@socketsecurity/cli 0.14.29 → 0.14.30

package/dist/require/npm-injection.js

@@ -29,7 +29,7 @@ var arborist = {};
 var ttyServer$1 = {};
 
 var name = "@socketsecurity/cli";
-var version = "0.14.29";
+var version = "0.14.30";
 var description = "CLI tool for Socket.dev";
 var homepage = "http://github.com/SocketDev/socket-cli";
 var license = "MIT";
@@ -640,7 +640,7 @@ var _misc = sdk.misc;
 var _pathResolve = pathResolve.pathResolve;
 var _sdk = sdk.sdk;
 var _settings = sdk.settings;
-const POTENTIALLY_BUG_ERROR_SNIPPET = 'this is potentially a bug with socket-npm caused by changes to the npm cli';
+const POTENTIAL_BUG_ERROR_MESSAGE = `This is may be a bug with socket-npm related to changes to the npm CLI.\nPlease report to ${_constants$1.SOCKET_CLI_ISSUES_URL}.`;
 const npmEntrypoint = (0, _nodeFs.realpathSync)(process.argv[1]);
 const npmRootPath = (0, _pathResolve.findRoot)(_nodePath.dirname(npmEntrypoint));
 function tryRequire(...ids) {
@@ -666,12 +666,9 @@ function tryRequire(...ids) {
   return undefined;
 }
 if (npmRootPath === undefined) {
-  console.error(`Unable to find npm cli install directory, ${POTENTIALLY_BUG_ERROR_SNIPPET}.`);
-  console.error(`Searched parent directories of ${npmEntrypoint}`);
+  console.error(`Unable to find npm CLI install directory.\nSearched parent directories of ${npmEntrypoint}.\n\n${POTENTIAL_BUG_ERROR_MESSAGE}`);
   process.exit(127);
 }
-const LOOP_SENTINEL = 1_000_000;
-const NPM_REGISTRY_URL = 'https://registry.npmjs.org';
 const npmNmPath = _nodePath.join(npmRootPath, 'node_modules');
 const arboristPkgPath = _nodePath.join(npmNmPath, '@npmcli/arborist');
 const arboristClassPath = _nodePath.join(arboristPkgPath, 'lib/arborist/index.js');
@@ -684,7 +681,7 @@ const log = tryRequire([_nodePath.join(npmNmPath, 'proc-log/lib/index.js'),
 // is really that of its export log.
 mod => mod.log], _nodePath.join(npmNmPath, 'npmlog/lib/log.js'));
 if (log === undefined) {
-  console.error(`Unable to integrate with npm cli logging infrastructure, ${POTENTIALLY_BUG_ERROR_SNIPPET}.`);
+  console.error(`Unable to integrate with npm CLI logging infrastructure.\n\n${POTENTIAL_BUG_ERROR_MESSAGE}.`);
   process.exit(127);
 }
 const pacote = tryRequire(_nodePath.join(npmNmPath, 'pacote'), 'pacote');
@@ -841,11 +838,16 @@ async function packagesHaveRiskyIssues(safeArb, _registry, pkgs, output) {
       if (pkgData.type === 'missing') {
         result = true;
         failures.push({
-          type: 'missingDependency'
+          type: 'missingDependency',
+          block: false,
+          raw: undefined
         });
       } else {
         let blocked = false;
         for (const failure of pkgData.value.issues) {
+          const {
+            type
+          } = failure;
           // eslint-disable-next-line no-await-in-loop
           const ux = await uxLookup({
             package: {
@@ -853,33 +855,34 @@ async function packagesHaveRiskyIssues(safeArb, _registry, pkgs, output) {
               version
             },
             issue: {
-              type: failure.type
+              type
             }
           });
-          if (ux.display || ux.block) {
+          if (ux.block) {
+            result = true;
+            blocked = true;
+          }
+          if (ux.display) {
+            displayWarning = true;
+          }
+          if (ux.block || ux.display) {
             failures.push({
-              raw: failure,
-              block: ux.block
+              type,
+              block: ux.block,
+              raw: failure
             });
             // Before we ask about problematic issues, check to see if they
             // already existed in the old version if they did, be quiet.
             const pkg = pkgs.find(p => p.pkgid === id && p.existing?.startsWith(`${name}@`));
             if (pkg?.existing) {
+              const oldPkgData =
               // eslint-disable-next-line no-await-in-loop
-              for await (const oldPkgData of batchScan([pkg.existing])) {
-                if (oldPkgData.type === 'success') {
-                  failures = failures.filter(issue => oldPkgData.value.issues.find(oldIssue => oldIssue.type === issue.raw.type) == null);
-                }
+              (await batchScan([pkg.existing]).next()).value;
+              if (oldPkgData.type === 'success') {
+                failures = failures.filter(issue => oldPkgData.value.issues.find(oldIssue => oldIssue.type === issue.type) === undefined);
               }
             }
           }
-          if (ux.block) {
-            result = true;
-            blocked = true;
-          }
-          if (ux.display) {
-            displayWarning = true;
-          }
         }
         if (!blocked) {
           const pkg = pkgs.find(p => p.pkgid === id);
@@ -895,15 +898,26 @@ async function packagesHaveRiskyIssues(safeArb, _registry, pkgs, output) {
       }
       if (displayWarning) {
         spinner.stop(`(socket) ${formatter.hyperlink(id, `https://socket.dev/npm/package/${name}/overview/${version}`)} contains risks:`);
-        failures.sort((a, b) => a.raw.type < b.raw.type ? -1 : 1);
+        // Filter issues for blessed packages.
+        if (name === 'socket' || name.startsWith('@socketregistry/') || name.startsWith('@socketsecurity/')) {
+          failures = failures.filter(({
+            type
+          }) => type !== 'unpopularPackage' && type !== 'unstableOwnership');
+        }
+        failures.sort((a, b) => a.type < b.type ? -1 : 1);
         const lines = new Set();
         for (const failure of failures) {
-          const type = failure.raw.type;
-          if (type) {
-            const issueTypeTranslation = translations.issues[type];
-            // TODO: emoji seems to mis-align terminals sometimes
-            lines.add(`  ${issueTypeTranslation?.title ?? type}${failure.block ? '' : ' (non-blocking)'} - ${issueTypeTranslation?.description ?? ''}\n`);
-          }
+          const {
+            type
+          } = failure;
+          // Based data from { pageProps: { alertTypes } } of:
+          // https://socket.dev/_next/data/94666139314b6437ee4491a0864e72b264547585/en-US.json
+          const info = translations.issues[type];
+          const title = info?.title ?? type;
+          const maybeBlocking = failure.block ? '' : ' (non-blocking)';
+          const maybeDesc = info?.description ? ` - ${info.description}` : '';
+          // TODO: emoji seems to mis-align terminals sometimes
+          lines.add(`  ${title}${maybeBlocking}${maybeDesc}\n`);
         }
         for (const line of lines) {
           output?.write(line);
@@ -937,7 +951,7 @@ function walk(diff_, needInfoOn = []) {
     length: queueLength
   } = queue;
   while (pos < queueLength) {
-    if (pos === LOOP_SENTINEL) {
+    if (pos === _constants$1.LOOP_SENTINEL) {
       throw new Error('Detected infinite loop while walking Arborist diff');
     }
     const diff = queue[pos++];
@@ -1509,7 +1523,7 @@ class SafeOverrideSet extends OverrideSet {
       length: queueLength
     } = queue;
     while (pos < queueLength) {
-      if (pos === LOOP_SENTINEL) {
+      if (pos === _constants$1.LOOP_SENTINEL) {
         throw new Error('Detected infinite loop while comparing override sets');
       }
       const {
@@ -1651,10 +1665,10 @@ class SafeArborist extends Arborist {
     options['save'] = old.save;
     options['saveBundle'] = old.saveBundle;
     // Nothing to check, mmm already installed or all private?
-    if (diff.findIndex(c => c.repository_url === NPM_REGISTRY_URL) === -1) {
+    if (diff.findIndex(c => c.repository_url === _constants$1.NPM_REGISTRY_URL) === -1) {
       return await this[kRiskyReify](...args);
     }
-    let proceed = _constants$1.ENV.UPDATE_SOCKET_OVERRIDES_IN_PACKAGE_LOCK_FILE;
+    let proceed = _constants$1.ENV[_constants$1.UPDATE_SOCKET_OVERRIDES_IN_PACKAGE_LOCK_FILE];
     if (!proceed) {
       proceed = await ttyServer.captureTTY(async (input, output) => {
         if (input && output) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@socketsecurity/cli",
-  "version": "0.14.29",
+  "version": "0.14.30",
   "description": "CLI tool for Socket.dev",
   "homepage": "http://github.com/SocketDev/socket-cli",
   "license": "MIT",
@@ -75,7 +75,7 @@
   },
   "dependencies": {
     "@apideck/better-ajv-errors": "^0.3.6",
-    "@cyclonedx/cdxgen": "^11.0.3",
+    "@cyclonedx/cdxgen": "^11.0.5",
     "@inquirer/prompts": "^7.1.0",
     "@npmcli/promise-spawn": "^8.0.2",
     "@socketregistry/hyrious__bun.lockb": "1.0.5",