@socketsecurity/cli-with-sentry 1.1.27 → 1.1.29

package/CHANGELOG.md

@@ -4,6 +4,16 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## [1.1.29](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.29) - 2025-11-16
+
+### Added
+- Added options `--reach-concurrency <number>` and `--reach-disable-analysis-splitting` for `socket scan create --reach`
+
+## [1.1.28](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.28) - 2025-11-13
+
+### Added
+- Backported `socket fix` with `--json` improvements
+
 ## [1.1.27](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.27) - 2025-11-12
 
 ### Added

package/dist/cli.js

@@ -18,6 +18,7 @@ var prompts = require('../external/@socketsecurity/registry/lib/prompts');
 var spawn = require('../external/@socketsecurity/registry/lib/spawn');
 var fs$2 = require('../external/@socketsecurity/registry/lib/fs');
 var strings = require('../external/@socketsecurity/registry/lib/strings');
+var os = require('node:os');
 var path$1 = require('../external/@socketsecurity/registry/lib/path');
 var require$$11 = require('../external/@socketsecurity/registry/lib/objects');
 var registry = require('../external/@socketsecurity/registry');
@@ -26,7 +27,6 @@ var require$$12 = require('../external/@socketsecurity/registry/lib/promises');
 var regexps = require('../external/@socketsecurity/registry/lib/regexps');
 var require$$0$1 = require('node:crypto');
 var require$$1 = require('node:util');
-var os = require('node:os');
 var promises = require('node:stream/promises');
 
 var _documentCurrentScript = typeof document !== 'undefined' ? document.currentScript : null;
@@ -1631,7 +1631,7 @@ async function performReachabilityAnalysis(options) {
   spinner?.infoAndStop('Running reachability analysis with Coana...');
 
   // Build Coana arguments.
-  const coanaArgs = ['run', cwd, '--output-dir', cwd, '--socket-mode', constants.default.DOT_SOCKET_DOT_FACTS_JSON, '--disable-report-submission', ...(reachabilityOptions.reachAnalysisTimeout ? ['--analysis-timeout', `${reachabilityOptions.reachAnalysisTimeout}`] : []), ...(reachabilityOptions.reachAnalysisMemoryLimit ? ['--memory-limit', `${reachabilityOptions.reachAnalysisMemoryLimit}`] : []), ...(reachabilityOptions.reachDisableAnalytics ? ['--disable-analytics-sharing'] : []), ...(tarHash ? ['--run-without-docker', '--manifests-tar-hash', tarHash] : []),
+  const coanaArgs = ['run', cwd, '--output-dir', cwd, '--socket-mode', constants.default.DOT_SOCKET_DOT_FACTS_JSON, '--disable-report-submission', ...(reachabilityOptions.reachAnalysisTimeout ? ['--analysis-timeout', `${reachabilityOptions.reachAnalysisTimeout}`] : []), ...(reachabilityOptions.reachAnalysisMemoryLimit ? ['--memory-limit', `${reachabilityOptions.reachAnalysisMemoryLimit}`] : []), ...(reachabilityOptions.reachConcurrency ? ['--concurrency', `${reachabilityOptions.reachConcurrency}`] : []), ...(reachabilityOptions.reachDisableAnalytics ? ['--disable-analytics-sharing'] : []), ...(reachabilityOptions.reachDisableAnalysisSplitting ? ['--disable-analysis-splitting'] : []), ...(tarHash ? ['--run-without-docker', '--manifests-tar-hash', tarHash] : []),
   // Empty reachEcosystems implies scanning all ecosystems.
   ...(reachabilityOptions.reachEcosystems.length ? ['--purl-types', ...reachabilityOptions.reachEcosystems] : []), ...(reachabilityOptions.reachExcludePaths.length ? ['--exclude-dirs', ...reachabilityOptions.reachExcludePaths] : []), ...(reachabilityOptions.reachSkipCache ? ['--skip-cache-usage'] : [])];
 
@@ -2371,7 +2371,9 @@ async function handleCi(autoManifest) {
     reach: {
       reachAnalysisTimeout: 0,
       reachAnalysisMemoryLimit: 0,
+      reachConcurrency: 1,
       reachDisableAnalytics: false,
+      reachDisableAnalysisSplitting: false,
       reachEcosystems: [],
       reachExcludePaths: [],
       reachSkipCache: false,
@@ -3631,18 +3633,47 @@ async function coanaFix(fixConfig) {
         }
       };
     }
-    const fixCResult = await utils.spawnCoanaDlx(['compute-fixes-and-upgrade-purls', cwd, '--manifests-tar-hash', tarHash, '--apply-fixes-to', ...(isAll ? ['all'] : ghsas), ...(fixConfig.rangeStyle ? ['--range-style', fixConfig.rangeStyle] : []), ...(minimumReleaseAge ? ['--minimum-release-age', minimumReleaseAge] : []), ...(include.length ? ['--include', ...include] : []), ...(exclude.length ? ['--exclude', ...exclude] : []), ...(!applyFixes ? [constants.FLAG_DRY_RUN] : []), ...(outputFile ? ['--output-file', outputFile] : []), ...(disableMajorUpdates ? ['--disable-major-updates'] : []), ...(showAffectedDirectDependencies ? ['--show-affected-direct-dependencies'] : []), ...fixConfig.unknownFlags], fixConfig.orgSlug, {
-      cwd,
-      spinner,
-      stdio: 'inherit'
-    });
-    spinner?.stop();
-    return fixCResult.ok ? {
-      ok: true,
-      data: {
-        fixed: true
+
+    // Create a temporary file for the output.
+    const tmpDir = os.tmpdir();
+    const tmpFile = path.join(tmpDir, `socket-fix-${Date.now()}.json`);
+    try {
+      const fixCResult = await utils.spawnCoanaDlx(['compute-fixes-and-upgrade-purls', cwd, '--manifests-tar-hash', tarHash, '--apply-fixes-to', ...(isAll ? ['all'] : ghsas), ...(fixConfig.rangeStyle ? ['--range-style', fixConfig.rangeStyle] : []), ...(minimumReleaseAge ? ['--minimum-release-age', minimumReleaseAge] : []), ...(include.length ? ['--include', ...include] : []), ...(exclude.length ? ['--exclude', ...exclude] : []), ...(!applyFixes ? [constants.FLAG_DRY_RUN] : []), '--output-file', tmpFile, ...(disableMajorUpdates ? ['--disable-major-updates'] : []), ...(showAffectedDirectDependencies ? ['--show-affected-direct-dependencies'] : []), ...fixConfig.unknownFlags], fixConfig.orgSlug, {
+        cwd,
+        spinner,
+        stdio: 'inherit'
+      });
+      spinner?.stop();
+      if (!fixCResult.ok) {
+        return fixCResult;
       }
-    } : fixCResult;
+
+      // Read the temporary file to get the actual fixes result.
+      const fixesResultJson = fs$2.readJsonSync(tmpFile, {
+        throws: false
+      });
+
+      // Copy to outputFile if provided.
+      if (outputFile) {
+        logger.logger.info(`Copying fixes result to ${outputFile}`);
+        const tmpContent = await fs$1.promises.readFile(tmpFile, 'utf8');
+        await fs$1.promises.writeFile(outputFile, tmpContent, 'utf8');
+      }
+      return {
+        ok: true,
+        data: {
+          data: fixesResultJson,
+          fixed: true
+        }
+      };
+    } finally {
+      // Clean up the temporary file.
+      try {
+        await fs$1.promises.unlink(tmpFile);
+      } catch (e) {
+        // Ignore cleanup errors.
+      }
+    }
   }
 
   // Adjust limit based on open Socket Fix PRs.
@@ -3967,8 +3998,10 @@ async function handleFix({
     include,
     limit,
     minimumReleaseAge,
+    minSatisfying,
     orgSlug,
     outputFile,
+    prCheck,
     rangeStyle,
     showAffectedDirectDependencies,
     spinner,
@@ -10827,11 +10860,21 @@ const reachabilityFlags = {
     default: 0,
     description: 'Set timeout for the reachability analysis. Split analysis runs may cause the total scan time to exceed this timeout significantly.'
   },
+  reachConcurrency: {
+    type: 'number',
+    default: 1,
+    description: 'Set the maximum number of concurrent reachability analysis runs. It is recommended to choose a concurrency level that ensures each analysis run has at least the --reach-analysis-memory-limit amount of memory available. NPM reachability analysis does not support concurrent execution, so the concurrency level is ignored for NPM.'
+  },
   reachDisableAnalytics: {
     type: 'boolean',
     default: false,
     description: 'Disable reachability analytics sharing with Socket. Also disables caching-based optimizations.'
   },
+  reachDisableAnalysisSplitting: {
+    type: 'boolean',
+    default: false,
+    description: 'Limits Coana to at most 1 reachability analysis run per workspace.'
+  },
   reachEcosystems: {
     type: 'string',
     isMultiple: true,
@@ -11050,6 +11093,8 @@ async function run$d(argv, importMeta, {
     reach,
     reachAnalysisMemoryLimit,
     reachAnalysisTimeout,
+    reachConcurrency,
+    reachDisableAnalysisSplitting,
     reachDisableAnalytics,
     reachSkipCache,
     readOnly,
@@ -11177,8 +11222,9 @@ async function run$d(argv, importMeta, {
   const hasReachExcludePaths = reachExcludePaths.length > 0;
   const isUsingNonDefaultMemoryLimit = reachAnalysisMemoryLimit !== reachabilityFlags['reachAnalysisMemoryLimit']?.default;
   const isUsingNonDefaultTimeout = reachAnalysisTimeout !== reachabilityFlags['reachAnalysisTimeout']?.default;
+  const isUsingNonDefaultConcurrency = reachConcurrency !== reachabilityFlags['reachConcurrency']?.default;
   const isUsingNonDefaultAnalytics = reachDisableAnalytics !== reachabilityFlags['reachDisableAnalytics']?.default;
-  const isUsingAnyReachabilityFlags = isUsingNonDefaultMemoryLimit || isUsingNonDefaultTimeout || isUsingNonDefaultAnalytics || hasReachEcosystems || hasReachExcludePaths || reachSkipCache;
+  const isUsingAnyReachabilityFlags = isUsingNonDefaultMemoryLimit || isUsingNonDefaultTimeout || isUsingNonDefaultConcurrency || isUsingNonDefaultAnalytics || hasReachEcosystems || hasReachExcludePaths || reachSkipCache || reachDisableAnalysisSplitting;
   const wasValidInput = utils.checkCommandInput(outputKind, {
     nook: true,
     test: !!orgSlug,
@@ -11239,6 +11285,8 @@ async function run$d(argv, importMeta, {
       reachDisableAnalytics: Boolean(reachDisableAnalytics),
       reachAnalysisTimeout: Number(reachAnalysisTimeout),
       reachAnalysisMemoryLimit: Number(reachAnalysisMemoryLimit),
+      reachConcurrency: Number(reachConcurrency),
+      reachDisableAnalysisSplitting: Boolean(reachDisableAnalysisSplitting),
       reachEcosystems,
       reachExcludePaths,
       reachSkipCache: Boolean(reachSkipCache)
@@ -11884,6 +11932,8 @@ async function scanOneRepo(repoSlug, {
       reachDisableAnalytics: false,
       reachAnalysisTimeout: 0,
       reachAnalysisMemoryLimit: 0,
+      reachConcurrency: 1,
+      reachDisableAnalysisSplitting: false,
       reachEcosystems: [],
       reachExcludePaths: [],
       reachSkipCache: false
@@ -13154,6 +13204,8 @@ async function run$7(argv, importMeta, {
     org: orgFlag,
     reachAnalysisMemoryLimit,
     reachAnalysisTimeout,
+    reachConcurrency,
+    reachDisableAnalysisSplitting,
     reachDisableAnalytics,
     reachSkipCache
   } = cli.flags;
@@ -13219,7 +13271,9 @@ async function run$7(argv, importMeta, {
     reachabilityOptions: {
       reachAnalysisTimeout: Number(reachAnalysisTimeout),
       reachAnalysisMemoryLimit: Number(reachAnalysisMemoryLimit),
+      reachConcurrency: Number(reachConcurrency),
       reachDisableAnalytics: Boolean(reachDisableAnalytics),
+      reachDisableAnalysisSplitting: Boolean(reachDisableAnalysisSplitting),
       reachEcosystems,
       reachExcludePaths,
       reachSkipCache: Boolean(reachSkipCache)
@@ -15060,5 +15114,5 @@ void (async () => {
     await utils.captureException(e);
   }
 })();
-//# debugId=ede65737-8f7f-42fe-be24-d7339a0b3189
+//# debugId=af14f2c8-7f1a-4f12-bd1a-322165537e4f
 //# sourceMappingURL=cli.js.map