@socketsecurity/cli-with-sentry 1.10.1 → 1.11.0

package/CHANGELOG.md

@@ -4,6 +4,14 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## [1.11.0](https://github.com/SocketDev/socket-cli/releases/tag/v1.11.0) - 2026-10-26
+
+### Added
+- `socket scan create --reach` and `socket scan reach` take `--reach-advisories` to focus reachability analysis on the GHSA or CVE advisories you care about. Every other advisory is left with unknown reachability.
+
+### Changed
+- Updated the Coana CLI to v `15.13.0`.
+
 ## [1.10.1](https://github.com/SocketDev/socket-cli/releases/tag/v1.10.1) - 2026-10-23
 
 ### Changed

package/README.md

@@ -1,8 +1,8 @@
 # Socket CLI
 
 [![Socket Badge](https://socket.dev/api/badge/npm/package/socket)](https://socket.dev/npm/package/socket)
-[![Follow @SocketSecurity](https://raw.githubusercontent.com/SocketDev/socket-cli/v1.10.1/assets/fleet/badge-follow-x.svg)](https://twitter.com/SocketSecurity)
-[![Follow @socket.dev on Bluesky](https://raw.githubusercontent.com/SocketDev/socket-cli/v1.10.1/assets/fleet/badge-follow-bluesky.svg)](https://bsky.app/profile/socket.dev)
+[![Follow @SocketSecurity](https://raw.githubusercontent.com/SocketDev/socket-cli/v1.11.0/assets/fleet/badge-follow-x.svg)](https://twitter.com/SocketSecurity)
+[![Follow @socket.dev on Bluesky](https://raw.githubusercontent.com/SocketDev/socket-cli/v1.11.0/assets/fleet/badge-follow-bluesky.svg)](https://bsky.app/profile/socket.dev)
 
 CLI for [Socket.dev](https://socket.dev) — scan dependencies, audit packages, apply security patches, and gate installs from your terminal or CI. This is the 1.x line of the published `socket` package on npm.
 
@@ -170,8 +170,8 @@ MIT
 <br/>
 <div align="center">
   <picture>
-    <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.10.1/assets/fleet/socket-combomark-dark.svg">
-    <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.10.1/assets/fleet/socket-combomark-light.svg">
-    <img width="324" height="104" alt="Socket" src="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.10.1/assets/fleet/socket-combomark-light.svg">
+    <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.11.0/assets/fleet/socket-combomark-dark.svg">
+    <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.11.0/assets/fleet/socket-combomark-light.svg">
+    <img width="324" height="104" alt="Socket" src="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.11.0/assets/fleet/socket-combomark-light.svg">
   </picture>
 </div>

package/dist/cli.js

@@ -2010,7 +2010,7 @@ async function performReachabilityAnalysis(options) {
   // Build Coana arguments.
   const coanaArgs = ['run', analysisTarget, '--output-dir', path.dirname(outputFilePath), '--socket-mode', outputFilePath, '--disable-report-submission', ...(isOmittedReachValue(reachabilityOptions.reachAnalysisTimeout) ? [] : ['--analysis-timeout', reachabilityOptions.reachAnalysisTimeout]), ...(isOmittedReachValue(reachabilityOptions.reachAnalysisMemoryLimit) ? [] : ['--memory-limit', reachabilityOptions.reachAnalysisMemoryLimit]), ...(reachabilityOptions.reachConcurrency ? ['--concurrency', `${reachabilityOptions.reachConcurrency}`] : []), ...(reachabilityOptions.reachContinueOnAnalysisErrors ? ['--reach-continue-on-analysis-errors'] : []), ...(reachabilityOptions.reachContinueOnInstallErrors ? ['--reach-continue-on-install-errors'] : []), ...(reachabilityOptions.reachContinueOnMissingLockFiles ? ['--reach-continue-on-missing-lock-files'] : []), ...(reachabilityOptions.reachContinueOnNoSourceFiles ? ['--reach-continue-on-no-source-files'] : []), ...(reachabilityOptions.reachDebug ? ['--debug'] : []), ...(reachabilityOptions.reachDetailedAnalysisLogFile ? ['--print-analysis-log-file'] : []), ...(reachabilityOptions.reachDisableAnalytics ? ['--disable-analytics-sharing'] : []), ...(reachabilityOptions.reachDisableExternalToolChecks ? ['--disable-external-tool-checks'] : []), ...(reachabilityOptions.reachEnableAnalysisSplitting ? [] : ['--disable-analysis-splitting']), '--run-without-docker', '--manifests-tar-hash', tarHash,
   // Empty reachEcosystems implies scanning all ecosystems.
-  ...(reachabilityOptions.reachEcosystems.length ? ['--purl-types', ...reachabilityOptions.reachEcosystems] : []), ...(reachabilityOptions.reachExcludePaths.length ? ['--exclude-dirs', ...reachabilityOptions.reachExcludePaths] : []),
+  ...(reachabilityOptions.reachEcosystems.length ? ['--purl-types', ...reachabilityOptions.reachEcosystems] : []), ...(reachabilityOptions.reachAdvisories.length ? ['--ghsas', ...reachabilityOptions.reachAdvisories] : []), ...(reachabilityOptions.reachExcludePaths.length ? ['--exclude-dirs', ...reachabilityOptions.reachExcludePaths] : []),
   // sidecarPath is always set above when this is true - Coana rejects this
   // flag without one.
   ...(reachabilityOptions.dynamicSbomInference ? ['--maven-use-only-socket-facts'] : []), ...(reachabilityOptions.reachSkipCache ? ['--skip-cache-usage'] : []), ...(reachabilityOptions.reachUseOnlyPregeneratedSboms ? ['--use-only-pregenerated-sboms'] : []), ...(sidecarPath ? ['--compute-artifacts-sidecar', sidecarPath] : [])];
@@ -7806,6 +7806,7 @@ async function handleCi(autoManifest) {
     reach: {
       dynamicSbomInference: false,
       excludePaths: [],
+      reachAdvisories: [],
       reachAnalysisMemoryLimit: '',
       reachAnalysisTimeout: '',
       reachConcurrency: 1,
@@ -9934,8 +9935,6 @@ async function outputFixResult(result, outputKind) {
   logger.logger.success('Finished!');
 }
 
-const GHSA_FORMAT_REGEXP = /^GHSA-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}$/;
-const CVE_FORMAT_REGEXP = /^CVE-\d{4}-\d{4,}$/;
 /**
  * Converts mixed CVE/GHSA/PURL IDs to GHSA IDs only.
  * Filters out invalid IDs and logs conversion results.
@@ -9951,51 +9950,12 @@ async function convertIdsToGhsas(ids, options) {
   debug.debugDir('inspect', {
     ids
   });
-  const validGhsas = [];
-  const errors = [];
-  for (const id of ids) {
-    const trimmedId = id.trim();
-    if (trimmedId.startsWith('GHSA-')) {
-      // Already a GHSA ID, validate format
-      if (GHSA_FORMAT_REGEXP.test(trimmedId)) {
-        validGhsas.push(trimmedId);
-      } else {
-        errors.push(`Invalid GHSA format: ${trimmedId}`);
-      }
-    } else if (trimmedId.startsWith('CVE-')) {
-      // Convert CVE to GHSA
-      if (!CVE_FORMAT_REGEXP.test(trimmedId)) {
-        errors.push(`Invalid CVE format: ${trimmedId}`);
-        continue;
-      }
-
-      // eslint-disable-next-line no-await-in-loop
-      const conversionResult = await utils.convertCveToGhsa(trimmedId);
-      if (conversionResult.ok) {
-        validGhsas.push(conversionResult.data);
-        if (!silence) {
-          logger.logger.info(`Converted ${trimmedId} to ${conversionResult.data}`);
-        }
-      } else {
-        errors.push(`${trimmedId}: ${conversionResult.message}`);
-      }
-    } else if (trimmedId.startsWith('pkg:')) {
-      // Convert PURL to GHSAs.
-      // eslint-disable-next-line no-await-in-loop
-      const conversionResult = await utils.convertPurlToGhsas(trimmedId);
-      if (conversionResult.ok && conversionResult.data.length) {
-        validGhsas.push(...conversionResult.data);
-        if (!silence) {
-          logger.logger.info(`Converted ${trimmedId} to ${conversionResult.data.length} GHSA(s): ${arrays.joinAnd(conversionResult.data)}`);
-        }
-      } else {
-        errors.push(`${trimmedId}: ${conversionResult.message || 'No GHSAs found'}`);
-      }
-    } else {
-      // Neither CVE, GHSA, nor PURL, skip
-      errors.push(`Unsupported ID format (expected CVE, GHSA, or PURL): ${trimmedId}`);
-    }
-  }
+  const {
+    errors,
+    ghsas: validGhsas
+  } = await utils.resolveAdvisoryIds(ids, {
+    silence
+  });
   if (errors.length) {
     if (!silence) {
       logger.logger.warn(`Skipped ${errors.length} invalid IDs:\n${errors.map(e => `  - ${e}`).join('\n')}`);
@@ -10112,6 +10072,11 @@ const reachabilityFlags = {
     type: 'string',
     description: `Override the version of @coana-tech/cli used for reachability analysis. Default: ${constants.COANA_CLI_VERSION}.`
   },
+  reachAdvisories: {
+    type: 'string',
+    isMultiple: true,
+    description: 'List of advisories to run reachability analysis for, as GHSA or CVE IDs, either as a comma separated value or as multiple flags. CVE IDs are converted to GHSA IDs through the GitHub API. Vulnerabilities from other advisories get unknown reachability. Defaults to all advisories.'
+  },
   reachAnalysisMemoryLimit: {
     type: 'string',
     default: '8192',
@@ -20058,6 +20023,37 @@ function resolveUvMemberDirs(targets, cwd) {
   return Array.from(memberDirs);
 }
 
+// GitHub publishes GHSA IDs with a lowercase body and CVE IDs uppercase.
+function normalizeAdvisoryId(id) {
+  const trimmed = id.trim();
+  return /^ghsa-/i.test(trimmed) ? `GHSA-${trimmed.slice(5).toLowerCase()}` : trimmed.toUpperCase();
+}
+
+/**
+ * Resolves the --reach-advisories IDs to GHSA IDs, converting CVE IDs through
+ * the GitHub API. Any ID that cannot be resolved fails the command, since
+ * dropping it would leave that advisory without reachability analysis.
+ */
+async function resolveReachAdvisories(ids) {
+  const normalizedIds = arrays.arrayUnique(ids.map(normalizeAdvisoryId));
+  // Checked up front so PURLs never reach resolveAdvisoryIds and a typo fails
+  // before any GitHub lookup.
+  const invalidIds = normalizedIds.filter(id => !utils.GHSA_FORMAT_REGEXP.test(id) && !utils.CVE_FORMAT_REGEXP.test(id));
+  if (invalidIds.length) {
+    throw new utils.InputError(`Invalid --reach-advisories IDs: ${invalidIds.join(', ')}. Use GHSA IDs (GHSA-xxxx-xxxx-xxxx) or CVE IDs (CVE-YYYY-NNNN).`);
+  }
+  const {
+    errors,
+    ghsas
+  } = await utils.resolveAdvisoryIds(normalizedIds, {
+    silence: true
+  });
+  if (errors.length) {
+    throw new utils.InputError(`Could not resolve --reach-advisories IDs to GHSA IDs:\n${errors.map(e => `  - ${e}`).join('\n')}`);
+  }
+  return arrays.arrayUnique(ghsas);
+}
+
 async function suggestTarget() {
   // We could prefill this with sub-dirs of the current
   // dir ... but is that going to be useful?
@@ -20487,8 +20483,10 @@ async function run$d(argv, importMeta, {
   const excludePaths = utils.cmdFlagValueToArray(cli.flags['excludePaths']);
   assertValidExcludePaths(excludePaths);
   const reachExcludePaths = utils.cmdFlagValueToArray(cli.flags['reachExcludePaths']);
+  const reachAdvisoriesRaw = utils.cmdFlagValueToArray(cli.flags['reachAdvisories']);
 
   // Validation helpers for better readability.
+  const hasReachAdvisories = reachAdvisoriesRaw.length > 0;
   const hasReachEcosystems = reachEcosystems.length > 0;
   const hasReachExcludePaths = reachExcludePaths.length > 0;
 
@@ -20506,7 +20504,7 @@ async function run$d(argv, importMeta, {
   // added flags require --reach automatically instead of relying on a
   // hand-maintained list. Deprecated no-ops are excluded on purpose.
   const isUsingAnyBooleanReachFlag = Object.entries(reachabilityFlags).some(([name, flag]) => flag.type === 'boolean' && !DEPRECATED_NO_OP_REACH_FLAGS.has(name) && cli.flags[name] !== flag.default);
-  const isUsingAnyReachabilityFlags = hasReachEcosystems || hasReachExcludePaths || isUsingAnyBooleanReachFlag || isUsingNonDefaultConcurrency || isUsingNonDefaultMemoryLimit || isUsingNonDefaultTimeout || isUsingNonDefaultVersion;
+  const isUsingAnyReachabilityFlags = hasReachAdvisories || hasReachEcosystems || hasReachExcludePaths || isUsingAnyBooleanReachFlag || isUsingNonDefaultConcurrency || isUsingNonDefaultMemoryLimit || isUsingNonDefaultTimeout || isUsingNonDefaultVersion;
 
   // Validate target constraints when --reach is enabled.
   const reachTargetValidation = reach ? await validateReachabilityTarget(targets, cwd) : {
@@ -20583,6 +20581,7 @@ async function run$d(argv, importMeta, {
     logger.logger.log(constants.default.DRY_RUN_BAILING_NOW);
     return;
   }
+  const reachAdvisories = await resolveReachAdvisories(reachAdvisoriesRaw);
   await handleCreateNewScan({
     autoManifest: Boolean(autoManifest),
     branchName: branchName,
@@ -20600,6 +20599,7 @@ async function run$d(argv, importMeta, {
     reach: {
       dynamicSbomInference: Boolean(dynamicSbomInference),
       excludePaths,
+      reachAdvisories,
       reachAnalysisMemoryLimit,
       reachAnalysisTimeout,
       reachConcurrency: Number(reachConcurrency),
@@ -21318,6 +21318,7 @@ async function scanOneRepo(repoSlug, {
     reach: {
       dynamicSbomInference: false,
       excludePaths: [],
+      reachAdvisories: [],
       reachAnalysisMemoryLimit: '',
       reachAnalysisTimeout: '',
       reachConcurrency: 1,
@@ -22746,6 +22747,7 @@ async function run$7(argv, importMeta, {
 
   // Process comma-separated values for isMultiple flags.
   const excludePaths = utils.cmdFlagValueToArray(cli.flags['excludePaths']);
+  const reachAdvisoriesRaw = utils.cmdFlagValueToArray(cli.flags['reachAdvisories']);
   const reachEcosystemsRaw = utils.cmdFlagValueToArray(cli.flags['reachEcosystems']);
   const reachExcludePaths = utils.cmdFlagValueToArray(cli.flags['reachExcludePaths']);
   assertValidExcludePaths(excludePaths);
@@ -22818,6 +22820,7 @@ async function run$7(argv, importMeta, {
     logger.logger.log(constants.default.DRY_RUN_BAILING_NOW);
     return;
   }
+  const reachAdvisories = await resolveReachAdvisories(reachAdvisoriesRaw);
   await handleScanReach({
     cwd,
     interactive,
@@ -22827,6 +22830,7 @@ async function run$7(argv, importMeta, {
     reachabilityOptions: {
       dynamicSbomInference: Boolean(dynamicSbomInference),
       excludePaths,
+      reachAdvisories,
       reachAnalysisMemoryLimit,
       reachAnalysisTimeout,
       reachConcurrency: Number(reachConcurrency),
@@ -24791,5 +24795,5 @@ process.on('unhandledRejection', async (reason, promise) => {
   // eslint-disable-next-line n/no-process-exit
   process.exit(1);
 });
-//# debugId=3195b2a9-2bce-44ed-8eea-bd5e763d40fa
+//# debugId=5d7a85dd-501f-4419-b550-bef90180bd6a
 //# sourceMappingURL=cli.js.map