@socketsecurity/cli-with-sentry 1.1.134 → 1.1.136

package/CHANGELOG.md

@@ -4,6 +4,20 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## [1.1.136](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.136) - 2026-07-02
+
+### Changed
+- `socket manifest gradle --facts` now reports Gradle configurations it can't resolve instead of silently skipping them, failing the run unless you pass `--ignore-unresolved` so an incomplete scan can't slip by. Benign variant-selection ambiguity stays a one-line notice.
+- Config filters (`--include-configs` / `--exclude-configs`) for `socket manifest gradle`, `kotlin`, `scala`, and `maven` are now case-sensitive, as documented, and support `[...]` character classes — e.g. `*[Tt]est*` matches both `testCompileClasspath` and `androidTestCompileClasspath`.
+
+### Fixed
+- `socket manifest auto` and `socket scan create --auto-manifest` now detect a Gradle project by its build files (`build.gradle`/`.kts` or `settings.gradle`/`.kts`) instead of requiring a `gradlew` wrapper, so wrapper-less projects — including settings-only multi-module roots — are no longer skipped.
+
+## [1.1.135](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.135) - 2026-07-01
+
+### Changed
+- Updated the Coana CLI to v `15.6.7`.
+
 ## [1.1.134](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.134) - 2026-07-01
 
 ### Fixed

package/dist/cli.js

@@ -1953,7 +1953,9 @@ sockJson, cwd = process.cwd()) {
   }
   if (sockJson?.defaults?.manifest?.gradle?.disabled) {
     require$$9.debugLog('notice', `[DEBUG] - gradle auto-detection is disabled in ${constants.SOCKET_JSON}`);
-  } else if (fs$1.existsSync(path.join(cwd, 'gradlew'))) {
+  } else if (fs$1.existsSync(path.join(cwd, 'build.gradle')) || fs$1.existsSync(path.join(cwd, 'build.gradle.kts')) || fs$1.existsSync(path.join(cwd, 'settings.gradle')) || fs$1.existsSync(path.join(cwd, 'settings.gradle.kts'))) {
+    // Detect by build descriptor, not the `gradlew` wrapper (a project can build via
+    // `gradle` on PATH). `settings.gradle(.kts)` covers Kotlin-DSL roots with no root build script.
     require$$9.debugLog('notice', '[DEBUG] - Detected a gradle build file');
     output.gradle = true;
     output.count += 1;
@@ -4284,8 +4286,9 @@ function classifyGradleFailure(detail) {
   if (t.includes('conflict on capability')) {
     return 'capability-conflict';
   }
-  // Zero compatible variants — the opposite of ambiguity below.
-  if (t.includes('no matching variant') || t.includes('no variants of')) {
+  // Zero compatible variants — the opposite of ambiguity below. Gradle phrases
+  // this several ways depending on version and whether attributes were supplied.
+  if (t.includes('no matching variant') || t.includes('no variants of') || t.includes('unable to find a matching variant') || t.includes('no compatible variant')) {
     return 'no-matching-variant';
   }
   if (t.includes('cannot choose between')) {
@@ -4459,6 +4462,8 @@ function firstLine(s) {
 // classifier/type, so relating a failed and a succeeded dep is unsound.
 function renderResolutionReport(failures, scannedConfigs, dialect, opts = {}) {
   const name = dialect.label;
+  const unscannable = opts.unscannable ?? [];
+  const unscannableConfigs = new Set(unscannable.map(u => u.config));
   const specOf = new Map(dialect.categories.map(c => [c.key, c]));
   const isBlocking = cat => specOf.get(cat)?.blocking ?? true;
 
@@ -4485,16 +4490,31 @@ function renderResolutionReport(failures, scannedConfigs, dialect, opts = {}) {
     }
   }
   const allInfos = [...byKey.values()];
-  const blockingConfigs = new Set();
+
+  // A whole-config throw is classified by the same cause rules as a per-dep
+  // failure: ambiguity stays lenient, every other cause is fail-closed.
+  const unscannableInfos = unscannable.map(u => {
+    const category = dialect.classify(u.detail);
+    return {
+      ...u,
+      category,
+      blocking: isBlocking(category)
+    };
+  });
+  const blockingUnscannable = unscannableInfos.filter(u => u.blocking);
+  const nonBlockingUnscannable = unscannableInfos.filter(u => !u.blocking);
+  const perDepBlockingConfigs = new Set();
   for (const info of allInfos) {
     if (isBlocking(info.category)) {
       for (const c of info.configs) {
-        blockingConfigs.add(c);
+        perDepBlockingConfigs.add(c);
       }
     }
   }
+  const blockingConfigs = new Set([...perDepBlockingConfigs, ...blockingUnscannable.map(u => u.config)]);
   const blockingFailed = [...blockingConfigs].sort();
-  const succeeded = scannedConfigs.filter(c => !blockingConfigs.has(c)).sort();
+  // An un-scannable config was attempted but resolved nothing, so it didn't succeed.
+  const succeeded = scannedConfigs.filter(c => !blockingConfigs.has(c) && !unscannableConfigs.has(c)).sort();
   const groups = dialect.categories.map(spec => ({
     spec,
     infos: dedupCoords(allInfos.filter(i => i.category === spec.key).map(i => i.coord)).map(c => byKey.get(keyOf(c, spec.key)))
@@ -4502,24 +4522,41 @@ function renderResolutionReport(failures, scannedConfigs, dialect, opts = {}) {
   const blockingGroups = groups.filter(g => g.spec.blocking);
   const nonBlockingGroups = groups.filter(g => !g.spec.blocking);
   const blockingCount = blockingGroups.reduce((n, g) => n + g.infos.length, 0);
-  const hasBlockingFailures = blockingCount > 0;
+  const hasBlockingFailures = blockingCount > 0 || blockingUnscannable.length > 0;
   const willFail = hasBlockingFailures && !opts.ignoreUnresolved;
   const out = [];
   if (hasBlockingFailures) {
-    out.push(opts.ignoreUnresolved ? `Ignored ${blockingCount} unresolved dependency(ies) in ${blockingFailed.length} configuration(s):` : `Could not resolve ${blockingCount} dependency(ies) in ${blockingFailed.length} configuration(s):`);
-    for (const {
-      infos,
-      spec
-    } of blockingGroups) {
-      out.push('');
-      out.push(spec.header ? spec.header(name) : '');
-      for (const info of infos.slice(0, RESOLUTION_REPORT_ARTIFACT_LIMIT)) {
-        const fl = firstLine(info.detail);
-        const reasonSuffix = spec.showReason && fl ? `  [${fl}]` : '';
-        out.push(`    - ${info.coord}${reasonSuffix}`);
+    if (blockingCount > 0) {
+      out.push(opts.ignoreUnresolved ? `Ignored ${blockingCount} unresolved dependency(ies) in ${perDepBlockingConfigs.size} configuration(s):` : `Could not resolve ${blockingCount} dependency(ies) in ${perDepBlockingConfigs.size} configuration(s):`);
+      for (const {
+        infos,
+        spec
+      } of blockingGroups) {
+        out.push('');
+        out.push(spec.header ? spec.header(name) : '');
+        for (const info of infos.slice(0, RESOLUTION_REPORT_ARTIFACT_LIMIT)) {
+          const fl = firstLine(info.detail);
+          const reasonSuffix = spec.showReason && fl ? `  [${fl}]` : '';
+          out.push(`    - ${info.coord}${reasonSuffix}`);
+        }
+        if (infos.length > RESOLUTION_REPORT_ARTIFACT_LIMIT) {
+          out.push(`    … and ${infos.length - RESOLUTION_REPORT_ARTIFACT_LIMIT} more`);
+        }
+      }
+    }
+    if (blockingUnscannable.length) {
+      // Separate from the per-dep block above, but only if there is one — otherwise
+      // the summary would lead with a blank line (a dangling ✗ under logger.fail).
+      if (out.length) {
+        out.push('');
+      }
+      out.push(opts.ignoreUnresolved ? `Ignored ${blockingUnscannable.length} configuration(s) that could not be scanned:` : `Could not scan ${blockingUnscannable.length} configuration(s) (reason from ${name}):`);
+      for (const u of blockingUnscannable.slice(0, RESOLUTION_REPORT_CONFIG_LIMIT)) {
+        const fl = firstLine(u.detail);
+        out.push(`    - ${u.config}${fl ? `  [${fl}]` : ''}`);
       }
-      if (infos.length > RESOLUTION_REPORT_ARTIFACT_LIMIT) {
-        out.push(`    … and ${infos.length - RESOLUTION_REPORT_ARTIFACT_LIMIT} more`);
+      if (blockingUnscannable.length > RESOLUTION_REPORT_CONFIG_LIMIT) {
+        out.push(`    … and ${blockingUnscannable.length - RESOLUTION_REPORT_CONFIG_LIMIT} more`);
       }
     }
     out.push('');
@@ -4551,6 +4588,12 @@ function renderResolutionReport(failures, scannedConfigs, dialect, opts = {}) {
     const configCount = new Set(infos.flatMap(i => [...i.configs])).size;
     notices.push(spec.notice(name, infos.length, configCount));
   }
+  // A config-level throw whose cause classifies as variant ambiguity is surfaced, not failed —
+  // matching the deliberately-lenient per-dep variant-ambiguity policy.
+  if (nonBlockingUnscannable.length) {
+    const n = new Set(nonBlockingUnscannable.map(u => u.config)).size;
+    notices.push(`Could not scan ${n} configuration(s) — re-run with --verbose for ${name}'s messages.`);
+  }
   const detailLines = [`${name}'s full message for each unresolved dependency:`];
   for (const info of allInfos) {
     detailLines.push('');
@@ -4559,6 +4602,17 @@ function renderResolutionReport(failures, scannedConfigs, dialect, opts = {}) {
       detailLines.push(`    ${line}`);
     }
   }
+  if (unscannable.length) {
+    detailLines.push('');
+    detailLines.push(`${name} configurations that could not be scanned:`);
+    for (const u of unscannable) {
+      detailLines.push('');
+      detailLines.push(`  ${u.config}:`);
+      for (const line of (u.detail || '(no message)').split('\n')) {
+        detailLines.push(`    ${line}`);
+      }
+    }
+  }
   return {
     summary: out.join('\n'),
     details: detailLines.join('\n'),
@@ -4937,9 +4991,19 @@ function buildReport(parsed) {
     seen.add(key);
     return true;
   });
+  const seenUnscannable = new Set();
+  const unscannable = parsed.unscannable.filter(u => {
+    const key = `${u.config}|${u.detail}`;
+    if (seenUnscannable.has(key)) {
+      return false;
+    }
+    seenUnscannable.add(key);
+    return true;
+  });
   return {
     failures,
-    scannedConfigs: parsed.scannedConfigs
+    scannedConfigs: parsed.scannedConfigs,
+    unscannable
   };
 }
 
@@ -4985,6 +5049,7 @@ function resolveBuildToolBin(tool, projectDir, bin) {
 //   file        rootId  coordId  path                    (--with-files only)
 //   scanned     config
 //   failure     coord  detail  config
+//   unscannable config  detail
 //
 // A `root` is one (subproject, configuration) resolution root; `coordId` is the
 // coordinate key (`group:name:ext:classifier:version`, empty segments dropped),
@@ -5017,7 +5082,8 @@ function parseRecords(text) {
     projects: new Map(),
     roots: new Map(),
     scannedConfigs: [],
-    failures: []
+    failures: [],
+    unscannable: []
   };
   const scanned = new Set();
   const root = id => {
@@ -5138,6 +5204,14 @@ function parseRecords(text) {
           });
         }
         break;
+      case 'unscannable':
+        if (f[1]) {
+          result.unscannable.push({
+            config: f[1],
+            detail: f[2] ?? ''
+          });
+        }
+        break;
     }
   }
   result.scannedConfigs = [...scanned].sort();
@@ -5448,7 +5522,8 @@ async function runManifestFacts({
     stdout
   } = result;
   const rendered = renderResolutionErrorReport(report.failures, report.scannedConfigs, ecosystem, {
-    ignoreUnresolved
+    ignoreUnresolved,
+    unscannable: report.unscannable
   });
   if (rendered.hasBlockingFailures) {
     if (ignoreUnresolved) {
@@ -5475,7 +5550,7 @@ async function runManifestFacts({
   // exception in the extension. The build tool's own exit is the only signal, so
   // fail closed rather than silently dropping the ecosystem with an empty SBOM
   // (the empty-facts branch below would otherwise just log "nothing to upload").
-  if (code !== 0 && !facts.components.length && !facts.projects?.length && !report.failures.length) {
+  if (code !== 0 && !facts.components.length && !facts.projects?.length && !report.failures.length && !report.unscannable.length) {
     if (!verbose) {
       const tail = tailBuildOutput(stdout, stderr);
       if (tail) {
@@ -11502,7 +11577,7 @@ const config$c = {
     },
     includeConfigs: {
       type: 'string',
-      description: 'When generating facts: comma-separated glob patterns matched against Gradle configuration names (case-sensitive, `*` and `?` wildcards). Only configurations matching at least one pattern are resolved. e.g. `*CompileClasspath,*RuntimeClasspath`. Default: every resolvable configuration except AGP instrumented-test classpaths'
+      description: 'When generating facts: comma-separated glob patterns matched against Gradle configuration names (case-sensitive; `*`, `?`, and `[...]` wildcards). Only configurations matching at least one pattern are resolved. e.g. `*CompileClasspath,*RuntimeClasspath`. Default: every resolvable configuration'
     },
     excludeConfigs: {
       type: 'string',
@@ -11748,7 +11823,7 @@ const config$b = {
     },
     includeConfigs: {
       type: 'string',
-      description: 'When generating facts: comma-separated glob patterns matched against Gradle configuration names (case-sensitive, `*` and `?` wildcards). Only configurations matching at least one pattern are resolved. e.g. `*CompileClasspath,*RuntimeClasspath`. Default: every resolvable configuration except AGP instrumented-test classpaths'
+      description: 'When generating facts: comma-separated glob patterns matched against Gradle configuration names (case-sensitive; `*`, `?`, and `[...]` wildcards). Only configurations matching at least one pattern are resolved. e.g. `*CompileClasspath,*RuntimeClasspath`. Default: every resolvable configuration'
     },
     excludeConfigs: {
       type: 'string',
@@ -11979,7 +12054,7 @@ const config$a = {
     },
     includeConfigs: {
       type: 'string',
-      description: 'Comma-separated glob patterns matched against Maven dependency scopes (case-sensitive, `*` and `?` wildcards). Only scopes matching at least one pattern are resolved. e.g. `compile,runtime`. Default: every scope'
+      description: 'Comma-separated glob patterns matched against Maven dependency scopes (case-sensitive; `*`, `?`, and `[...]` wildcards). Only scopes matching at least one pattern are resolved. e.g. `compile,runtime`. Default: every scope'
     },
     excludeConfigs: {
       type: 'string',
@@ -12171,7 +12246,7 @@ const config$9 = {
     },
     includeConfigs: {
       type: 'string',
-      description: 'When generating facts: comma-separated glob patterns matched against sbt configuration names (case-sensitive, `*` and `?` wildcards). Only configurations matching at least one pattern are resolved. e.g. `compile,test`. Default: compile,optional,provided,runtime,test'
+      description: 'When generating facts: comma-separated glob patterns matched against sbt configuration names (case-sensitive; `*`, `?`, and `[...]` wildcards). Only configurations matching at least one pattern are resolved. e.g. `compile,test`. Default: compile,optional,provided,runtime,test'
     },
     excludeConfigs: {
       type: 'string',
@@ -21840,5 +21915,5 @@ process.on('unhandledRejection', async (reason, promise) => {
   // eslint-disable-next-line n/no-process-exit
   process.exit(1);
 });
-//# debugId=d8a70f18-1fe0-4a46-92e4-b0faf786bd57
+//# debugId=7e8416d5-be6a-4d93-954d-13ea1803d95e
 //# sourceMappingURL=cli.js.map