@socketsecurity/cli-with-sentry 1.0.98 → 1.0.100

package/dist/cli.js

@@ -3371,6 +3371,62 @@ async function cacheFetch(key, fetcher, ttlMs) {
   }
   return data;
 }
+async function fetchGhsaDetails(ids) {
+  const results = new Map();
+  if (!ids.length) {
+    return results;
+  }
+  const octokitGraphql = getOctokitGraphql();
+  try {
+    const gqlCacheKey = `${ids.join('-')}-graphql-snapshot`;
+    const gqlResp = await cacheFetch(gqlCacheKey, () => octokitGraphql(`
+        query($identifiers: [SecurityAdvisoryIdentifierFilter!]!) {
+          securityAdvisories(first: ${ids.length}, identifiers: $identifiers) {
+            nodes {
+              ghsaId
+              cveId
+              summary
+              severity
+              publishedAt
+              withdrawnAt
+              references {
+                url
+              }
+              vulnerabilities(first: 10) {
+                nodes {
+                  package {
+                    ecosystem
+                    name
+                  }
+                  vulnerableVersionRange
+                }
+              }
+            }
+          }
+        }`, {
+      identifiers: ids.map(id => ({
+        type: 'GHSA',
+        value: id
+      }))
+    }));
+    const advisories = gqlResp?.securityAdvisories?.nodes || [];
+    for (const advisory of advisories) {
+      if (advisory.ghsaId) {
+        results.set(advisory.ghsaId, advisory);
+      }
+    }
+
+    // Log any missing advisories
+    for (const id of ids) {
+      if (!results.has(id)) {
+        require$$8.debugFn('notice', `No advisory found for ${id}`);
+      }
+    }
+  } catch (e) {
+    require$$8.debugFn('error', `Failed to fetch GHSA details: ${e?.message || 'Unknown error'}`);
+  }
+  return results;
+}
 async function cleanupPrs(owner, repo, options) {
   const contextualMatches = await getSocketPrsWithContext(owner, repo, options);
   if (!contextualMatches.length) {
@@ -3454,9 +3510,8 @@ async function enablePrAutoMerge({
   node_id: prId
 }) {
   const octokitGraphql = getOctokitGraphql();
-  let error;
   try {
-    const response = await octokitGraphql(`
+    const gqlResp = await octokitGraphql(`
       mutation EnableAutoMerge($pullRequestId: ID!) {
         enablePullRequestAutoMerge(input: {
           pullRequestId: $pullRequestId,
@@ -3469,23 +3524,22 @@ async function enablePrAutoMerge({
       }`, {
       pullRequestId: prId
     });
-    const respPrNumber = response?.enablePullRequestAutoMerge?.pullRequest?.number;
+    const respPrNumber = gqlResp?.enablePullRequestAutoMerge?.pullRequest?.number;
     if (respPrNumber) {
       return {
         enabled: true
       };
     }
   } catch (e) {
-    error = e;
-  }
-  if (error instanceof vendor.GraphqlResponseError && Array.isArray(error.errors) && error.errors.length) {
-    const details = error.errors.map(({
-      message: m
-    }) => m.trim());
-    return {
-      enabled: false,
-      details
-    };
+    if (e instanceof vendor.GraphqlResponseError && Array.isArray(e.errors) && e.errors.length) {
+      const details = e.errors.map(({
+        message: m
+      }) => m.trim());
+      return {
+        enabled: false,
+        details
+      };
+    }
   }
   return {
     enabled: false
@@ -3654,7 +3708,8 @@ async function openPr(owner, repo, branch, purl, newVersion, options) {
 }
 async function openCoanaPr(owner, repo, branch, ghsaIds, options) {
   const {
-    baseBranch = 'main'
+    baseBranch = 'main',
+    ghsaDetails
   } = {
     __proto__: null,
     ...options
@@ -3664,9 +3719,23 @@ async function openCoanaPr(owner, repo, branch, ghsaIds, options) {
   const prTitle = vulnCount === 1 ? `Fix for ${ghsaIds[0]}` : `Fixes for ${vulnCount} GHSAs`;
   let prBody = '';
   if (vulnCount === 1) {
-    prBody = `[Socket](https://socket.dev/) fix for [${ghsaIds[0]}](https://github.com/advisories/${ghsaIds[0]}).`;
+    const ghsaId = ghsaIds[0];
+    const details = ghsaDetails?.get(ghsaId);
+    prBody = `[Socket](https://socket.dev/) fix for [${ghsaId}](https://github.com/advisories/${ghsaId}).`;
+    if (details) {
+      const packages = details.vulnerabilities.nodes.map(v => `${v.package.name} (${v.package.ecosystem})`);
+      prBody += ['', '', `**Vulnerability Summary:** ${details.summary}`, '', `**Severity:** ${details.severity}`, '', `**Affected Packages:** ${arrays.joinAnd(packages)}`].join('\n');
+    }
   } else {
-    prBody = `[Socket](https://socket.dev/) fixes for ${vulnCount} GHSAs.\n\n**Fixed GHSAs:**\n${ghsaIds.map(id => `- [${id}](https://github.com/advisories/${id})`).join('\n')}`;
+    prBody = [`[Socket](https://socket.dev/) fixes for ${vulnCount} GHSAs.`, '', '**Fixed Vulnerabilities:**', ...ghsaIds.map(id => {
+      const details = ghsaDetails?.get(id);
+      const item = `- [${id}](https://github.com/advisories/${id})`;
+      if (details) {
+        const packages = details.vulnerabilities.nodes.map(v => `${v.package.name}`);
+        return `${item} - ${details.summary} (${arrays.joinAnd(packages)})`;
+      }
+      return item;
+    })].join('\n');
   }
   try {
     const octokitPullsCreateParams = {
@@ -3869,6 +3938,9 @@ async function coanaFix(fixConfig) {
       }
     };
   }
+  require$$8.debugFn('notice', `fetch: ${ids.length} GHSA details for ${arrays.joinAnd(ids)}`);
+  const ghsaDetails = await fetchGhsaDetails(ids);
+  require$$8.debugFn('notice', `found: ${ghsaDetails.size} GHSA details`);
   const scanBaseNames = new Set(scanFilepaths.map(p => path.basename(p)));
   let count = 0;
   let overallFixed = false;
@@ -3878,7 +3950,7 @@ async function coanaFix(fixConfig) {
       length
     } = ids; i < length; i += 1) {
     const id = ids[i];
-    require$$8.debugFn('notice', `Processing GHSA ID: ${id}`);
+    require$$8.debugFn('notice', `check: ${id}`);
 
     // Apply fix for single GHSA ID.
     // eslint-disable-next-line no-await-in-loop
@@ -3900,25 +3972,25 @@ async function coanaFix(fixConfig) {
       continue ghsaLoop;
     }
     overallFixed = true;
-
-    // Create PR if in CI environment
+    const branch = `socket/fix/${id}`;
     try {
-      const branch = `socket/coana-fix/${id}`;
-
-      // Check if branch already exists
+      // Check if branch already exists.
       // eslint-disable-next-line no-await-in-loop
       if (await utils.gitRemoteBranchExists(branch, cwd)) {
         require$$8.debugFn('notice', `skip: remote branch "${branch}" exists`);
         continue ghsaLoop;
       }
       require$$8.debugFn('notice', `pr: creating for ${id}`);
+      const details = ghsaDetails.get(id);
+      const summary = details?.summary;
+      require$$8.debugFn('notice', `ghsa: ${id} details ${details ? 'found' : 'missing'}`);
       const pushed =
       // eslint-disable-next-line no-await-in-loop
       (await utils.gitCreateBranch(branch, cwd)) && (
       // eslint-disable-next-line no-await-in-loop
       await utils.gitCheckoutBranch(branch, cwd)) && (
       // eslint-disable-next-line no-await-in-loop
-      await utils.gitCommit(`fix: Apply Coana security fix for ${id}`, modifiedFiles, {
+      await utils.gitCommit(`fix: ${id}${summary ? ` - ${summary}` : ''}`, modifiedFiles, {
         cwd,
         email: fixEnv.gitEmail,
         user: fixEnv.gitUser
@@ -3945,7 +4017,8 @@ async function coanaFix(fixConfig) {
       // Single GHSA ID.
       [id], {
         baseBranch: fixEnv.baseBranch,
-        cwd
+        cwd,
+        ghsaDetails
       });
       if (prResponse) {
         const {
@@ -3988,7 +4061,7 @@ async function coanaFix(fixConfig) {
       await utils.gitCheckoutBranch(fixEnv.baseBranch, cwd);
     }
     count += 1;
-    require$$8.debugFn('notice', `Processed ${count}/${Math.min(limit, ids.length)} fixes`);
+    require$$8.debugFn('notice', `increment: count ${count}/${Math.min(limit, ids.length)}`);
     if (count >= limit) {
       break ghsaLoop;
     }
@@ -15460,5 +15533,5 @@ void (async () => {
     await utils.captureException(e);
   }
 })();
-//# debugId=293e0fae-5f8d-4051-915d-b3c213feafed
+//# debugId=ae8893ee-c6c6-456e-8176-51ca01466ef5
 //# sourceMappingURL=cli.js.map