39,7 +28,7 @@ async function installLinks(realBinPath, binName) {
   // Move our bin directory to front of PATH so its found first.
   if (!shadowed) {
     if (WIN32) {
-      await cmdShim(
+      await vendor.libExports(
         // Lazily access constants.rootDistPath.
         path.join(constants.rootDistPath, `${binName}-${CLI}.js`),
         path.join(realBinPath, binName)
@@ -117,5 +106,5 @@ async function shadowBin(binName, args = process.argv.slice(2)) {
 }
 
 module.exports = shadowBin
-//# debugId=3488d19d-a988-44e5-a63f-309d31b935be
+//# debugId=a3ff14de-2729-4213-91d1-6f1ab7249f1d
 //# sourceMappingURL=shadow-bin.js.map

package/dist/module-sync/shadow-bin.js.map

@@ -1 +1 @@
-{"version":3,"file":"shadow-bin.js","sources":["../../src/shadow/npm/link.ts","../../src/shadow/npm/bin.ts"],"sourcesContent":["import path from 'node:path'\nimport process from 'node:process'\n\nimport cmdShim from 'cmd-shim'\n\nimport {\n  getNpmBinPath,\n  getNpxBinPath,\n  isNpmBinPathShadowed,\n  isNpxBinPathShadowed\n} from './paths'\nimport constants from '../../constants'\n\nconst { CLI, NPX } = constants\n\nexport async function installLinks(\n  realBinPath: string,\n  binName: 'npm' | 'npx'\n): Promise<string> {\n  const isNpx = binName === NPX\n  // Find package manager being shadowed by this process.\n  const binPath = isNpx ? getNpxBinPath() : getNpmBinPath()\n  // Lazily access constants.WIN32.\n  const { WIN32 } = constants\n  // TODO: Is this early exit needed?\n  if (WIN32 && binPath) {\n    return binPath\n  }\n  const shadowed = isNpx ? isNpxBinPathShadowed() : isNpmBinPathShadowed()\n  // Move our bin directory to front of PATH so its found first.\n  if (!shadowed) {\n    if (WIN32) {\n      await cmdShim(\n        // Lazily access constants.rootDistPath.\n        path.join(constants.rootDistPath, `${binName}-${CLI}.js`),\n        path.join(realBinPath, binName)\n      )\n    }\n    const { env } = process\n    env['PATH'] = `${realBinPath}${path.delimiter}${env['PATH']}`\n  }\n  return binPath\n}\n","import process from 'node:process'\n\nimport { isDebug } from '@socketsecurity/registry/lib/debug'\nimport {\n  isLoglevelFlag,\n  isProgressFlag\n} from '@socketsecurity/registry/lib/npm'\nimport { spawn } from '@socketsecurity/registry/lib/spawn'\n\nimport { installLinks } from './link'\nimport constants from '../../constants'\n\nconst { SOCKET_CLI_SAFE_BIN, SOCKET_CLI_SAFE_PROGRESS, SOCKET_IPC_HANDSHAKE } =\n  constants\n\nexport default async function shadowBin(\n  binName: 'npm' | 'npx',\n  args = process.argv.slice(2)\n) {\n  process.exitCode = 1\n  const useDebug = isDebug()\n  const terminatorPos = args.indexOf('--')\n  const rawBinArgs = terminatorPos === -1 ? args : args.slice(0, terminatorPos)\n  const progressArg = rawBinArgs.findLast(isProgressFlag) !== '--no-progress'\n  const binArgs = rawBinArgs.filter(a => !isProgressFlag(a))\n  const otherArgs = terminatorPos === -1 ? [] : args.slice(terminatorPos)\n  const isSilent = !useDebug && !binArgs.some(isLoglevelFlag)\n  // The default value of loglevel is \"notice\". We default to \"error\" which is\n  // two levels quieter.\n  const logLevelArgs = isSilent ? ['--loglevel', 'error'] : []\n  const spawnPromise = spawn(\n    // Lazily access constants.execPath.\n    constants.execPath,\n    [\n      // Lazily access constants.nodeHardenFlags.\n      ...constants.nodeHardenFlags,\n      // Lazily access constants.nodeNoWarningsFlags.\n      ...constants.nodeNoWarningsFlags,\n      // Lazily access process.env['INLINED_SOCKET_CLI_SENTRY_BUILD'].\n      ...(process.env['INLINED_SOCKET_CLI_SENTRY_BUILD']\n        ? [\n            '--require',\n            // Lazily access constants.distInstrumentWithSentryPath.\n            constants.distInstrumentWithSentryPath\n          ]\n        : []),\n      '--require',\n      // Lazily access constants.distShadowNpmInjectPath.\n      constants.distShadowNpmInjectPath,\n      // Lazily access constants.shadowBinPath.\n      await installLinks(constants.shadowBinPath, binName),\n      // Add '--no-progress' to fix input being swallowed by the npm spinner.\n      '--no-progress',\n      // Add '--loglevel=error' if a loglevel flag is not provided and the\n      // SOCKET_CLI_DEBUG environment variable is not truthy.\n      ...logLevelArgs,\n      ...binArgs,\n      ...otherArgs\n    ],\n    {\n      // 'inherit' + 'ipc'\n      stdio: [0, 1, 2, 'ipc']\n    }\n  )\n  // See https://nodejs.org/api/all.html#all_child_process_event-exit.\n  spawnPromise.process.on('exit', (code, signalName) => {\n    if (signalName) {\n      process.kill(process.pid, signalName)\n    } else if (code !== null) {\n      // eslint-disable-next-line n/no-process-exit\n      process.exit(code)\n    }\n  })\n  spawnPromise.process.send({\n    [SOCKET_IPC_HANDSHAKE]: {\n      [SOCKET_CLI_SAFE_BIN]: binName,\n      [SOCKET_CLI_SAFE_PROGRESS]: progressArg\n    }\n  })\n  await spawnPromise\n}\n"],"names":["NPX","WIN32","env","SOCKET_IPC_HANDSHAKE","constants","process","spawnPromise"],"mappings":";;;;;;;;;;;;;;;;;;;;AAaA;;AAAaA;AAAI;AAEV;AAIL;AACA;;AAEA;;AACQC;AAAM;AACd;;AAEE;AACF;;AAEA;;AAEE;AACE;AACE;;AAIJ;;AACQC;AAAI;AACZA;AACF;AACA;AACF;;AC9BA;;;AAAuDC;AAAqB;AAG7D;;AAKb;AACA;AACA;;AAEA;AACA;;AAEA;AACA;;;AAGE;;AAGE;;AAEA;;AAEA;;AAIM;AACAC;AAIN;AACAA;AACA;AACA;AACA;;AAEA;AACA;;AAMA;;AAEF;AAEF;;AAEE;;AAEA;AACE;AACAC;AACF;AACF;AACAC;AACE;;AAEE;AACF;AACF;AACA;AACF;;","debugId":"3488d19d-a988-44e5-a63f-309d31b935be"}
+{"version":3,"file":"shadow-bin.js","sources":["../../src/shadow/npm/link.ts","../../src/shadow/npm/bin.ts"],"sourcesContent":["import path from 'node:path'\nimport process from 'node:process'\n\nimport cmdShim from 'cmd-shim'\n\nimport {\n  getNpmBinPath,\n  getNpxBinPath,\n  isNpmBinPathShadowed,\n  isNpxBinPathShadowed\n} from './paths'\nimport constants from '../../constants'\n\nconst { CLI, NPX } = constants\n\nexport async function installLinks(\n  realBinPath: string,\n  binName: 'npm' | 'npx'\n): Promise<string> {\n  const isNpx = binName === NPX\n  // Find package manager being shadowed by this process.\n  const binPath = isNpx ? getNpxBinPath() : getNpmBinPath()\n  // Lazily access constants.WIN32.\n  const { WIN32 } = constants\n  // TODO: Is this early exit needed?\n  if (WIN32 && binPath) {\n    return binPath\n  }\n  const shadowed = isNpx ? isNpxBinPathShadowed() : isNpmBinPathShadowed()\n  // Move our bin directory to front of PATH so its found first.\n  if (!shadowed) {\n    if (WIN32) {\n      await cmdShim(\n        // Lazily access constants.rootDistPath.\n        path.join(constants.rootDistPath, `${binName}-${CLI}.js`),\n        path.join(realBinPath, binName)\n      )\n    }\n    const { env } = process\n    env['PATH'] = `${realBinPath}${path.delimiter}${env['PATH']}`\n  }\n  return binPath\n}\n","import process from 'node:process'\n\nimport { isDebug } from '@socketsecurity/registry/lib/debug'\nimport {\n  isLoglevelFlag,\n  isProgressFlag\n} from '@socketsecurity/registry/lib/npm'\nimport { spawn } from '@socketsecurity/registry/lib/spawn'\n\nimport { installLinks } from './link'\nimport constants from '../../constants'\n\nconst { SOCKET_CLI_SAFE_BIN, SOCKET_CLI_SAFE_PROGRESS, SOCKET_IPC_HANDSHAKE } =\n  constants\n\nexport default async function shadowBin(\n  binName: 'npm' | 'npx',\n  args = process.argv.slice(2)\n) {\n  process.exitCode = 1\n  const useDebug = isDebug()\n  const terminatorPos = args.indexOf('--')\n  const rawBinArgs = terminatorPos === -1 ? args : args.slice(0, terminatorPos)\n  const progressArg = rawBinArgs.findLast(isProgressFlag) !== '--no-progress'\n  const binArgs = rawBinArgs.filter(a => !isProgressFlag(a))\n  const otherArgs = terminatorPos === -1 ? [] : args.slice(terminatorPos)\n  const isSilent = !useDebug && !binArgs.some(isLoglevelFlag)\n  // The default value of loglevel is \"notice\". We default to \"error\" which is\n  // two levels quieter.\n  const logLevelArgs = isSilent ? ['--loglevel', 'error'] : []\n  const spawnPromise = spawn(\n    // Lazily access constants.execPath.\n    constants.execPath,\n    [\n      // Lazily access constants.nodeHardenFlags.\n      ...constants.nodeHardenFlags,\n      // Lazily access constants.nodeNoWarningsFlags.\n      ...constants.nodeNoWarningsFlags,\n      // Lazily access process.env['INLINED_SOCKET_CLI_SENTRY_BUILD'].\n      ...(process.env['INLINED_SOCKET_CLI_SENTRY_BUILD']\n        ? [\n            '--require',\n            // Lazily access constants.distInstrumentWithSentryPath.\n            constants.distInstrumentWithSentryPath\n          ]\n        : []),\n      '--require',\n      // Lazily access constants.distShadowNpmInjectPath.\n      constants.distShadowNpmInjectPath,\n      // Lazily access constants.shadowBinPath.\n      await installLinks(constants.shadowBinPath, binName),\n      // Add '--no-progress' to fix input being swallowed by the npm spinner.\n      '--no-progress',\n      // Add '--loglevel=error' if a loglevel flag is not provided and the\n      // SOCKET_CLI_DEBUG environment variable is not truthy.\n      ...logLevelArgs,\n      ...binArgs,\n      ...otherArgs\n    ],\n    {\n      // 'inherit' + 'ipc'\n      stdio: [0, 1, 2, 'ipc']\n    }\n  )\n  // See https://nodejs.org/api/all.html#all_child_process_event-exit.\n  spawnPromise.process.on('exit', (code, signalName) => {\n    if (signalName) {\n      process.kill(process.pid, signalName)\n    } else if (code !== null) {\n      // eslint-disable-next-line n/no-process-exit\n      process.exit(code)\n    }\n  })\n  spawnPromise.process.send({\n    [SOCKET_IPC_HANDSHAKE]: {\n      [SOCKET_CLI_SAFE_BIN]: binName,\n      [SOCKET_CLI_SAFE_PROGRESS]: progressArg\n    }\n  })\n  await spawnPromise\n}\n"],"names":["NPX","WIN32","env","SOCKET_IPC_HANDSHAKE","constants","process","spawnPromise"],"mappings":";;;;;;;;;;;AAaA;;AAAaA;AAAI;AAEV;AAIL;AACA;;AAEA;;AACQC;AAAM;AACd;;AAEE;AACF;;AAEA;;AAEE;AACE;AACE;;AAIJ;;AACQC;AAAI;AACZA;AACF;AACA;AACF;;AC9BA;;;AAAuDC;AAAqB;AAG7D;;AAKb;AACA;AACA;;AAEA;AACA;;AAEA;AACA;;;AAGE;;AAGE;;AAEA;;AAEA;;AAIM;AACAC;AAIN;AACAA;AACA;AACA;AACA;;AAEA;AACA;;AAMA;;AAEF;AAEF;;AAEE;;AAEA;AACE;AACAC;AACF;AACF;AACAC;AACE;;AAEE;AACF;AACF;AACA;AACF;;","debugId":"a3ff14de-2729-4213-91d1-6f1ab7249f1d"}

package/dist/module-sync/shadow-npm-inject.js

@@ -1,43 +1,26 @@
 'use strict'
 
-function _socketInterop(e) {
-  let c = 0
-  for (const k in e ?? {}) {
-    c = c === 0 && k === 'default' ? 1 : 0
-    if (!c && k !== '__esModule') {
-      break
-    }
-  }
-  return c ? e.default : e
-}
-
 const shadowNpmPaths = require('./shadow-npm-paths.js')
 const process$1 = require('node:process')
-const commonTags = _socketInterop(require('common-tags'))
+const vendor = require('./vendor.js')
 const logger = require('@socketsecurity/registry/lib/logger')
 const constants = require('./constants.js')
-const semver = _socketInterop(require('semver'))
 const packageurlJs = require('@socketregistry/packageurl-js')
 const registry = require('@socketsecurity/registry')
 const arrays = require('@socketsecurity/registry/lib/arrays')
 const debug = require('@socketsecurity/registry/lib/debug')
 const objects = require('@socketsecurity/registry/lib/objects')
-const npa = _socketInterop(require('npm-package-arg'))
-const hpagent = _socketInterop(require('hpagent'))
 const isInteractive = require('@socketregistry/is-interactive/index.cjs')
 const registryConstants = require('@socketsecurity/registry/lib/constants')
 const prompts = require('@socketsecurity/registry/lib/prompts')
 const strings = require('@socketsecurity/registry/lib/strings')
 const sdk = require('@socketsecurity/sdk')
-const fs = require('node:fs')
+const require$$0 = require('node:fs')
 const os = require('node:os')
 const path = require('node:path')
-const config = require('@socketsecurity/config')
 const promises = require('node:timers/promises')
-const colors = _socketInterop(require('yoctocolors-cjs'))
 const packages = require('@socketsecurity/registry/lib/packages')
 const sorts = require('@socketsecurity/registry/lib/sorts')
-const terminalLink = _socketInterop(require('terminal-link'))
 const indentString = require('@socketregistry/indent-string/index.cjs')
 
 const { abortSignal } = constants
@@ -53,7 +36,7 @@ async function findUp(name, { cwd = process$1.cwd(), signal = abortSignal }) {
       const filePath = path.join(dir, name)
       try {
         // eslint-disable-next-line no-await-in-loop
-        const stats = await fs.promises.stat(filePath)
+        const stats = await require$$0.promises.stat(filePath)
         if (stats.isFile()) {
           return filePath
         }
@@ -64,14 +47,14 @@ async function findUp(name, { cwd = process$1.cwd(), signal = abortSignal }) {
   return undefined
 }
 async function readFileBinary(filepath, options) {
-  return await fs.promises.readFile(filepath, {
+  return await require$$0.promises.readFile(filepath, {
     signal: abortSignal,
     ...options,
     encoding: 'binary'
   })
 }
 async function readFileUtf8(filepath, options) {
-  return await fs.promises.readFile(filepath, {
+  return await require$$0.promises.readFile(filepath, {
     signal: abortSignal,
     ...options,
     encoding: 'utf8'
@@ -79,7 +62,7 @@ async function readFileUtf8(filepath, options) {
 }
 async function safeReadFile(filepath, options) {
   try {
-    return await fs.promises.readFile(filepath, {
+    return await require$$0.promises.readFile(filepath, {
       encoding: 'utf8',
       signal: abortSignal,
       ...(typeof options === 'string'
@@ -93,7 +76,7 @@ async function safeReadFile(filepath, options) {
 }
 function safeReadFileSync(filepath, options) {
   try {
-    return fs.readFileSync(filepath, {
+    return require$$0.readFileSync(filepath, {
       encoding: 'utf8',
       ...(typeof options === 'string'
         ? {
@@ -162,7 +145,7 @@ function overrideCachedConfig(jsonConfig) {
 function overrideConfigApiToken(apiToken) {
   // Set token to the local cached config and mark it read-only so it doesn't persist
   _cachedConfig = {
-    ...config,
+    ...vendor.configExports,
     ...(apiToken === undefined
       ? {}
       : {
@@ -195,7 +178,7 @@ function getConfigValues() {
           updateConfigValue('apiToken', token)
         }
       } else {
-        fs.mkdirSync(path.dirname(configPath), {
+        require$$0.mkdirSync(path.dirname(configPath), {
           recursive: true
         })
       }
@@ -267,7 +250,7 @@ function findSocketYmlSync(dir = process$1.cwd()) {
       try {
         return {
           path: ymlPath,
-          parsed: config.parseSocketConfig(yml)
+          parsed: vendor.configExports.parseSocketConfig(yml)
         }
       } catch {
         throw new Error(`Found file but was unable to parse ${ymlPath}`)
@@ -299,7 +282,7 @@ function updateConfigValue(key, value) {
       _pendingSave = false
       const configPath = getConfigPath()
       if (configPath) {
-        fs.writeFileSync(
+        require$$0.writeFileSync(
           configPath,
           Buffer.from(JSON.stringify(localConfig)).toString('base64')
         )
@@ -397,7 +380,7 @@ async function setupSdk(
   }
   return new sdk.SocketSdk(apiToken, {
     agent: proxy
-      ? new hpagent.HttpsProxyAgent({
+      ? new vendor.HttpsProxyAgent({
           proxy
         })
       : undefined,
@@ -406,7 +389,7 @@ async function setupSdk(
       // The '@rollup/plugin-replace' will replace "process.env['INLINED_SOCKET_CLI_NAME']".
       name: '@socketsecurity/cli',
       // The '@rollup/plugin-replace' will replace "process.env['INLINED_SOCKET_CLI_VERSION']".
-      version: '0.14.93',
+      version: '0.14.95',
       // The '@rollup/plugin-replace' will replace "process.env['INLINED_SOCKET_CLI_HOMEPAGE']".
       homepage: 'https://github.com/SocketDev/socket-cli'
     })
@@ -539,18 +522,21 @@ class SafeOverrideSet extends OverrideSet {
       // We need to use the rawSpec here, because the spec has the overrides
       // applied to it already. The rawSpec can be undefined, so we need to use
       // the fallback value of spec if it is.
-      let spec = npa(`${edge.name}@${edge.rawSpec || edge.spec}`)
+      let spec = vendor.npaExports(`${edge.name}@${edge.rawSpec || edge.spec}`)
       if (spec.type === 'alias') {
         spec = spec.subSpec
       }
       if (spec.type === 'git') {
-        if (spec.gitRange && semver.intersects(spec.gitRange, rule.keySpec)) {
+        if (
+          spec.gitRange &&
+          vendor.semverExports.intersects(spec.gitRange, rule.keySpec)
+        ) {
           return rule
         }
         continue
       }
       if (spec.type === 'range' || spec.type === 'version') {
-        if (semver.intersects(spec.fetchSpec, rule.keySpec)) {
+        if (vendor.semverExports.intersects(spec.fetchSpec, rule.keySpec)) {
           return rule
         }
         continue
@@ -629,12 +615,15 @@ class SafeNode extends Node {
     // is based on https://github.com/npm/cli/pull/8089.
     //
     // If we prefer dedupe, or if the version is equal, take the other.
-    if (preferDedupe || semver.eq(other.version, this.version)) {
+    if (preferDedupe || vendor.semverExports.eq(other.version, this.version)) {
       return true
     }
     // If our current version isn't the result of an override, then prefer to
     // take the greater version.
-    if (!this.overridden && semver.gt(other.version, this.version)) {
+    if (
+      !this.overridden &&
+      vendor.semverExports.gt(other.version, this.version)
+    ) {
       return true
     }
     return false
@@ -1256,18 +1245,22 @@ class ColorOrMarkdown {
     this.useMarkdown = !!useMarkdown
   }
   bold(text) {
-    return this.useMarkdown ? `**${text}**` : colors.bold(`${text}`)
+    return this.useMarkdown
+      ? `**${text}**`
+      : vendor.yoctocolorsCjsExports.bold(`${text}`)
   }
   header(text, level = 1) {
     return this.useMarkdown
       ? `\n${''.padStart(level, '#')} ${text}\n`
-      : colors.underline(`\n${level === 1 ? colors.bold(text) : text}\n`)
+      : vendor.yoctocolorsCjsExports.underline(
+          `\n${level === 1 ? vendor.yoctocolorsCjsExports.bold(text) : text}\n`
+        )
   }
   hyperlink(text, url, { fallback = true, fallbackToUrl } = {}) {
     if (url) {
       return this.useMarkdown
         ? `[${text}](${url})`
-        : terminalLink(text, url, {
+        : vendor.terminalLinkExports(text, url, {
             fallback: fallbackToUrl ? (_text, url) => url : fallback
           })
     }
@@ -1277,7 +1270,9 @@ class ColorOrMarkdown {
     return indentString(...args)
   }
   italic(text) {
-    return this.useMarkdown ? `_${text}_` : colors.italic(`${text}`)
+    return this.useMarkdown
+      ? `_${text}_`
+      : vendor.yoctocolorsCjsExports.italic(`${text}`)
   }
   json(value) {
     return this.useMarkdown
@@ -1432,7 +1427,7 @@ async function addArtifactToAlertsMap(artifact, alertsByPkgId, options) {
   const name = packages.resolvePackageName(artifact)
   const { version } = artifact
   const pkgId = `${name}@${version}`
-  const major = semver.major(version)
+  const major = vendor.semverExports.major(version)
   const socketYml = findSocketYmlSync()
   const enabledState = {
     __proto__: null,
@@ -1489,10 +1484,10 @@ async function addArtifactToAlertsMap(artifact, alertsByPkgId, options) {
       if (fixType === ALERT_FIX_TYPE.cve) {
         const patchedVersion =
           alert.props[CVE_ALERT_PROPS_FIRST_PATCHED_VERSION_IDENTIFIER]
-        const patchedMajor = semver.major(patchedVersion)
+        const patchedMajor = vendor.semverExports.major(patchedVersion)
         const oldHighest = highestForCve.get(patchedMajor)
         const highest = oldHighest?.version ?? '0.0.0'
-        if (semver.gt(patchedVersion, highest)) {
+        if (vendor.semverExports.gt(patchedVersion, highest)) {
           highestForCve.set(patchedMajor, {
             alert: sockPkgAlert,
             version: patchedVersion
@@ -1501,7 +1496,7 @@ async function addArtifactToAlertsMap(artifact, alertsByPkgId, options) {
       } else if (fixType === ALERT_FIX_TYPE.upgrade) {
         const oldHighest = highestForUpgrade.get(major)
         const highest = oldHighest?.version ?? '0.0.0'
-        if (semver.gt(version, highest)) {
+        if (vendor.semverExports.gt(version, highest)) {
           highestForUpgrade.set(major, {
             alert: sockPkgAlert,
             version
@@ -1555,7 +1550,7 @@ function getCveInfoByAlertsMap(alertsMap, options) {
         alert.props
       infos.push({
         firstPatchedVersionIdentifier,
-        vulnerableVersionRange: new semver.Range(
+        vulnerableVersionRange: new vendor.semverExports.Range(
           vulnerableVersionRange
         ).format()
       })
@@ -1651,13 +1646,23 @@ function logAlertsMap(alertsMap, options) {
       const severity = alert.raw.severity ?? ''
       const attributes = [
         ...(severity
-          ? [colors[ALERT_SEVERITY_COLOR[severity]](getSeverityLabel(severity))]
+          ? [
+              vendor.yoctocolorsCjsExports[ALERT_SEVERITY_COLOR[severity]](
+                getSeverityLabel(severity)
+              )
+            ]
+          : []),
+        ...(alert.blocked
+          ? [
+              vendor.yoctocolorsCjsExports.bold(
+                vendor.yoctocolorsCjsExports.red('blocked')
+              )
+            ]
           : []),
-        ...(alert.blocked ? [colors.bold(colors.red('blocked'))] : []),
         ...(alert.fixable ? ['fixable'] : [])
       ]
       const maybeAttributes = attributes.length
-        ? ` ${colors.italic(`(${attributes.join('; ')})`)}`
+        ? ` ${vendor.yoctocolorsCjsExports.italic(`(${attributes.join('; ')})`)}`
         : ''
       // Based data from { pageProps: { alertTypes } } of:
       // https://socket.dev/_next/data/94666139314b6437ee4491a0864e72b264547585/en-US.json
@@ -1693,11 +1698,11 @@ function logAlertsMap(alertsMap, options) {
       mentionedPkgIdsWithHiddenAlerts.add(pkgId)
       if (hiddenAlertsCount === 1) {
         output.write(
-          `  ${colors.dim(`+1 Hidden ${getSeverityLabel(hiddenAlerts[0].raw.severity ?? 'low')} risk alert`)}\n`
+          `  ${vendor.yoctocolorsCjsExports.dim(`+1 Hidden ${getSeverityLabel(hiddenAlerts[0].raw.severity ?? 'low')} risk alert`)}\n`
         )
       } else {
         output.write(
-          `  ${colors.dim(`+${hiddenAlertsCount} Hidden alerts ${colors.italic(getHiddenRisksDescription(getHiddenRiskCounts(hiddenAlerts)))}`)}\n`
+          `  ${vendor.yoctocolorsCjsExports.dim(`+${hiddenAlertsCount} Hidden alerts ${vendor.yoctocolorsCjsExports.italic(getHiddenRisksDescription(getHiddenRiskCounts(hiddenAlerts)))}`)}\n`
         )
       }
     }
@@ -1723,7 +1728,7 @@ function logAlertsMap(alertsMap, options) {
       totalRiskCounts.low += riskCounts.low
     }
     output.write(
-      `${aboveTheFoldPkgIds.size ? '\n' : ''}${colors.dim(`${aboveTheFoldPkgIds.size ? '+' : ''}${additionalHiddenCount} Packages with hidden alerts ${colors.italic(getHiddenRisksDescription(totalRiskCounts))}`)}\n`
+      `${aboveTheFoldPkgIds.size ? '\n' : ''}${vendor.yoctocolorsCjsExports.dim(`${aboveTheFoldPkgIds.size ? '+' : ''}${additionalHiddenCount} Packages with hidden alerts ${vendor.yoctocolorsCjsExports.italic(getHiddenRisksDescription(totalRiskCounts))}`)}\n`
     )
   }
   output.write('\n')
@@ -1763,7 +1768,9 @@ function applyRange(refRange, version, style = 'preserve') {
     case 'lte':
       return `<=${version}`
     case 'preserve': {
-      const comparators = [...new semver.Range(refRange).set].flat()
+      const comparators = [
+        ...new vendor.semverExports.Range(refRange).set
+      ].flat()
       const { length } = comparators
       return !length || length > 1
         ? version
@@ -1877,20 +1884,22 @@ function findBestPatchVersion(
   const manifestData = registry.getManifestData(NPM$1, node.name)
   let eligibleVersions
   if (manifestData && manifestData.name === manifestData.package) {
-    const major = semver.major(manifestData.version)
-    eligibleVersions = availableVersions.filter(v => semver.major(v) === major)
+    const major = vendor.semverExports.major(manifestData.version)
+    eligibleVersions = availableVersions.filter(
+      v => vendor.semverExports.major(v) === major
+    )
   } else {
-    const major = semver.major(node.version)
+    const major = vendor.semverExports.major(node.version)
     eligibleVersions = availableVersions.filter(
       v =>
         // Filter for versions that are within the current major version and
         // are NOT in the vulnerable range.
-        semver.major(v) === major &&
+        vendor.semverExports.major(v) === major &&
         (!vulnerableVersionRange ||
-          !semver.satisfies(v, vulnerableVersionRange))
+          !vendor.semverExports.satisfies(v, vulnerableVersionRange))
     )
   }
-  return semver.maxSatisfying(eligibleVersions, '*')
+  return vendor.semverExports.maxSatisfying(eligibleVersions, '*')
 }
 function findPackageNode(tree, name, version) {
   const queue = [tree]
@@ -2251,7 +2260,7 @@ class SafeArborist extends Arborist {
         hideAt: viewAllRisks ? 'none' : 'middle',
         output: process$1.stderr
       })
-      throw new Error(commonTags.stripIndents`
+      throw new Error(vendor.stripIndents`
           Socket ${binName} exiting due to risks.${viewAllRisks ? '' : `\nView all risks - Rerun with environment variable ${SOCKET_CLI_VIEW_ALL_RISKS}=1.`}${acceptRisks ? '' : `\nAccept risks - Rerun with environment variable ${SOCKET_CLI_ACCEPT_RISKS}=1.`}
         `)
     } else if (!options['silent']) {
@@ -2324,5 +2333,5 @@ exports.supportedConfigKeys = supportedConfigKeys
 exports.updateConfigValue = updateConfigValue
 exports.updateNode = updateNode
 exports.updatePackageJsonFromNode = updatePackageJsonFromNode
-//# debugId=4a5ec0eb-c847-4515-a3ab-d54909c5458b
+//# debugId=4272984d-bd34-42be-a7cc-e1ca384ab62e
 //# sourceMappingURL=shadow-npm-inject.js.map