@socketsecurity/cli-with-sentry 0.15.24 → 0.15.26

package/dist/cli.js

@@ -24,6 +24,7 @@ var sorts = require('../external/@socketsecurity/registry/lib/sorts');
 var path$1 = require('../external/@socketsecurity/registry/lib/path');
 var regexps = require('../external/@socketsecurity/registry/lib/regexps');
 var fs$2 = require('../external/@socketsecurity/registry/lib/fs');
+var strings = require('../external/@socketsecurity/registry/lib/strings');
 var shadowInject = require('./shadow-inject.js');
 var objects = require('../external/@socketsecurity/registry/lib/objects');
 var registryConstants = require('../external/@socketsecurity/registry/lib/constants');
@@ -3590,8 +3591,6 @@ const cmdDiffScan = {
   }
 };
 
-const GITHUB_ACTIONS_BOT_USERNAME = 'github-actions[bot]';
-const GITHUB_ACTIONS_BOT_EMAIL = `${GITHUB_ACTIONS_BOT_USERNAME}@users.noreply.github.com`;
 function formatBranchName(name) {
   return name.replace(/[-_.\\/]+/g, '-').replace(/[^-a-zA-Z0-9]+/g, '').replace(/^-+|-+$/g, '');
 }
@@ -3609,17 +3608,25 @@ function getSocketBranchName(purl, newVersion, workspaceName) {
   const fullName = `${maybeWorkspaceName}${maybeNamespace}${formatBranchName(purlObj.name)}`;
   return `socket/${fullName}-${formatBranchName(newVersion)}`;
 }
-function getSocketPrTitlePattern(purl, workspaceName) {
-  const purlObj = vendor.packageurlJsExports.PackageURL.fromString(purl);
-  const pkgFullName = utils.getPkgFullNameFromPurlObj(purlObj);
-  const workspaceDetails = workspaceName ? ` in ${regexps.escapeRegExp(workspaceName)}` : '';
-  return new RegExp(`Bump ${regexps.escapeRegExp(pkgFullName)} from ${regexps.escapeRegExp(purlObj.version)} to \\S+${workspaceDetails}`);
+function getSocketPrTitlePattern(options) {
+  const {
+    purl,
+    workspace
+  } = {
+    __proto__: null,
+    ...options
+  };
+  const purlObj = purl ? vendor.packageurlJsExports.PackageURL.fromString(purl) : null;
+  const escapedPkgFullName = purlObj ? regexps.escapeRegExp(utils.getPkgFullNameFromPurlObj(purlObj)) : '\\S+';
+  const escapedPkgVersion = purlObj ? regexps.escapeRegExp(purlObj.version) : '\\S+';
+  const escapedWorkspaceDetails = workspace ? ` in ${regexps.escapeRegExp(workspace)}` : '';
+  return new RegExp(`Bump ${escapedPkgFullName} from ${escapedPkgVersion} to \\S+${escapedWorkspaceDetails}`);
 }
-function getSocketPullRequestTitle(purl, newVersion, workspaceName) {
+function getSocketPullRequestTitle(purl, toVersion, workspace) {
   const purlObj = vendor.packageurlJsExports.PackageURL.fromString(purl);
   const pkgFullName = utils.getPkgFullNameFromPurlObj(purlObj);
-  const workspaceDetails = workspaceName ? ` in ${workspaceName}` : '';
-  return `Bump ${pkgFullName} from ${purlObj.version} to ${newVersion}${workspaceDetails}`;
+  const workspaceDetails = workspace ? ` in ${workspace}` : '';
+  return `Bump ${pkgFullName} from ${purlObj.version} to ${toVersion}${workspaceDetails}`;
 }
 function getSocketPullRequestBody(purl, newVersion, workspaceName) {
   const purlObj = vendor.packageurlJsExports.PackageURL.fromString(purl);
@@ -3640,13 +3647,23 @@ async function gitCleanFdx(cwd = process.cwd()) {
   };
   await spawn.spawn('git', ['clean', '-fdx'], stdioIgnoreOptions);
 }
-async function gitCreateAndPushBranch(branch, commitMsg, filepaths, cwd = process.cwd()) {
+async function gitCreateAndPushBranch(branch, commitMsg, filepaths, options) {
+  const {
+    cwd = process.cwd(),
+    // Lazily access constants.ENV.SOCKET_CLI_GIT_USER_EMAIL.
+    email = constants.ENV.SOCKET_CLI_GIT_USER_EMAIL,
+    // Lazily access constants.ENV.SOCKET_CLI_GIT_USER_NAME.
+    user = constants.ENV.SOCKET_CLI_GIT_USER_NAME
+  } = {
+    __proto__: null,
+    ...options
+  };
   const stdioIgnoreOptions = {
     cwd,
     stdio: 'ignore'
   };
   try {
-    await gitEnsureIdentity(cwd);
+    await gitEnsureIdentity(user, email, cwd);
     await spawn.spawn('git', ['checkout', '-b', branch], stdioIgnoreOptions);
     await spawn.spawn('git', ['add', ...filepaths], stdioIgnoreOptions);
     await spawn.spawn('git', ['commit', '-m', commitMsg], stdioIgnoreOptions);
@@ -3658,7 +3675,7 @@ async function gitCreateAndPushBranch(branch, commitMsg, filepaths, cwd = proces
   } catch {}
   return false;
 }
-async function gitEnsureIdentity(cwd = process.cwd()) {
+async function gitEnsureIdentity(name, email, cwd = process.cwd()) {
   const stdioIgnoreOptions = {
     cwd,
     stdio: 'ignore'
@@ -3666,19 +3683,27 @@ async function gitEnsureIdentity(cwd = process.cwd()) {
   const stdioPipeOptions = {
     cwd
   };
-  let hasUserName = false;
-  try {
-    hasUserName = !!(await spawn.spawn('git', ['config', '--get', 'user.name'], stdioPipeOptions)).stdout.trim();
-  } catch {}
-  if (!hasUserName) {
-    await spawn.spawn('git', ['config', 'user.name', GITHUB_ACTIONS_BOT_USERNAME], stdioIgnoreOptions);
-  }
-  let hasUserEmail = false;
+  const identEntries = [['user.email', name], ['user.name', email]];
+  await Promise.all(identEntries.map(async ({
+    0: prop,
+    1: value
+  }) => {
+    try {
+      const output = await spawn.spawn('git', ['config', '--get', prop], stdioPipeOptions);
+      if (output.stdout.trim() !== value) {
+        await spawn.spawn('git', ['config', prop, value], stdioIgnoreOptions);
+      }
+    } catch {}
+  }));
+}
+async function gitRemoteBranchExists(branch, cwd = process.cwd()) {
+  const stdioPipeOptions = {
+    cwd
+  };
   try {
-    hasUserEmail = !!(await spawn.spawn('git', ['config', '--get', 'user.email'], stdioPipeOptions)).stdout.trim();
-  } catch {}
-  if (!hasUserEmail) {
-    await spawn.spawn('git', ['config', 'user.email', GITHUB_ACTIONS_BOT_EMAIL], stdioIgnoreOptions);
+    return (await spawn.spawn('git', ['ls-remote', '--heads', 'origin', branch], stdioPipeOptions)).stdout.trim().length > 0;
+  } catch {
+    return false;
   }
 }
 async function gitResetAndClean(branch = 'HEAD', cwd = process.cwd()) {
@@ -3694,16 +3719,6 @@ async function gitResetHard(branch = 'HEAD', cwd = process.cwd()) {
   };
   await spawn.spawn('git', ['reset', '--hard', branch], stdioIgnoreOptions);
 }
-async function gitRemoteBranchExists(branch, cwd = process.cwd()) {
-  const stdioPipeOptions = {
-    cwd
-  };
-  try {
-    return (await spawn.spawn('git', ['ls-remote', '--heads', 'origin', branch], stdioPipeOptions)).stdout.trim().length > 0;
-  } catch {
-    return false;
-  }
-}
 async function gitUnstagedModifiedFiles(cwd = process.cwd()) {
   const stdioPipeOptions = {
     cwd
@@ -3775,115 +3790,25 @@ async function writeCache(key, data) {
   }
   await fs$2.writeJson(cacheJsonPath, data);
 }
-async function cleanupOpenPrs(owner, repo, purl, newVersion, options) {
-  const {
-    workspaceName
-  } = {
-    __proto__: null,
-    ...options
-  };
-  const octokit = getOctokit();
-  const octokitGraphql = getOctokitGraphql();
-  const titlePattern = getSocketPrTitlePattern(purl, workspaceName);
-  const prMatches = [];
-  try {
-    // Optimistically fetch only the first 50 open PRs using GraphQL to minimize
-    // API quota usage. Fallback to REST if no matching PRs are found.
-    const gqlCacheKey = `${repo}-pr-graphql-snapshot`;
-    const gqlResp = await cacheFetch(gqlCacheKey, () => octokitGraphql(`
-          query($owner: String!, $repo: String!) {
-            repository(owner: $owner, name: $repo) {
-              pullRequests(first: 50, states: OPEN, orderBy: {field: CREATED_AT, direction: DESC}) {
-                nodes {
-                  number
-                  title
-                  mergeStateStatus
-                  headRefName
-                  baseRefName
-                }
-              }
-            }
-          }
-          `, {
-      owner,
-      repo
-    }));
-    const nodes = gqlResp?.repository?.pullRequests?.nodes;
-    if (nodes) {
-      for (let i = 0, {
-          length
-        } = nodes; i < length; i += 1) {
-        const node = nodes[i];
-        if (titlePattern.test(node.title)) {
-          prMatches.push({
-            apiType: 'graphql',
-            cacheKey: gqlCacheKey,
-            data: gqlResp,
-            entry: node,
-            index: i,
-            parent: nodes,
-            props: node
-          });
-        }
-      }
-    }
-  } catch {}
-
-  // Fallback to REST if GraphQL found no matching PRs.
-  let allOpenPrs;
-  if (!prMatches.length) {
-    const cacheKey = `${repo}-open-prs`;
-    try {
-      allOpenPrs = await cacheFetch(cacheKey, async () => await octokit.paginate(octokit.pulls.list, {
-        owner,
-        repo,
-        state: 'open',
-        per_page: 100
-      }));
-    } catch {}
-    if (allOpenPrs) {
-      for (let i = 0, {
-          length
-        } = allOpenPrs; i < length; i += 1) {
-        const pr = allOpenPrs[i];
-        if (titlePattern.test(pr.title)) {
-          prMatches.push({
-            apiType: 'rest',
-            cacheKey,
-            data: allOpenPrs,
-            entry: pr,
-            index: i,
-            parent: allOpenPrs,
-            props: {
-              baseRefName: pr.base.ref,
-              headRefName: pr.head.ref,
-              // Upper cased mergeable_state is equivalent to mergeStateStatus.
-              // https://docs.github.com/en/rest/pulls/pulls?apiVersion=2022-11-28#get-a-pull-request
-              mergeStateStatus: pr.mergeable_state?.toUpperCase?.() ?? 'UNKNOWN',
-              number: pr.number,
-              title: pr.title
-            }
-          });
-        }
-      }
-    }
-  }
-  if (!prMatches.length) {
-    return;
+async function cleanupOpenPrs(owner, repo, newVersion, options) {
+  const contextualMatches = await getOpenSocketPrsWithContext(owner, repo, options);
+  if (!contextualMatches.length) {
+    return [];
   }
   const cachesToSave = new Map();
-  await Promise.allSettled(prMatches.map(async match => {
-    const {
-      props
-    } = match;
-    const versionText = /(?<= to )\S+/.exec(props.title)?.[0];
+  const octokit = getOctokit();
+  const settledMatches = await Promise.allSettled(contextualMatches.map(async ({
+    context,
+    match
+  }) => {
     const {
       number: prNum
-    } = props;
+    } = match;
     const prRef = `PR #${prNum}`;
-    const prVersion = vendor.semverExports.coerce(versionText);
+    const prToVersionText = /(?<= to )\S+/.exec(match.title)?.[0];
+    const prToVersion = vendor.semverExports.coerce(prToVersionText);
     // Close older PRs.
-    if (prVersion && vendor.semverExports.lt(prVersion, newVersion)) {
+    if (prToVersion && vendor.semverExports.lt(prToVersion, newVersion)) {
       try {
         await octokit.pulls.update({
           owner,
@@ -3891,40 +3816,41 @@ async function cleanupOpenPrs(owner, repo, purl, newVersion, options) {
           pull_number: prNum,
           state: 'closed'
         });
-        debug.debugLog(`Closed ${prRef} for older version ${prVersion}.`);
+        debug.debugLog(`Closed ${prRef} for older version ${prToVersion}.`);
         // Remove entry from parent object.
-        match.parent.splice(match.index, 1);
+        context.parent.splice(context.index, 1);
         // Mark cache to be saved.
-        cachesToSave.set(match.cacheKey, match.data);
+        cachesToSave.set(context.cacheKey, context.data);
+        return null;
       } catch (e) {
         debug.debugLog(`Failed to close ${prRef}: ${e?.message || 'Unknown error'}`);
-        return;
       }
     }
     // Update stale PRs.
     // https://docs.github.com/en/graphql/reference/enums#mergestatestatus
-    if (props.mergeStateStatus === 'BEHIND') {
+    if (match.mergeStateStatus === 'BEHIND') {
       try {
         await octokit.repos.merge({
           owner,
           repo,
-          base: props.headRefName,
-          head: props.baseRefName
+          base: match.headRefName,
+          head: match.baseRefName
         });
         debug.debugLog(`Updated stale ${prRef}.`);
         // Update entry entry.
-        if (match.apiType === 'graphql') {
-          match.entry.mergeStateStatus = 'CLEAN';
-        } else if (match.apiType === 'rest') {
-          match.entry.mergeable_state = 'clean';
+        if (context.apiType === 'graphql') {
+          context.entry.mergeStateStatus = 'CLEAN';
+        } else if (context.apiType === 'rest') {
+          context.entry.mergeable_state = 'clean';
         }
         // Mark cache to be saved.
-        cachesToSave.set(match.cacheKey, match.data);
+        cachesToSave.set(context.cacheKey, context.data);
       } catch (e) {
         const message = e?.message || 'Unknown error';
         debug.debugLog(`Failed to update ${prRef}: ${message}`);
       }
     }
+    return match;
   }));
   if (cachesToSave.size) {
     await Promise.allSettled([...cachesToSave].map(({
@@ -3932,6 +3858,8 @@ async function cleanupOpenPrs(owner, repo, purl, newVersion, options) {
       1: data
     }) => writeCache(key, data)));
   }
+  const fulfilledMatches = settledMatches.filter(r => r.status === 'fulfilled' && r.value);
+  return fulfilledMatches.map(r => r.value.match);
 }
 async function enablePrAutoMerge({
   node_id: prId
@@ -3986,10 +3914,122 @@ function getGitHubEnvRepoInfo() {
     repo: ownerSlashRepo.slice(slashIndex + 1)
   };
 }
+async function getOpenSocketPrsWithContext(owner, repo, options_) {
+  const options = {
+    __proto__: null,
+    ...options_
+  };
+  const {
+    author
+  } = options;
+  const checkAuthor = strings.isNonEmptyString(author);
+  const octokit = getOctokit();
+  const octokitGraphql = getOctokitGraphql();
+  const titlePattern = getSocketPrTitlePattern(options);
+  const contextualMatches = [];
+  try {
+    // Optimistically fetch only the first 50 open PRs using GraphQL to minimize
+    // API quota usage. Fallback to REST if no matching PRs are found.
+    const gqlCacheKey = `${repo}-pr-graphql-snapshot`;
+    const gqlResp = await cacheFetch(gqlCacheKey, () => octokitGraphql(`
+          query($owner: String!, $repo: String!) {
+            repository(owner: $owner, name: $repo) {
+              pullRequests(first: 50, states: OPEN, orderBy: {field: CREATED_AT, direction: DESC}) {
+                nodes {
+                  author {
+                    login
+                  }
+                  baseRefName
+                  headRefName
+                  mergeStateStatus
+                  number
+                  title
+                }
+              }
+            }
+          }
+          `, {
+      owner,
+      repo
+    }));
+    const nodes = gqlResp?.repository?.pullRequests?.nodes ?? [];
+    for (let i = 0, {
+        length
+      } = nodes; i < length; i += 1) {
+      const node = nodes[i];
+      const login = node.author?.login;
+      const matchesAuthor = checkAuthor ? login === author : true;
+      if (matchesAuthor && titlePattern.test(node.title)) {
+        contextualMatches.push({
+          context: {
+            apiType: 'graphql',
+            cacheKey: gqlCacheKey,
+            data: gqlResp,
+            entry: node,
+            index: i,
+            parent: nodes
+          },
+          match: {
+            ...node,
+            author: login ?? '<unknown>'
+          }
+        });
+      }
+    }
+  } catch {}
+  if (contextualMatches.length) {
+    return contextualMatches;
+  }
+
+  // Fallback to REST if GraphQL found no matching PRs.
+  let allOpenPrs;
+  const cacheKey = `${repo}-open-prs`;
+  try {
+    allOpenPrs = await cacheFetch(cacheKey, async () => await octokit.paginate(octokit.pulls.list, {
+      owner,
+      repo,
+      state: 'open',
+      per_page: 100
+    }));
+  } catch {}
+  if (!allOpenPrs) {
+    return contextualMatches;
+  }
+  for (let i = 0, {
+      length
+    } = allOpenPrs; i < length; i += 1) {
+    const pr = allOpenPrs[i];
+    const login = pr.user?.login;
+    const matchesAuthor = checkAuthor ? login === author : true;
+    if (matchesAuthor && titlePattern.test(pr.title)) {
+      contextualMatches.push({
+        context: {
+          apiType: 'rest',
+          cacheKey,
+          data: allOpenPrs,
+          entry: pr,
+          index: i,
+          parent: allOpenPrs
+        },
+        match: {
+          author: login ?? '<unknown>',
+          baseRefName: pr.base.ref,
+          headRefName: pr.head.ref,
+          // Upper cased mergeable_state is equivalent to mergeStateStatus.
+          // https://docs.github.com/en/rest/pulls/pulls?apiVersion=2022-11-28#get-a-pull-request
+          mergeStateStatus: pr.mergeable_state?.toUpperCase?.() ?? 'UNKNOWN',
+          number: pr.number,
+          title: pr.title
+        }
+      });
+    }
+  }
+  return contextualMatches;
+}
 async function openPr(owner, repo, branch, purl, newVersion, options) {
   const {
     baseBranch = 'main',
-    workspaceName
+    workspace
   } = {
     __proto__: null,
     ...options
@@ -4004,10 +4044,10 @@ async function openPr(owner, repo, branch, purl, newVersion, options) {
     return await octokit.pulls.create({
       owner,
       repo,
-      title: getSocketPullRequestTitle(purl, newVersion, workspaceName),
+      title: getSocketPullRequestTitle(purl, newVersion, workspace),
       head: branch,
       base: baseBranch,
-      body: getSocketPullRequestBody(purl, newVersion, workspaceName)
+      body: getSocketPullRequestBody(purl, newVersion, workspace)
     });
   } catch (e) {
     let message = `Failed to open pull request`;
@@ -4134,7 +4174,7 @@ async function npmFix(pkgEnvDetails, {
   const {
     pkgPath: rootPath
   } = pkgEnvDetails;
-  const arb = new shadowInject.SafeArborist({
+  const arb = new shadowInject.Arborist({
     path: rootPath,
     ...shadowInject.SAFE_ARBORIST_REIFY_OPTIONS_OVERRIDES
   });
@@ -4211,10 +4251,10 @@ async function npmFix(pkgEnvDetails, {
       const pkgJsonPath = pkgJsonPaths[j];
       const pkgPath = path.dirname(pkgJsonPath);
       const isWorkspaceRoot = pkgJsonPath === pkgEnvDetails.editablePkgJson.filename;
-      const workspaceName = isWorkspaceRoot ? 'root' : path.relative(rootPath, pkgPath);
+      const workspace = isWorkspaceRoot ? 'root' : path.relative(rootPath, pkgPath);
       const oldVersions = arrays.arrayUnique(shadowInject.findPackageNodes(actualTree, name).map(n => n.target?.version ?? n.version).filter(Boolean));
       if (!oldVersions.length) {
-        logger.logger.warn(`Unexpected condition: ${name} not found in node_modules.\n`);
+        debug.debugLog(`${name} not found, skipping.\n`);
         // Skip to next package.
         logger.logger.dedent();
         spinner?.dedent();
@@ -4230,7 +4270,7 @@ async function npmFix(pkgEnvDetails, {
       let hasAnnouncedWorkspace = false;
       let workspaceLogCallCount = logger.logger.logCallCount;
       if (debug.isDebug()) {
-        debug.debugLog(`Checking workspace: ${workspaceName}`);
+        debug.debugLog(`Checking workspace: ${workspace}`);
         hasAnnouncedWorkspace = true;
         workspaceLogCallCount = logger.logger.logCallCount;
       }
@@ -4239,15 +4279,17 @@ async function npmFix(pkgEnvDetails, {
         const oldPurl = utils.idToPurl(oldId);
         const node = shadowInject.findPackageNode(actualTree, name, oldVersion);
         if (!node) {
-          if (hasAnnouncedWorkspace) {
-            logger.logger.warn(`Unexpected condition: Arborist node not found, skipping ${oldId}.`);
-          }
+          debug.debugLog(`${oldId} not found, skipping.`);
           continue oldVersionsLoop;
         }
         infosLoop: for (const {
           firstPatchedVersionIdentifier,
           vulnerableVersionRange
         } of infos.values()) {
+          if (vendor.semverExports.gte(oldVersion, firstPatchedVersionIdentifier)) {
+            debug.debugLog(`${oldId} is >= ${firstPatchedVersionIdentifier}, skipping.`);
+            continue infosLoop;
+          }
           const newVersion = shadowInject.findBestPatchVersion(node, availableVersions, vulnerableVersionRange);
           const newVersionPackument = newVersion ? packument.versions[newVersion] : undefined;
           if (!(newVersion && newVersionPackument)) {
@@ -4281,7 +4323,7 @@ async function npmFix(pkgEnvDetails, {
           if (!(await editablePkgJson.save({
             ignoreWhitespace: true
           }))) {
-            debug.debugLog(`${workspaceName}/package.json not changed, skipping.`);
+            debug.debugLog(`${workspace}/package.json not changed, skipping.`);
             // Reset things just in case.
             if (isCi) {
               // eslint-disable-next-line no-await-in-loop
@@ -4294,7 +4336,7 @@ async function npmFix(pkgEnvDetails, {
             workspaceLogCallCount = logger.logger.logCallCount;
           }
           spinner?.start();
-          spinner?.info(`Installing ${newId} in ${workspaceName}.`);
+          spinner?.info(`Installing ${newId} in ${workspace}.`);
           let error;
           let errored = false;
           try {
@@ -4305,14 +4347,14 @@ async function npmFix(pkgEnvDetails, {
             if (maybeActualTree) {
               actualTree = maybeActualTree;
               if (test) {
-                spinner?.info(`Testing ${newId} in ${workspaceName}.`);
+                spinner?.info(`Testing ${newId} in ${workspace}.`);
                 // eslint-disable-next-line no-await-in-loop
                 await npm.runScript(testScript, [], {
                   spinner,
                   stdio: 'ignore'
                 });
               }
-              spinner?.success(`Fixed ${name} in ${workspaceName}.`);
+              spinner?.success(`Fixed ${name} in ${workspace}.`);
             } else {
               errored = true;
             }
@@ -4334,7 +4376,7 @@ async function npmFix(pkgEnvDetails, {
                 continue infosLoop;
               }
               const repoInfo = getGitHubEnvRepoInfo();
-              const branch = getSocketBranchName(oldPurl, newVersion, workspaceName);
+              const branch = getSocketBranchName(oldPurl, newVersion, workspace);
               let skipPr = false;
               if (
               // eslint-disable-next-line no-await-in-loop
@@ -4348,7 +4390,9 @@ async function npmFix(pkgEnvDetails, {
                 debug.debugLog(`Remote branch "${branch}" exists, skipping PR creation.`);
               } else if (
               // eslint-disable-next-line no-await-in-loop
-              !(await gitCreateAndPushBranch(branch, getSocketCommitMessage(oldPurl, newVersion, workspaceName), moddedFilepaths, cwd))) {
+              !(await gitCreateAndPushBranch(branch, getSocketCommitMessage(oldPurl, newVersion, workspace), moddedFilepaths, {
+                cwd
+              }))) {
                 skipPr = true;
                 logger.logger.warn('Unexpected condition: Push failed, skipping PR creation.');
               }
@@ -4369,14 +4413,15 @@ async function npmFix(pkgEnvDetails, {
               }
 
               // eslint-disable-next-line no-await-in-loop
-              await Promise.allSettled([setGitRemoteGitHubRepoUrl(repoInfo.owner, repoInfo.repo, token, cwd), cleanupOpenPrs(repoInfo.owner, repoInfo.repo, oldPurl, newVersion, {
-                workspaceName
+              await Promise.allSettled([setGitRemoteGitHubRepoUrl(repoInfo.owner, repoInfo.repo, token, cwd), cleanupOpenPrs(repoInfo.owner, repoInfo.repo, newVersion, {
+                purl: oldPurl,
+                workspace
               })]);
               // eslint-disable-next-line no-await-in-loop
               const prResponse = await openPr(repoInfo.owner, repoInfo.repo, branch, oldPurl, newVersion, {
                 baseBranch,
                 cwd,
-                workspaceName
+                workspace
               });
               if (prResponse) {
                 const {
@@ -4442,7 +4487,7 @@ async function npmFix(pkgEnvDetails, {
               }
               actualTree = maybeActualTree;
             }
-            logger.logger.fail(`Update failed for ${oldId} in ${workspaceName}.`, error);
+            logger.logger.fail(`Update failed for ${oldId} in ${workspace}.`, error);
           }
           if (++count >= limit) {
             logger.logger.dedent();
@@ -4478,7 +4523,7 @@ async function getActualTree(cwd = process.cwd()) {
   // folders. However, support is iffy resulting in unhappy path errors and hangs.
   // So, to avoid the unhappy path, we restrict our usage to --dry-run loading
   // of the node_modules folder.
-  const arb = new shadowInject.SafeArborist({
+  const arb = new shadowInject.Arborist({
     path: cwd,
     ...shadowInject.SAFE_ARBORIST_REIFY_OPTIONS_OVERRIDES
   });
@@ -4550,7 +4595,7 @@ async function pnpmFix(pkgEnvDetails, {
   let lockfile = utils.parsePnpmLockfile(lockfileContent);
   // Update pnpm-lock.yaml if its version is older than what the installed pnpm
   // produces.
-  if (lockfileContent && pkgEnvDetails.agentVersion.major >= 10 && utils.parsePnpmLockfileVersion(lockfile?.lockfileVersion)?.major <= 6) {
+  if (lockfileContent && pkgEnvDetails.agentVersion.major >= 10 && (utils.parsePnpmLockfileVersion(lockfile?.lockfileVersion)?.major ?? 0) <= 6) {
     const maybeActualTree = await install(pkgEnvDetails, {
       args: ['--lockfile-only'],
       cwd,
@@ -4643,11 +4688,11 @@ async function pnpmFix(pkgEnvDetails, {
       const pkgJsonPath = pkgJsonPaths[j];
       const pkgPath = path.dirname(pkgJsonPath);
       const isWorkspaceRoot = pkgJsonPath === pkgEnvDetails.editablePkgJson.filename;
-      const workspaceName = isWorkspaceRoot ? 'root' : path.relative(rootPath, pkgPath);
+      const workspace = isWorkspaceRoot ? 'root' : path.relative(rootPath, pkgPath);
 
       // actualTree may not be defined on the first iteration of pkgJsonPathsLoop.
       if (!actualTree) {
-        const maybeActualTree = fs$1.existsSync(path.join(rootPath, 'node_modules')) ?
+        const maybeActualTree = isCi && fs$1.existsSync(path.join(rootPath, 'node_modules')) ?
         // eslint-disable-next-line no-await-in-loop
         await getActualTree(cwd) :
         // eslint-disable-next-line no-await-in-loop
@@ -4670,7 +4715,7 @@ async function pnpmFix(pkgEnvDetails, {
       }
       const oldVersions = arrays.arrayUnique(shadowInject.findPackageNodes(actualTree, name).map(n => n.version).filter(Boolean));
       if (!oldVersions.length) {
-        logger.logger.warn(`Unexpected condition: ${name} not found in node_modules.\n`);
+        debug.debugLog(`${name} not found, skipping.\n`);
         // Skip to next package.
         logger.logger.dedent();
         spinner?.dedent();
@@ -4689,7 +4734,7 @@ async function pnpmFix(pkgEnvDetails, {
       let hasAnnouncedWorkspace = false;
       let workspaceLogCallCount = logger.logger.logCallCount;
       if (debug.isDebug()) {
-        debug.debugLog(`Checking workspace: ${workspaceName}`);
+        debug.debugLog(`Checking workspace: ${workspace}`);
         hasAnnouncedWorkspace = true;
         workspaceLogCallCount = logger.logger.logCallCount;
       }
@@ -4698,15 +4743,17 @@ async function pnpmFix(pkgEnvDetails, {
         const oldPurl = utils.idToPurl(oldId);
         const node = shadowInject.findPackageNode(actualTree, name, oldVersion);
         if (!node) {
-          if (hasAnnouncedWorkspace) {
-            logger.logger.warn(`Unexpected condition: Arborist node not found, skipping ${oldId}.`);
-          }
+          debug.debugLog(`${oldId} not found, skipping.`);
           continue oldVersionsLoop;
         }
         infosLoop: for (const {
           firstPatchedVersionIdentifier,
           vulnerableVersionRange
         } of infos.values()) {
+          if (vendor.semverExports.gte(oldVersion, firstPatchedVersionIdentifier)) {
+            debug.debugLog(`${oldId} is >= ${firstPatchedVersionIdentifier}, skipping.`);
+            continue infosLoop;
+          }
           const newVersion = shadowInject.findBestPatchVersion(node, availableVersions, vulnerableVersionRange);
           const newVersionPackument = newVersion ? packument.versions[newVersion] : undefined;
           if (!(newVersion && newVersionPackument)) {
@@ -4762,7 +4809,7 @@ async function pnpmFix(pkgEnvDetails, {
           if (!(await editablePkgJson.save({
             ignoreWhitespace: true
           }))) {
-            debug.debugLog(`${workspaceName}/package.json not changed, skipping.`);
+            debug.debugLog(`${workspace}/package.json unchanged, skipping.`);
             // Reset things just in case.
             if (isCi) {
               // eslint-disable-next-line no-await-in-loop
@@ -4775,7 +4822,7 @@ async function pnpmFix(pkgEnvDetails, {
             workspaceLogCallCount = logger.logger.logCallCount;
           }
           spinner?.start();
-          spinner?.info(`Installing ${newId} in ${workspaceName}.`);
+          spinner?.info(`Installing ${newId} in ${workspace}.`);
           let error;
           let errored = false;
           try {
@@ -4805,14 +4852,14 @@ async function pnpmFix(pkgEnvDetails, {
                 await fs$1.promises.writeFile(lockfilePath, lockfileContent, 'utf8');
               }
               if (test) {
-                spinner?.info(`Testing ${newId} in ${workspaceName}.`);
+                spinner?.info(`Testing ${newId} in ${workspace}.`);
                 // eslint-disable-next-line no-await-in-loop
                 await npm.runScript(testScript, [], {
                   spinner,
                   stdio: 'ignore'
                 });
               }
-              spinner?.success(`Fixed ${name} in ${workspaceName}.`);
+              spinner?.success(`Fixed ${name} in ${workspace}.`);
             } else {
               errored = true;
             }
@@ -4834,7 +4881,7 @@ async function pnpmFix(pkgEnvDetails, {
                 continue infosLoop;
               }
               const repoInfo = getGitHubEnvRepoInfo();
-              const branch = getSocketBranchName(oldPurl, newVersion, workspaceName);
+              const branch = getSocketBranchName(oldPurl, newVersion, workspace);
               let skipPr = false;
               if (
               // eslint-disable-next-line no-await-in-loop
@@ -4848,7 +4895,9 @@ async function pnpmFix(pkgEnvDetails, {
                 debug.debugLog(`Remote branch "${branch}" exists, skipping PR creation.`);
               } else if (
               // eslint-disable-next-line no-await-in-loop
-              !(await gitCreateAndPushBranch(branch, getSocketCommitMessage(oldPurl, newVersion, workspaceName), moddedFilepaths, cwd))) {
+              !(await gitCreateAndPushBranch(branch, getSocketCommitMessage(oldPurl, newVersion, workspace), moddedFilepaths, {
+                cwd
+              }))) {
                 skipPr = true;
                 logger.logger.warn('Unexpected condition: Push failed, skipping PR creation.');
               }
@@ -4874,14 +4923,15 @@ async function pnpmFix(pkgEnvDetails, {
               }
 
               // eslint-disable-next-line no-await-in-loop
-              await Promise.allSettled([setGitRemoteGitHubRepoUrl(repoInfo.owner, repoInfo.repo, token, cwd), cleanupOpenPrs(repoInfo.owner, repoInfo.repo, oldPurl, newVersion, {
-                workspaceName
+              await Promise.allSettled([setGitRemoteGitHubRepoUrl(repoInfo.owner, repoInfo.repo, token, cwd), cleanupOpenPrs(repoInfo.owner, repoInfo.repo, newVersion, {
+                purl: oldPurl,
+                workspace
               })]);
               // eslint-disable-next-line no-await-in-loop
               const prResponse = await openPr(repoInfo.owner, repoInfo.repo, branch, oldPurl, newVersion, {
                 baseBranch,
                 cwd,
-                workspaceName
+                workspace
               });
               if (prResponse) {
                 const {
@@ -4958,7 +5008,7 @@ async function pnpmFix(pkgEnvDetails, {
                 return;
               }
             }
-            logger.logger.fail(`Update failed for ${oldId} in ${workspaceName}.`, ...(error ? [error] : []));
+            logger.logger.fail(`Update failed for ${oldId} in ${workspace}.`, ...(error ? [error] : []));
           }
           if (++count >= limit) {
             logger.logger.dedent();
@@ -7020,7 +7070,7 @@ async function addOverrides(pkgEnvDetails, pkgPath, options) {
       package: origPkgName,
       version
     } = data;
-    const major = vendor.semverExports.major(version);
+    const major = utils.getMajor(version);
     const sockOverridePrefix = `${NPM$1}:${sockRegPkgName}@`;
     const sockOverrideSpec = `${sockOverridePrefix}${pin ? version : `^${major}`}`;
     for (const {
@@ -7041,7 +7091,7 @@ async function addOverrides(pkgEnvDetails, pkgPath, options) {
         !(thisSpec.startsWith(sockOverridePrefix) &&
         // Check the validity of the spec by passing it through npa and
         // seeing if it will coerce to a version.
-        vendor.semverExports.coerce(vendor.npaExports(thisSpec).rawSpec)?.version)) {
+        vendor.semverExports.coerce(utils.npa(thisSpec).subSpec.rawSpec)?.version)) {
           thisSpec = sockOverrideSpec;
           depObj[origPkgName] = thisSpec;
           state.added.add(sockRegPkgName);
@@ -7085,16 +7135,16 @@ async function addOverrides(pkgEnvDetails, pkgPath, options) {
           } else if (typeof oldSpec === 'string') {
             const thisSpec = oldSpec.startsWith('$') ? depAlias || newSpec : oldSpec || newSpec;
             if (thisSpec.startsWith(sockOverridePrefix)) {
-              if (pin && vendor.semverExports.major(
+              if (pin && utils.getMajor(
               // Check the validity of the spec by passing it through npa
               // and seeing if it will coerce to a version. semver.coerce
               // will strip leading v's, carets (^), comparators (<,<=,>,>=,=),
               // and tildes (~). If not coerced to a valid version then
               // default to the manifest entry version.
-              vendor.semverExports.coerce(vendor.npaExports(thisSpec).rawSpec)?.version ?? version) !== major) {
+              vendor.semverExports.coerce(utils.npa(thisSpec).subSpec.rawSpec)?.version ?? version) !== major) {
                 const otherVersion = (await packages.fetchPackageManifest(thisSpec))?.version;
                 if (otherVersion && otherVersion !== version) {
-                  newSpec = `${sockOverridePrefix}${pin ? otherVersion : `^${vendor.semverExports.major(otherVersion)}`}`;
+                  newSpec = `${sockOverridePrefix}${pin ? otherVersion : `^${utils.getMajor(otherVersion)}`}`;
                 }
               }
             } else {
@@ -12652,5 +12702,5 @@ void (async () => {
     await utils.captureException(e);
   }
 })();
-//# debugId=726ab9a5-2bd9-4713-bdc1-f8860b83f478
+//# debugId=fc951913-c543-4f4f-aef4-8c8e6d016539
 //# sourceMappingURL=cli.js.map