@socketsecurity/cli-with-sentry 1.8.2 → 1.8.4

package/CHANGELOG.md

@@ -4,10 +4,22 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## [1.8.4](https://github.com/SocketDev/socket-cli/releases/tag/v1.8.4) - 2026-10-16
+
+### Changed
+- `socket fix` now exits with code 5 when it computed fixes it could not apply, matching the Coana CLI. Automation can tell this apart from a failed run, which still exits with 1. The `--output-file` JSON lists the unapplied fixes under `notApplied`.
+- Updated the Coana CLI to v `15.12.9`.
+
+## [1.8.3](https://github.com/SocketDev/socket-cli/releases/tag/v1.8.3) - 2026-10-15
+
+### Changed
+- Updated the Coana CLI to v `15.12.8`.
+
 ## [1.8.2](https://github.com/SocketDev/socket-cli/releases/tag/v1.8.2) - 2026-10-13
 
 ### Fixed
 - Reachability scans in pnpm and yarn projects no longer print a 403 from the Socket API when run with a repository-scoped token. The safety check that runs before Coana launches now uses Socket's public token and only looks up the Coana package itself.
+- `--dynamic-sbom-inference` no longer skips an independent Maven, Gradle or sbt build that shares a directory with a module of another build: only build files another build actually uses count as covered.
 
 ## [1.8.1](https://github.com/SocketDev/socket-cli/releases/tag/v1.8.1) - 2026-10-12
 

package/README.md

@@ -1,8 +1,8 @@
 # Socket CLI
 
 [![Socket Badge](https://socket.dev/api/badge/npm/package/socket)](https://socket.dev/npm/package/socket)
-[![Follow @SocketSecurity](https://raw.githubusercontent.com/SocketDev/socket-cli/v1.8.2/assets/fleet/badge-follow-x.svg)](https://twitter.com/SocketSecurity)
-[![Follow @socket.dev on Bluesky](https://raw.githubusercontent.com/SocketDev/socket-cli/v1.8.2/assets/fleet/badge-follow-bluesky.svg)](https://bsky.app/profile/socket.dev)
+[![Follow @SocketSecurity](https://raw.githubusercontent.com/SocketDev/socket-cli/v1.8.4/assets/fleet/badge-follow-x.svg)](https://twitter.com/SocketSecurity)
+[![Follow @socket.dev on Bluesky](https://raw.githubusercontent.com/SocketDev/socket-cli/v1.8.4/assets/fleet/badge-follow-bluesky.svg)](https://bsky.app/profile/socket.dev)
 
 CLI for [Socket.dev](https://socket.dev) — scan dependencies, audit packages, apply security patches, and gate installs from your terminal or CI. This is the 1.x line of the published `socket` package on npm.
 
@@ -171,8 +171,8 @@ MIT
 <br/>
 <div align="center">
   <picture>
-    <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.8.2/assets/fleet/socket-combomark-dark.svg">
-    <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.8.2/assets/fleet/socket-combomark-light.svg">
-    <img width="324" height="104" alt="Socket" src="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.8.2/assets/fleet/socket-combomark-light.svg">
+    <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.8.4/assets/fleet/socket-combomark-dark.svg">
+    <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.8.4/assets/fleet/socket-combomark-light.svg">
+    <img width="324" height="104" alt="Socket" src="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.8.4/assets/fleet/socket-combomark-light.svg">
   </picture>
 </div>

package/dist/cli.js

@@ -2126,6 +2126,28 @@ function withoutDisabledFlags(sockJson) {
     }
   };
 }
+
+// Gradle reports a project's build file even when absent, which covers
+// nothing. A sibling outside the build root is independently locatable.
+async function addCoveredBuildFiles(covered, buildRoot, projects) {
+  const realBuildRoot = await utils.realpathOrResolved(buildRoot);
+  const files = await Promise.all(projects.flatMap(project => project.manifestFiles ?? []).map(async ({
+    file
+  }) => {
+    const resolved = path.resolve(buildRoot, file);
+    return path.join(await utils.realpathOrResolved(path.dirname(resolved)), path.basename(resolved));
+  }));
+  for (const file of files) {
+    if (file.startsWith(`${realBuildRoot}${path.sep}`) && fs$1.existsSync(file)) {
+      covered.add(file);
+    }
+  }
+}
+
+// `dir` must be realpath-resolved, as findBuildToolCandidates returns it.
+function isBuildRootCovered(covered, tool, dir) {
+  return MARKERS_BY_TOOL[tool].some(marker => covered.has(path.join(dir, marker)));
+}
 function sortByDepthThenPath(dirs, cwd) {
   return [...dirs].sort((a, b) => {
     const relA = path.relative(cwd, a);
@@ -2139,9 +2161,8 @@ function sortByDepthThenPath(dirs, cwd) {
   });
 }
 
-// Depth-sorted (root-most first) so the caller, using each build root's
-// `subprojectDir` facts, visits a reactor root before its own members and can
-// skip subprojects a parent root already covers.
+// Depth-sorted (root-most first) so the caller visits a reactor root before
+// its own members and can skip those whose build files it already covers.
 async function findBuildToolCandidates({
   cwd,
   excludePaths,
@@ -3505,6 +3526,7 @@ async function runManifestScript(tool, opts) {
 async function enumerateWorkspaces$1(tool, opts) {
   const result = await (tool === 'gradle' ? enumerateGradleWorkspaces(opts) : tool === 'sbt' ? enumerateSbtWorkspaces(opts) : enumerateMavenWorkspaces(opts));
   return {
+    buildRoot: result.buildRoot,
     code: result.code,
     projects: result.facts.projects ?? [],
     stderr: result.stderr,
@@ -3835,12 +3857,12 @@ async function runEcosystemCandidates({
   withFiles
 }) {
   const outcomes = [];
+  const covered = new Set();
   for (const [ecosystem, dirs] of candidatesByTool) {
-    const covered = new Set();
     const disabledRoots = [];
     for (let dirIndex = 0; dirIndex < dirs.length; dirIndex += 1) {
       const dir = dirs[dirIndex];
-      if (covered.has(dir)) {
+      if (isBuildRootCovered(covered, ecosystem, dir)) {
         outcomes.push({
           dir,
           ecosystem,
@@ -3924,28 +3946,10 @@ async function runEcosystemCandidates({
         });
         continue;
       }
-      covered.add(dir);
+
       // `-f`/`-p` can root the reactor away from `dir`.
       // eslint-disable-next-line no-await-in-loop
-      const buildRoot = await utils.realpathOrResolved(path.dirname(result.factsPath));
-      // eslint-disable-next-line no-await-in-loop
-      const resolvedSubprojectDirs = await Promise.all(result.projects.map(project => utils.realpathOrResolved(path.resolve(buildRoot, project.subprojectDir))));
-      for (const subprojectDir of resolvedSubprojectDirs) {
-        // Only a genuinely nested member (a descendant of this reactor's own
-        // directory) has no independent existence worth its own standalone
-        // analysis. A subprojectDir that escapes this reactor's own tree (a
-        // sibling, e.g. Maven's `<module>../shared-lib</module>` or Gradle's
-        // relocated projectDir) is independently locatable and potentially
-        // independently consumed or published - its own un-mediated
-        // resolution (e.g. a dependency version this reactor's own
-        // dependency management happens to override) is a distinct,
-        // meaningful data point, not a redundant one. Never suppress its own
-        // build-root invocation, regardless of which reactor(s) also
-        // incorporate it or the order candidates happen to be discovered in.
-        if (subprojectDir === buildRoot || subprojectDir.startsWith(`${buildRoot}${path.sep}`)) {
-          covered.add(subprojectDir);
-        }
-      }
+      await addCoveredBuildFiles(covered, path.dirname(result.factsPath), result.projects);
       outcomes.push({
         dir,
         ecosystem,
@@ -3957,17 +3961,8 @@ async function runEcosystemCandidates({
   return outcomes;
 }
 
-// Generates one Socket facts file per independent gradle/sbt/maven build
-// root under `cwd`. Coverage is tracked per ecosystem via the facts SBOM's
-// own projects[].subprojectDir, not by pruning the whole discovered subtree,
-// so an unrelated nested project a reactor doesn't declare still gets its
-// own invocation - and only a properly nested subprojectDir counts as
-// coverage at all; one that escapes its declaring reactor's own directory
-// still gets its own independent invocation too (see the covered.add call
-// below). Fail-closed per ecosystem, not globally: a root whose
-// workspace layout can't be determined aborts only that ecosystem's own
-// remaining walk (marking its untried candidates 'aborted'), since coverage
-// is tracked per ecosystem and an unrelated one has nothing to lose from it.
+// A failed root aborts only its own ecosystem's remaining walk: the build
+// files it would have covered are all its own tool's.
 async function generateRecursiveManifests({
   cwd,
   excludePaths,
@@ -9103,6 +9098,7 @@ function readWrittenFiles(outputFile) {
   return Array.isArray(files) && files.every(f => typeof f === 'string') ? new Set(files) : undefined;
 }
 // Coana exits with this code after writing an --output-file that lists computed fixes it left unapplied.
+// Local mode exits with it too, so automation can tell unapplied fixes from a failed run.
 const COANA_FIXES_NOT_APPLIED_EXIT_CODE = 5;
 function isFixesNotAppliedExit(result) {
   return !result.ok && result.data?.code === COANA_FIXES_NOT_APPLIED_EXIT_CODE;
@@ -9336,6 +9332,7 @@ async function coanaFixWithFacts(fixConfig, factsSlot) {
       if (!fixCResult.ok || notApplied.length) {
         return {
           ok: false,
+          code: COANA_FIXES_NOT_APPLIED_EXIT_CODE,
           message: fixesResultJson?.type === 'no-fixes-applied' ? 'No computed fixes were applied' : 'Some computed fixes were not applied',
           cause: formatNotAppliedFixes(notApplied),
           data: {
@@ -12987,8 +12984,9 @@ const config$d = {
     (pom.xml.socket.facts.json, gradle.socket.facts.json, or
     sbt.socket.facts.json, so builds sharing a directory never overwrite each
     other),
-    skipping subproject/reactor-module directories a parent build root already
-    covers. Unlike \`socket manifest auto\`, this looks beyond CWD itself.
+    skipping build roots whose build file a parent build already reports for
+    one of its subprojects. Unlike \`socket manifest auto\`, this looks beyond
+    CWD itself.
 
     Options
       ${utils.getFlagListOutput(config.flags)}
@@ -14742,7 +14740,13 @@ async function enumerateWorkspaces({
     logger.logger.fail(`The ${ecosystem} build produced no workspace records (exit code ${result.code}); every build reports at least its own root project, so the enumeration task did not run.`);
     return;
   }
+  if (!result.buildRoot) {
+    process.exitCode = 1;
+    logger.logger.fail(`The ${ecosystem} build did not report its build root, so its projects' paths cannot be located.`);
+    return;
+  }
   return {
+    buildRoot: result.buildRoot,
     projects: result.projects
   };
 }
@@ -14885,20 +14889,11 @@ async function discoverBuildRoots({
   };
 }
 
-// Enumerates one build root's declared workspace members (see
-// enumerate-workspaces.mts) and folds them into `coveredByEcosystem`, so a
-// later candidate matching one is recognized as a reactor member rather than
-// independent - only a properly nested subprojectDir counts as coverage at
-// all; one that escapes this candidate's own directory still gets its own
-// entry (see the set.add call below). Called per-candidate right after its
-// own prompt, not as a bulk pass, so the build invocation never blocks
-// candidates that don't need it. A disabled candidate is skipped (no point
-// invoking an off build tool); otherwise this fails closed, same reasoning
-// as generateRecursiveManifests - if enumeration fails there's no way to
-// tell covered from independent, so the caller aborts rather than guess.
+// Fails closed: without the members' build files, covered and independent
+// candidates can't be told apart.
 async function markWorkspaceCoverage({
   candidate,
-  coveredByEcosystem,
+  covered,
   cwd,
   excludePaths,
   rootSockJson
@@ -14936,21 +14931,7 @@ async function markWorkspaceCoverage({
       message: `Could not determine ${candidate.ecosystem} workspace layout for ${relDir}; aborting rather than risk misclassifying its members.`
     };
   }
-  const set = coveredByEcosystem.get(candidate.ecosystem) ?? new Set();
-  set.add(candidate.dir);
-  const resolvedSubprojectDirs = await Promise.all(enumResult.projects.map(project => utils.realpathOrResolved(path.resolve(candidate.dir, project.subprojectDir))));
-  for (const subprojectDir of resolvedSubprojectDirs) {
-    // Only a genuinely nested member (a descendant of this candidate's own
-    // directory) should be skipped as covered by it. A subprojectDir that
-    // escapes this candidate's own tree (a sibling, e.g. Maven's
-    // `<module>../shared-lib</module>` or Gradle's relocated projectDir) is
-    // independently locatable and worth its own socket.json entry - never
-    // mark it covered, regardless of which candidate(s) also incorporate it.
-    if (subprojectDir.startsWith(`${candidate.dir}${path.sep}`)) {
-      set.add(subprojectDir);
-    }
-  }
-  coveredByEcosystem.set(candidate.ecosystem, set);
+  await addCoveredBuildFiles(covered, enumResult.buildRoot, enumResult.projects);
   return {
     ok: true,
     data: undefined
@@ -15460,7 +15441,7 @@ async function setupRecursiveManifestConfig(cwd, defaultOnReadError, excludePath
   logger.logger.log('For each one, choose to configure it or leave it as-is. To disable one,');
   logger.logger.log('re-run with --exclude-paths instead.');
   logger.logger.log('');
-  const coveredByEcosystem = new Map();
+  const covered = new Set();
   // cwd never appears in `included`, but a reactor root often sits exactly
   // at cwd - seed coverage from it first so its declared members still get
   // recognized.
@@ -15471,7 +15452,7 @@ async function setupRecursiveManifestConfig(cwd, defaultOnReadError, excludePath
         dir: realCwd,
         ecosystem
       },
-      coveredByEcosystem,
+      covered,
       cwd: realCwd,
       excludePaths,
       rootSockJson
@@ -15489,8 +15470,7 @@ async function setupRecursiveManifestConfig(cwd, defaultOnReadError, excludePath
   };
   const orderedIncluded = sortCandidatesForDisplay(included, realCwd);
   for (const candidate of orderedIncluded) {
-    const covered = coveredByEcosystem.get(candidate.ecosystem);
-    if (covered?.has(candidate.dir)) {
+    if (isBuildRootCovered(covered, candidate.ecosystem, candidate.dir)) {
       counts.covered += 1;
       continue;
     }
@@ -15527,7 +15507,7 @@ async function setupRecursiveManifestConfig(cwd, defaultOnReadError, excludePath
     // eslint-disable-next-line no-await-in-loop
     const coverageResult = await markWorkspaceCoverage({
       candidate,
-      coveredByEcosystem,
+      covered,
       cwd: realCwd,
       excludePaths,
       rootSockJson
@@ -24560,5 +24540,5 @@ process.on('unhandledRejection', async (reason, promise) => {
   // eslint-disable-next-line n/no-process-exit
   process.exit(1);
 });
-//# debugId=e5b43908-d002-4c63-b2f7-4c7336aacdb4
+//# debugId=f7aeb17e-13e2-4a73-b5ed-da37ea72d476
 //# sourceMappingURL=cli.js.map