@socketsecurity/cli 0.14.128 → 0.14.130

package/dist/module-sync/cli.js

@@ -917,7 +917,7 @@ function emitBanner(name) {
   logger.logger.error(getAsciiHeader(name))
 }
 function getAsciiHeader(command) {
-  const cliVersion = '0.14.128:ec33790:ce37c7ea:pub' // The '@rollup/plugin-replace' will replace "process.env['INLINED_SOCKET_CLI_VERSION_HASH']".
+  const cliVersion = '0.14.130:6d76a8a:75b17c6e:pub' // The '@rollup/plugin-replace' will replace "process.env['INLINED_SOCKET_CLI_VERSION_HASH']".
   const nodeVersion = process$1.version
   const apiToken = shadowNpmInject.getDefaultToken()
   const defaultOrg = shadowNpmInject.getConfigValue('defaultOrg')
@@ -3788,29 +3788,6 @@ async function gitBranchExists(branch, cwd = process.cwd()) {
   } catch {}
   return false
 }
-async function gitCheckoutBaseBranchIfAvailable(
-  baseBranch,
-  cwd = process.cwd()
-) {
-  try {
-    await gitHardReset()
-    await spawn.spawn('git', ['fetch', '--depth=1', 'origin', baseBranch], {
-      cwd
-    })
-    await spawn.spawn('git', ['checkout', baseBranch], {
-      cwd
-    })
-    await spawn.spawn('git', ['reset', '--hard', `origin/${baseBranch}`], {
-      cwd
-    })
-    logger.logger.info(`Checked out and reset to ${baseBranch}`)
-  } catch (e) {
-    logger.logger.warn(
-      `Could not switch to ${baseBranch}. Proceeding with HEAD.`
-    )
-    debug.debugLog(e)
-  }
-}
 async function gitCleanFdx(cwd = process.cwd()) {
   await spawn.spawn('git', ['clean', '-fdx'], {
     cwd
@@ -4005,45 +3982,69 @@ async function openGitHubPullRequest(
   throw new Error('Missing GITHUB_ACTIONS environment variable')
 }
 
+const CMD_NAME$1 = 'socket fix'
+const alertMapOptions = Object.freeze({
+  consolidate: true,
+  include: {
+    existing: true,
+    unfixable: false,
+    upgradable: false
+  },
+  nothrow: true
+})
+function assignDefaultFixOptions(options) {
+  if (options.autoPilot === undefined) {
+    options.autoPilot = false
+  }
+  if (options.autoMerge === undefined) {
+    options.autoMerge = !!options.autoPilot
+  }
+  if (options.cwd === undefined) {
+    options.cwd = process.cwd()
+  }
+  if (options.rangeStyle === undefined) {
+    options.rangeStyle = 'preserve'
+  }
+  if (options.test === undefined) {
+    options.test = !!options.autoPilot || !!options.testScript
+  }
+  if (options.testScript === undefined) {
+    options.testScript = 'test'
+  }
+  return options
+}
+
 const { CI: CI$1, NPM: NPM$f } = constants
 async function install$1(idealTree, options) {
   const { cwd = process.cwd() } = {
     __proto__: null,
     ...options
   }
-  const arb2 = new shadowNpmInject.Arborist({
+  const arb = new shadowNpmInject.Arborist({
     path: cwd
   })
-  arb2.idealTree = idealTree
-  await arb2.reify()
+  arb.idealTree = idealTree
+  await arb.reify()
 }
 async function npmFix(
   pkgEnvDetails,
   { autoMerge, cwd, purls, rangeStyle, spinner, test, testScript }
 ) {
-  const { pkgPath: rootPath } = pkgEnvDetails
   spinner?.start()
+  const { pkgPath: rootPath } = pkgEnvDetails
   const arb = new shadowNpmInject.SafeArborist({
     path: rootPath,
     ...shadowNpmInject.SAFE_ARBORIST_REIFY_OPTIONS_OVERRIDES
   })
   // Calling arb.reify() creates the arb.diff object and nulls-out arb.idealTree.
   await arb.reify()
-  const alertMapOptions = {
-    consolidate: true,
-    include: {
-      existing: true,
-      unfixable: false,
-      upgradable: false
-    },
-    nothrow: true
-  }
   const alertsMap = purls.length
     ? await shadowNpmInject.getAlertsMapFromPurls(purls, alertMapOptions)
     : await shadowNpmInject.getAlertsMapFromArborist(arb, alertMapOptions)
   const infoByPkg = shadowNpmInject.getCveInfoByAlertsMap(alertsMap)
   if (!infoByPkg) {
     spinner?.stop()
+    logger.logger.info('No fixable vulnerabilities found.')
     return
   }
 
@@ -4059,123 +4060,104 @@ async function npmFix(
     pkgEnvDetails.editablePkgJson.filename
   ]
   for (const { 0: name, 1: infos } of infoByPkg) {
-    const hasUpgrade = !!registry.getManifestData(NPM$f, name)
-    if (hasUpgrade) {
-      spinner?.info(`Skipping ${name}. Socket Optimize package exists.`)
+    debug.debugLog(`Processing vulnerable package: ${name}`)
+    if (registry.getManifestData(NPM$f, name)) {
+      spinner?.info(`Socket Optimize package for ${name} exists, skipping`)
+      continue
+    }
+    if (!infos.length) {
+      debug.debugLog(`No vulnerability info found for ${name}`)
       continue
     }
-    arb.idealTree = null
     // eslint-disable-next-line no-await-in-loop
-    await arb.buildIdealTree()
-    const oldVersions = arrays.arrayUnique(
-      shadowNpmInject
-        .findPackageNodes(arb.idealTree, name)
-        .map(n => n.target?.version ?? n.version)
-        .filter(Boolean)
-    )
-    const packument =
-      oldVersions.length && infos.length
-        ? // eslint-disable-next-line no-await-in-loop
-          await packages.fetchPackagePackument(name)
-        : null
+    const packument = await packages.fetchPackagePackument(name)
     if (!packument) {
+      debug.debugLog(`No packument found for ${name}`)
       continue
     }
-    const failedSpecs = new Set()
+    const availableVersions = Object.keys(packument.versions)
     const fixedSpecs = new Set()
-    const installedSpecs = new Set()
-    const testedSpecs = new Set()
-    const unavailableSpecs = new Set()
-    const revertedSpecs = new Set()
     for (const pkgJsonPath of pkgJsonPaths) {
+      const pkgPath = path$1.dirname(pkgJsonPath)
+      const isWorkspaceRoot =
+        pkgJsonPath === pkgEnvDetails.editablePkgJson.filename
+      const workspaceName = isWorkspaceRoot
+        ? 'root'
+        : path$1.relative(rootPath, pkgPath)
+      debug.debugLog(`Checking workspace: ${workspaceName}`)
+      arb.idealTree = null
+      // eslint-disable-next-line no-await-in-loop
+      await arb.buildIdealTree()
+      const oldVersions = arrays.arrayUnique(
+        shadowNpmInject
+          .findPackageNodes(arb.idealTree, name)
+          .map(n => n.target?.version ?? n.version)
+          .filter(Boolean)
+      )
+      if (!oldVersions.length) {
+        debug.debugLog(`Lockfile entries not found for ${name}`)
+        continue
+      }
+
+      // Always re-read the editable package.json to avoid stale mutations
+      // across iterations.
+      // eslint-disable-next-line no-await-in-loop
+      const editablePkgJson = await packages.readPackageJson(pkgJsonPath, {
+        editable: true
+      })
       for (const oldVersion of oldVersions) {
         const oldSpec = `${name}@${oldVersion}`
         const oldPurl = `pkg:npm/${oldSpec}`
+        const node = shadowNpmInject.findPackageNode(
+          arb.idealTree,
+          name,
+          oldVersion
+        )
+        if (!node) {
+          debug.debugLog(`Arborist node not found, skipping ${oldSpec}`)
+          continue
+        }
         for (const {
           firstPatchedVersionIdentifier,
           vulnerableVersionRange
         } of infos) {
-          const revertTree = arb.idealTree
-          arb.idealTree = null
-          // eslint-disable-next-line no-await-in-loop
-          await arb.buildIdealTree()
-          const node = shadowNpmInject.findPackageNode(
-            arb.idealTree,
-            name,
-            oldVersion
+          const newVersion = shadowNpmInject.findBestPatchVersion(
+            node,
+            availableVersions,
+            vulnerableVersionRange
           )
-          if (!node) {
-            debug.debugLog(
-              `Skipping ${oldSpec}, no node found in arborist.idealTree`,
-              pkgJsonPath
-            )
-            continue
-          }
-          if (
-            !shadowNpmInject.updateNode(node, packument, vulnerableVersionRange)
-          ) {
-            if (!unavailableSpecs.has(oldSpec)) {
-              unavailableSpecs.add(oldSpec)
-              spinner?.fail(`No update available for ${oldSpec}`)
-            }
+          const newVersionPackument = newVersion
+            ? packument.versions[newVersion]
+            : undefined
+          if (!(newVersion && newVersionPackument)) {
+            spinner?.fail(`No update found for ${oldSpec}.`)
             continue
           }
-          const isWorkspaceRoot =
-            pkgJsonPath === pkgEnvDetails.editablePkgJson.filename
-          const workspaceName = isWorkspaceRoot
-            ? ''
-            : path$1.relative(rootPath, path$1.dirname(pkgJsonPath))
-          const workspaceDetails = workspaceName ? ` in ${workspaceName}` : ''
-          const editablePkgJson = isWorkspaceRoot
-            ? pkgEnvDetails.editablePkgJson
-            : // eslint-disable-next-line no-await-in-loop
-              await packages.readPackageJson(pkgJsonPath, {
-                editable: true
-              })
-          const newVersion = node.package.version
           const newVersionRange = shadowNpmInject.applyRange(
             oldVersion,
             newVersion,
             rangeStyle
           )
           const newSpec = `${name}@${newVersionRange}`
-          const newSpecKey = `${workspaceName ? `${workspaceName}>` : ''}${newSpec}`
-          const revertData = {
-            ...(editablePkgJson.content.dependencies
-              ? {
-                  dependencies: editablePkgJson.content.dependencies
-                }
-              : undefined),
-            ...(editablePkgJson.content.optionalDependencies
-              ? {
-                  optionalDependencies:
-                    editablePkgJson.content.optionalDependencies
-                }
-              : undefined),
-            ...(editablePkgJson.content.peerDependencies
-              ? {
-                  peerDependencies: editablePkgJson.content.peerDependencies
-                }
-              : undefined)
+          const newSpecKey = `${workspaceName}:${newSpec}`
+          if (fixedSpecs.has(newSpecKey)) {
+            debug.debugLog(
+              `Already fixed ${newSpec} in ${workspaceName}, skipping`
+            )
+            continue
           }
-          const branch = isCi
-            ? getSocketBranchName(oldPurl, newVersion, workspaceName)
-            : ''
-          const baseBranch = isCi ? getBaseGitBranch() : ''
-          const { owner, repo } = isCi
-            ? getGitHubEnvRepoInfo()
-            : {
-                owner: '',
-                repo: ''
-              }
-          const shouldOpenPr = isCi
-            ? // eslint-disable-next-line no-await-in-loop
-              !(await doesPullRequestExistForBranch(owner, repo, branch))
-            : false
-          if (isCi) {
-            // eslint-disable-next-line no-await-in-loop
-            await gitCheckoutBaseBranchIfAvailable(baseBranch, cwd)
+          const revertData = {
+            ...(editablePkgJson.content.dependencies && {
+              dependencies: editablePkgJson.content.dependencies
+            }),
+            ...(editablePkgJson.content.optionalDependencies && {
+              optionalDependencies: editablePkgJson.content.optionalDependencies
+            }),
+            ...(editablePkgJson.content.peerDependencies && {
+              peerDependencies: editablePkgJson.content.peerDependencies
+            })
           }
+          shadowNpmInject.updateNode(node, newVersion, newVersionPackument)
           shadowNpmInject.updatePackageJsonFromNode(
             editablePkgJson,
             arb.idealTree,
@@ -4183,105 +4165,110 @@ async function npmFix(
             newVersion,
             rangeStyle
           )
-          let error
-          let errored = false
-          let saved = false
-
           // eslint-disable-next-line no-await-in-loop
-          if (await editablePkgJson.save()) {
-            saved = true
-          }
-          if (!installedSpecs.has(newSpecKey)) {
-            testedSpecs.add(newSpecKey)
-            spinner?.info(`Installing ${newSpec}${workspaceDetails}`)
+          if (!(await editablePkgJson.save())) {
+            debug.debugLog(
+              `Nothing changed for ${workspaceName}, skipping install`
+            )
+            continue
           }
+          spinner?.info(`Installing ${newSpec} in ${workspaceName}`)
+          let error
+          let errored = false
           try {
             // eslint-disable-next-line no-await-in-loop
             await install$1(arb.idealTree, {
               cwd
             })
             if (test) {
-              if (!testedSpecs.has(newSpecKey)) {
-                testedSpecs.add(newSpecKey)
-                spinner?.info(`Testing ${newSpec}${workspaceDetails}`)
-              }
+              spinner?.info(`Testing ${newSpec} in ${workspaceName}`)
               // eslint-disable-next-line no-await-in-loop
               await npm.runScript(testScript, [], {
                 spinner,
                 stdio: 'ignore'
               })
             }
-            if (!fixedSpecs.has(newSpecKey)) {
-              fixedSpecs.add(newSpecKey)
-              spinner?.successAndStop(`Fixed ${name}${workspaceDetails}`)
-              spinner?.start()
-            }
+            fixedSpecs.add(newSpecKey)
+            spinner?.successAndStop(`Fixed ${name} in ${workspaceName}`)
+            spinner?.start()
           } catch (e) {
-            error = e
             errored = true
+            error = e
           }
-          if (
-            !errored &&
-            shouldOpenPr &&
-            // eslint-disable-next-line no-await-in-loop
-            (await gitCreateAndPushBranchIfNeeded(
-              branch,
-              getSocketCommitMessage(oldPurl, newVersion, workspaceName),
-              cwd
-            ))
-          ) {
-            // eslint-disable-next-line no-await-in-loop
-            const prResponse = await openGitHubPullRequest(
-              owner,
-              repo,
-              baseBranch,
-              branch,
+          const baseBranch = isCi ? getBaseGitBranch() : ''
+          if (!errored && isCi) {
+            const branch = getSocketBranchName(
               oldPurl,
               newVersion,
-              {
-                cwd,
-                workspaceName
-              }
+              workspaceName
             )
-            if (prResponse) {
-              const { data } = prResponse
-              spinner?.info(`PR #${data.number} opened.`)
-              if (autoMerge) {
+            try {
+              const { owner, repo } = getGitHubEnvRepoInfo()
+              if (
+                // eslint-disable-next-line no-await-in-loop
+                (await doesPullRequestExistForBranch(owner, repo, branch)) ||
                 // eslint-disable-next-line no-await-in-loop
-                await enableAutoMerge(data)
+                !(await gitCreateAndPushBranchIfNeeded(
+                  branch,
+                  getSocketCommitMessage(oldPurl, newVersion, workspaceName),
+                  cwd
+                ))
+              ) {
+                continue
               }
-            }
-          }
-          if (errored || isCi) {
-            if (errored) {
-              if (!revertedSpecs.has(newSpecKey)) {
-                revertedSpecs.add(newSpecKey)
-                spinner?.error(`Reverting ${newSpec}${workspaceDetails}`, error)
+              // eslint-disable-next-line no-await-in-loop
+              const prResponse = await openGitHubPullRequest(
+                owner,
+                repo,
+                baseBranch,
+                branch,
+                oldPurl,
+                newVersion,
+                {
+                  cwd,
+                  workspaceName
+                }
+              )
+              if (prResponse) {
+                const { data } = prResponse
+                spinner?.info(`Opened PR #${data.number}.`)
+                if (autoMerge) {
+                  // eslint-disable-next-line no-await-in-loop
+                  await enableAutoMerge(data)
+                }
               }
+            } catch (e) {
+              error = e
+              errored = true
             }
-            if (saved) {
-              editablePkgJson.update(revertData)
-            }
+          }
+          if (isCi) {
+            // eslint-disable-next-line no-await-in-loop
+            await gitHardReset(baseBranch, cwd)
             // eslint-disable-next-line no-await-in-loop
-            await Promise.all([
-              shadowNpmInject.removeNodeModules(cwd),
-              ...(isCi
-                ? [gitCheckoutBaseBranchIfAvailable(baseBranch, cwd)]
-                : []),
-              ...(saved && !isCi ? [editablePkgJson.save()] : [])
-            ])
+            await gitCleanFdx(cwd)
             // eslint-disable-next-line no-await-in-loop
-            await install$1(revertTree, {
+            await install$1(arb.idealTree, {
               cwd
             })
-            if (errored) {
-              if (!failedSpecs.has(newSpecKey)) {
-                failedSpecs.add(newSpecKey)
-                spinner?.failAndStop(
-                  `Update failed for ${oldSpec}${workspaceDetails}`
-                )
-              }
+          }
+          if (errored) {
+            if (!isCi) {
+              editablePkgJson.update(revertData)
+              // eslint-disable-next-line no-await-in-loop
+              await Promise.all([
+                shadowNpmInject.removeNodeModules(cwd),
+                editablePkgJson.save()
+              ])
+              // eslint-disable-next-line no-await-in-loop
+              await install$1(arb.idealTree, {
+                cwd
+              })
             }
+            spinner?.failAndStop(
+              `Update failed for ${oldSpec} in ${workspaceName}`,
+              error
+            )
           }
         }
       }
@@ -4435,25 +4422,29 @@ async function install(pkgEnvDetails, options) {
   })
   return await getActualTree(cwd)
 }
+async function readLockfile(pkgPath) {
+  return await vendor.libExports$3.readWantedLockfile(pkgPath, {
+    ignoreIncompatible: false
+  })
+}
 async function pnpmFix(
   pkgEnvDetails,
   { autoMerge, cwd, purls, rangeStyle, spinner, test, testScript }
 ) {
+  spinner?.start()
   const { pkgPath: rootPath } = pkgEnvDetails
-  const lockfile = await vendor.libExports$3.readWantedLockfile(rootPath, {
-    ignoreIncompatible: false
-  })
+  let lockfile = await readLockfile(rootPath)
   if (!lockfile) {
-    return
-  }
-  const alertMapOptions = {
-    consolidate: true,
-    include: {
-      existing: true,
-      unfixable: false,
-      upgradable: false
-    },
-    nothrow: true
+    await install(pkgEnvDetails, {
+      cwd,
+      spinner
+    })
+    lockfile = await readLockfile(rootPath)
+    if (!lockfile) {
+      spinner?.stop()
+      logger.logger.error('Required pnpm-lock.yaml not found.')
+      return
+    }
   }
   const alertsMap = purls.length
     ? await shadowNpmInject.getAlertsMapFromPurls(purls, alertMapOptions)
@@ -4463,9 +4454,10 @@ async function pnpmFix(
       )
   const infoByPkg = shadowNpmInject.getCveInfoByAlertsMap(alertsMap)
   if (!infoByPkg) {
+    spinner?.stop()
+    logger.logger.info('No fixable vulnerabilities found.')
     return
   }
-  spinner?.start()
 
   // Lazily access constants.ENV[CI].
   const isCi = constants.ENV[CI]
@@ -4473,13 +4465,6 @@ async function pnpmFix(
     pkgEnvDetails.agent,
     rootPath
   )
-  const baseBranch = isCi ? getBaseGitBranch() : ''
-  const { owner, repo } = isCi
-    ? getGitHubEnvRepoInfo()
-    : {
-        owner: '',
-        repo: ''
-      }
   const pkgJsonPaths = [
     ...workspacePkgJsonPaths,
     // Process the workspace root last since it will add an override to package.json.
@@ -4488,44 +4473,52 @@ async function pnpmFix(
   for (const { 0: name, 1: infos } of infoByPkg) {
     debug.debugLog(`Processing vulnerable package: ${name}`)
     if (registry.getManifestData(NPM$c, name)) {
-      spinner?.info(`Skipping ${name}. Socket Optimize package exists.`)
+      spinner?.info(`Socket Optimize package for ${name} exists, skipping`)
+      continue
+    }
+    if (!infos.length) {
+      debug.debugLog(`No vulnerability info found for ${name}`)
+      continue
+    }
+    // eslint-disable-next-line no-await-in-loop
+    const packument = await packages.fetchPackagePackument(name)
+    if (!packument) {
+      debug.debugLog(`No packument found for ${name}`)
       continue
     }
+    const availableVersions = Object.keys(packument.versions)
     const fixedSpecs = new Set()
     for (const pkgJsonPath of pkgJsonPaths) {
-      debug.debugLog(`Checking workspace: ${pkgJsonPath}`)
-
-      // eslint-disable-next-line no-await-in-loop
-      let actualTree = await getActualTree(cwd)
+      const pkgPath = path$1.dirname(pkgJsonPath)
       const isWorkspaceRoot =
         pkgJsonPath === pkgEnvDetails.editablePkgJson.filename
       const workspaceName = isWorkspaceRoot
         ? 'root'
-        : path$1.relative(rootPath, path$1.dirname(pkgJsonPath))
-      const editablePkgJson = isWorkspaceRoot
-        ? pkgEnvDetails.editablePkgJson
-        : // eslint-disable-next-line no-await-in-loop
-          await packages.readPackageJson(pkgJsonPath, {
-            editable: true
-          })
+        : path$1.relative(rootPath, pkgPath)
+      debug.debugLog(`Checking workspace: ${workspaceName}`)
 
-      // Get current overrides for revert logic
-      const oldPnpmSection = editablePkgJson.content[PNPM$8]
-      const oldOverrides = oldPnpmSection?.[OVERRIDES$2]
+      // eslint-disable-next-line no-await-in-loop
+      let actualTree = await getActualTree(cwd)
       const oldVersions = arrays.arrayUnique(
         shadowNpmInject
           .findPackageNodes(actualTree, name)
           .map(n => n.target?.version ?? n.version)
           .filter(Boolean)
       )
-      const packument =
-        oldVersions.length && infos.length
-          ? // eslint-disable-next-line no-await-in-loop
-            await packages.fetchPackagePackument(name)
-          : null
-      if (!packument) {
+      if (!oldVersions.length) {
+        debug.debugLog(`Lockfile entries not found for ${name}`)
         continue
       }
+
+      // Always re-read the editable package.json to avoid stale mutations
+      // across iterations.
+      // eslint-disable-next-line no-await-in-loop
+      const editablePkgJson = await packages.readPackageJson(pkgJsonPath, {
+        editable: true
+      })
+      // Get current overrides for revert logic
+      const oldPnpmSection = editablePkgJson.content[PNPM$8]
+      const oldOverrides = oldPnpmSection?.[OVERRIDES$2]
       for (const oldVersion of oldVersions) {
         const oldSpec = `${name}@${oldVersion}`
         const oldPurl = `pkg:npm/${oldSpec}`
@@ -4535,14 +4528,13 @@ async function pnpmFix(
           oldVersion
         )
         if (!node) {
-          debug.debugLog(`Skipping ${oldSpec}, no node found in ${pkgJsonPath}`)
+          debug.debugLog(`Arborist node not found, skipping ${oldSpec}`)
           continue
         }
         for (const {
           firstPatchedVersionIdentifier,
           vulnerableVersionRange
         } of infos) {
-          const availableVersions = Object.keys(packument.versions)
           const newVersion = shadowNpmInject.findBestPatchVersion(
             node,
             availableVersions,
@@ -4552,7 +4544,7 @@ async function pnpmFix(
             ? packument.versions[newVersion]
             : undefined
           if (!(newVersion && newVersionPackument)) {
-            spinner?.fail(`No update available for ${oldSpec}`)
+            spinner?.fail(`No update found for ${oldSpec}.`)
             continue
           }
           const overrideKey = `${name}@${vulnerableVersionRange}`
@@ -4608,28 +4600,27 @@ async function pnpmFix(
           if (updateData) {
             editablePkgJson.update(updateData)
           }
-          const modded = shadowNpmInject.updatePackageJsonFromNode(
+          shadowNpmInject.updatePackageJsonFromNode(
             editablePkgJson,
             actualTree,
             node,
             newVersion,
             rangeStyle
           )
-          debug.debugLog(`Updated package.json from node: ${modded}`)
-
           // eslint-disable-next-line no-await-in-loop
           if (!(await editablePkgJson.save())) {
             debug.debugLog(
-              `No changes saved for ${pkgJsonPath}, skipping install`
+              `Nothing changed for ${workspaceName}, skipping install`
             )
             continue
           }
           spinner?.info(`Installing ${newSpec} in ${workspaceName}`)
-          let errored = false
           let error
+          let errored = false
           try {
             // eslint-disable-next-line no-await-in-loop
             actualTree = await install(pkgEnvDetails, {
+              cwd,
               spinner
             })
             if (test) {
@@ -4643,25 +4634,31 @@ async function pnpmFix(
             fixedSpecs.add(newSpecKey)
             spinner?.successAndStop(`Fixed ${name} in ${workspaceName}`)
             spinner?.start()
+          } catch (e) {
+            error = e
+            errored = true
+          }
+          const baseBranch = isCi ? getBaseGitBranch() : ''
+          if (!errored && isCi) {
             const branch = getSocketBranchName(
               oldPurl,
               newVersion,
               workspaceName
             )
-            const shouldOpenPr = isCi
-              ? // eslint-disable-next-line no-await-in-loop
-                !(await doesPullRequestExistForBranch(owner, repo, branch))
-              : false
-            if (
-              isCi &&
-              shouldOpenPr &&
-              // eslint-disable-next-line no-await-in-loop
-              (await gitCreateAndPushBranchIfNeeded(
-                branch,
-                getSocketCommitMessage(oldPurl, newVersion, workspaceName),
-                cwd
-              ))
-            ) {
+            try {
+              const { owner, repo } = getGitHubEnvRepoInfo()
+              if (
+                // eslint-disable-next-line no-await-in-loop
+                (await doesPullRequestExistForBranch(owner, repo, branch)) ||
+                // eslint-disable-next-line no-await-in-loop
+                !(await gitCreateAndPushBranchIfNeeded(
+                  branch,
+                  getSocketCommitMessage(oldPurl, newVersion, workspaceName),
+                  cwd
+                ))
+              ) {
+                continue
+              }
               // eslint-disable-next-line no-await-in-loop
               const prResponse = await openGitHubPullRequest(
                 owner,
@@ -4677,41 +4674,46 @@ async function pnpmFix(
               )
               if (prResponse) {
                 const { data } = prResponse
-                spinner?.info(`PR #${data.number} opened.`)
+                spinner?.info(`Opened PR #${data.number}.`)
                 if (autoMerge) {
                   // eslint-disable-next-line no-await-in-loop
                   await enableAutoMerge(data)
                 }
               }
+            } catch (e) {
+              error = e
+              errored = true
             }
-          } catch (e) {
-            error = e
-            errored = true
           }
-          if (errored) {
-            editablePkgJson.update(revertData)
+          if (isCi) {
             // eslint-disable-next-line no-await-in-loop
-            await Promise.all([
-              shadowNpmInject.removeNodeModules(cwd),
-              editablePkgJson.save()
-            ])
+            await gitHardReset(baseBranch, cwd)
+            // eslint-disable-next-line no-await-in-loop
+            await gitCleanFdx(cwd)
             // eslint-disable-next-line no-await-in-loop
             actualTree = await install(pkgEnvDetails, {
+              cwd,
               spinner
             })
+          }
+          if (errored) {
+            if (!isCi) {
+              editablePkgJson.update(revertData)
+              // eslint-disable-next-line no-await-in-loop
+              await Promise.all([
+                shadowNpmInject.removeNodeModules(cwd),
+                editablePkgJson.save()
+              ])
+              // eslint-disable-next-line no-await-in-loop
+              actualTree = await install(pkgEnvDetails, {
+                cwd,
+                spinner
+              })
+            }
             spinner?.failAndStop(
               `Update failed for ${oldSpec} in ${workspaceName}`,
               error
             )
-          } else if (isCi) {
-            // eslint-disable-next-line no-await-in-loop
-            await gitHardReset(baseBranch, cwd)
-            // eslint-disable-next-line no-await-in-loop
-            await gitCleanFdx(cwd)
-            // eslint-disable-next-line no-await-in-loop
-            actualTree = await install(pkgEnvDetails, {
-              spinner
-            })
           }
         }
       }
@@ -4720,29 +4722,6 @@ async function pnpmFix(
   spinner?.stop()
 }
 
-const CMD_NAME$1 = 'socket fix'
-function assignDefaultFixOptions(options) {
-  if (options.autoPilot === undefined) {
-    options.autoPilot = false
-  }
-  if (options.autoMerge === undefined) {
-    options.autoMerge = !!options.autoPilot
-  }
-  if (options.cwd === undefined) {
-    options.cwd = process.cwd()
-  }
-  if (options.rangeStyle === undefined) {
-    options.rangeStyle = 'preserve'
-  }
-  if (options.test === undefined) {
-    options.test = !!options.autoPilot || !!options.testScript
-  }
-  if (options.testScript === undefined) {
-    options.testScript = 'test'
-  }
-  return options
-}
-
 const {
   BINARY_LOCK_EXT,
   BUN: BUN$5,
@@ -12285,7 +12264,7 @@ void (async () => {
   await vendor.updater({
     name: SOCKET_CLI_BIN_NAME,
     // The '@rollup/plugin-replace' will replace "process.env['INLINED_SOCKET_CLI_VERSION']".
-    version: '0.14.128',
+    version: '0.14.130',
     ttl: 86_400_000 /* 24 hours in milliseconds */
   })
   try {
@@ -12353,5 +12332,5 @@ void (async () => {
     await shadowNpmInject.captureException(e)
   }
 })()
-//# debugId=1cf3ad9d-ff12-4caf-ae88-f575b2997ce2
+//# debugId=cff09185-7f8e-4487-ada1-cd5f599c6e2
 //# sourceMappingURL=cli.js.map