@socketsecurity/cli 1.1.171 → 1.1.173

package/CHANGELOG.md

@@ -4,6 +4,19 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## [1.1.173](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.173) - 2026-09-16
+
+### Changed
+- Updated the Coana CLI to v `15.10.43`.
+
+## [1.1.172](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.172) - 2026-09-16
+
+### Added
+- Added the `--reach-fallback-to-regular-scan` flag to `socket scan create`, keeping the scan moving with regular SCA results when full application reachability analysis fails. The JSON and Markdown output carry a `reachabilityFallback` marker so automation can tell a downgraded scan from a full one.
+
+### Changed
+- Updated the Coana CLI to v `15.10.42`.
+
 ## [1.1.171](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.171) - 2026-09-11
 
 ### Changed

package/README.md

@@ -1,8 +1,8 @@
 # Socket CLI
 
 [![Socket Badge](https://socket.dev/api/badge/npm/package/socket)](https://socket.dev/npm/package/socket)
-[![Follow @SocketSecurity](https://raw.githubusercontent.com/SocketDev/socket-cli/v1.1.171/assets/fleet/badge-follow-x.svg)](https://twitter.com/SocketSecurity)
-[![Follow @socket.dev on Bluesky](https://raw.githubusercontent.com/SocketDev/socket-cli/v1.1.171/assets/fleet/badge-follow-bluesky.svg)](https://bsky.app/profile/socket.dev)
+[![Follow @SocketSecurity](https://raw.githubusercontent.com/SocketDev/socket-cli/v1.1.173/assets/fleet/badge-follow-x.svg)](https://twitter.com/SocketSecurity)
+[![Follow @socket.dev on Bluesky](https://raw.githubusercontent.com/SocketDev/socket-cli/v1.1.173/assets/fleet/badge-follow-bluesky.svg)](https://bsky.app/profile/socket.dev)
 
 CLI for [Socket.dev](https://socket.dev) — scan dependencies, audit packages, apply security patches, and gate installs from your terminal or CI. This is the 1.x line of the published `socket` package on npm.
 
@@ -138,8 +138,8 @@ MIT
 <br/>
 <div align="center">
   <picture>
-    <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.1.171/assets/fleet/socket-combomark-dark.svg">
-    <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.1.171/assets/fleet/socket-combomark-light.svg">
-    <img width="324" height="104" alt="Socket" src="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.1.171/assets/fleet/socket-combomark-light.svg">
+    <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.1.173/assets/fleet/socket-combomark-dark.svg">
+    <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.1.173/assets/fleet/socket-combomark-light.svg">
+    <img width="324" height="104" alt="Socket" src="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.1.173/assets/fleet/socket-combomark-light.svg">
   </picture>
 </div>

package/dist/cli.js

@@ -1708,6 +1708,7 @@ async function outputCreateNewScan(result, options) {
   const {
     interactive = false,
     outputKind = 'text',
+    reachabilityFallback,
     spinner = constants.default.spinner
   } = {
     __proto__: null,
@@ -1719,7 +1720,11 @@ async function outputCreateNewScan(result, options) {
   const wasSpinning = !!spinner?.isSpinning;
   spinner?.stop();
   if (outputKind === 'json') {
-    logger.logger.log(utils.serializeResultJson(result));
+    const payload = reachabilityFallback ? {
+      ...result,
+      reachabilityFallback
+    } : result;
+    logger.logger.log(utils.serializeResultJson(payload));
     if (wasSpinning) {
       spinner.start();
     }
@@ -1739,6 +1744,10 @@ async function outputCreateNewScan(result, options) {
   if (outputKind === 'markdown') {
     logger.logger.log('# Create New Scan');
     logger.logger.log('');
+    if (reachabilityFallback) {
+      logger.logger.log(`Reachability analysis failed (${reachabilityFallback.message}); this Scan holds regular SCA results only.`);
+      logger.logger.log('');
+    }
     if (result.data.id) {
       logger.logger.log(`A [new Scan](${result.data.html_report_url}) was created with ID: ${result.data.id}`);
       logger.logger.log('');
@@ -7256,6 +7265,7 @@ async function handleCreateNewScan({
     let scanPaths = packagePaths;
     let tier1ReachabilityScanId;
     let reachabilityReport;
+    let reachabilityFallback;
 
     // If reachability is enabled, perform reachability analysis.
     if (reach.runReachabilityAnalysis) {
@@ -7265,6 +7275,11 @@ async function handleCreateNewScan({
       debug.debugDir('inspect', {
         reachabilityOptions: mergedReachabilityOptions
       });
+      const factsSnapshot = await utils.snapshotSocketFacts(packagePaths, {
+        cwd,
+        outputPath: constants.default.DOT_SOCKET_DOT_FACTS_JSON,
+        tmpDir: manifestTmpDir
+      });
       spinner.start();
       const reachResult = await performReachabilityAnalysis({
         branchName,
@@ -7280,27 +7295,39 @@ async function handleCreateNewScan({
       });
       spinner.stop();
       if (!reachResult.ok) {
-        await outputCreateNewScan(reachResult, {
-          interactive,
-          outputKind
-        });
-        return;
+        if (reach.reachFallbackToRegularScan) {
+          reachabilityFallback = {
+            cause: reachResult.cause,
+            message: reachResult.message
+          };
+          // Restore the pre-analysis facts files: the regular scan must upload
+          // the inputs it would have had without --reach, not partial output.
+          await factsSnapshot.restore();
+          logger.logger.warn(`Reachability analysis failed: ${reachResult.message}${reachResult.cause ? ` — ${reachResult.cause}` : ''}. Falling back to a regular SCA scan without reachability results.`);
+        } else {
+          await outputCreateNewScan(reachResult, {
+            interactive,
+            outputKind
+          });
+          return;
+        }
+      } else {
+        logger.logger.success('Reachability analysis completed successfully');
+        reachabilityReport = reachResult.data?.reachabilityReport;
+
+        // When using only pre-generated SBOMs, build the scan from those inputs —
+        // CycloneDX, SPDX, and Socket facts (`.socket.facts.json`) — matching
+        // Coana's `--use-only-pregenerated-sboms` selection. Otherwise drop any
+        // stray `.socket.facts.json`; coana's fresh reachability report (appended
+        // below) is the authoritative facts file for the scan.
+        const pathsForScan = reach.reachUseOnlyPregeneratedSboms ? filterToPregeneratedSboms(packagePaths, supportedFiles) : packagePaths.filter(p => path.basename(p) !== constants.default.DOT_SOCKET_DOT_FACTS_JSON);
+
+        // Append coana's reachability report, but not twice: a pre-generated facts
+        // input can resolve to the same path coana wrote its report to.
+        const reportPath = reachabilityReport ? path.resolve(cwd, reachabilityReport) : undefined;
+        scanPaths = [...pathsForScan.filter(p => path.resolve(cwd, p) !== reportPath), ...(reachabilityReport ? [reachabilityReport] : [])];
+        tier1ReachabilityScanId = reachResult.data?.tier1ReachabilityScanId;
       }
-      logger.logger.success('Reachability analysis completed successfully');
-      reachabilityReport = reachResult.data?.reachabilityReport;
-
-      // When using only pre-generated SBOMs, build the scan from those inputs —
-      // CycloneDX, SPDX, and Socket facts (`.socket.facts.json`) — matching
-      // Coana's `--use-only-pregenerated-sboms` selection. Otherwise drop any
-      // stray `.socket.facts.json`; coana's fresh reachability report (appended
-      // below) is the authoritative facts file for the scan.
-      const pathsForScan = reach.reachUseOnlyPregeneratedSboms ? filterToPregeneratedSboms(packagePaths, supportedFiles) : packagePaths.filter(p => path.basename(p) !== constants.default.DOT_SOCKET_DOT_FACTS_JSON);
-
-      // Append coana's reachability report, but not twice: a pre-generated facts
-      // input can resolve to the same path coana wrote its report to.
-      const reportPath = reachabilityReport ? path.resolve(cwd, reachabilityReport) : undefined;
-      scanPaths = [...pathsForScan.filter(p => path.resolve(cwd, p) !== reportPath), ...(reachabilityReport ? [reachabilityReport] : [])];
-      tier1ReachabilityScanId = reachResult.data?.tier1ReachabilityScanId;
     }
 
     // Brotli-compress any .socket.facts.json paths in scanPaths just before
@@ -7319,7 +7346,7 @@ async function handleCreateNewScan({
         pullRequest,
         repoName,
         branchName,
-        scanType: reach.runReachabilityAnalysis ? constants.default.SCAN_TYPE_SOCKET_TIER1 : constants.default.SCAN_TYPE_SOCKET,
+        scanType: reach.runReachabilityAnalysis && !reachabilityFallback ? constants.default.SCAN_TYPE_SOCKET_TIER1 : constants.default.SCAN_TYPE_SOCKET,
         workspace
       }, {
         cwd,
@@ -7333,7 +7360,7 @@ async function handleCreateNewScan({
     const scanId = fullScanCResult.ok ? fullScanCResult.data?.id : undefined;
     if (reach && scanId && tier1ReachabilityScanId) {
       await finalizeTier1Scan(tier1ReachabilityScanId, scanId);
-    } else if (reach.runReachabilityAnalysis && scanId && !tier1ReachabilityScanId) {
+    } else if (reach.runReachabilityAnalysis && scanId && !tier1ReachabilityScanId && !reachabilityFallback) {
       // Reachability analysis ran and a scan was created, but no full
       // application reachability scan id was extracted from the facts file.
       // Surface this instead of silently skipping finalize — otherwise the
@@ -7381,14 +7408,16 @@ async function handleCreateNewScan({
           data: fullScanCResult.data
         }, {
           interactive,
-          outputKind
+          outputKind,
+          reachabilityFallback
         });
       }
     } else {
       spinner.stop();
       await outputCreateNewScan(fullScanCResult, {
         interactive,
-        outputKind
+        outputKind,
+        reachabilityFallback
       });
     }
   });
@@ -7462,6 +7491,7 @@ async function handleCi(autoManifest) {
       reachEcosystems: [],
       reachEnableAnalysisSplitting: false,
       reachExcludePaths: [],
+      reachFallbackToRegularScan: false,
       reachRetainFactsFile: false,
       reachSkipCache: false,
       reachUseOnlyPregeneratedSboms: false,
@@ -19373,6 +19403,11 @@ const reachabilityFlags = {
     hidden: true,
     description: 'Deprecated: use --exclude-paths instead. List of paths to exclude from reachability analysis, as either a comma separated value or as multiple flags.'
   },
+  reachFallbackToRegularScan: {
+    type: 'boolean',
+    default: false,
+    description: 'If reachability analysis fails, continue with a regular SCA scan (without reachability results) instead of halting. By default, the CLI halts on reachability errors.'
+  },
   reachLazyMode: {
     type: 'boolean',
     default: false,
@@ -19668,6 +19703,7 @@ async function run$d(argv, importMeta, {
     reachDisableAnalytics,
     reachDisableExternalToolChecks,
     reachEnableAnalysisSplitting,
+    reachFallbackToRegularScan,
     reachLazyMode: _reachLazyMode,
     reachRetainFactsFile,
     reachSkipCache,
@@ -19926,6 +19962,7 @@ async function run$d(argv, importMeta, {
       reachEcosystems,
       reachEnableAnalysisSplitting: Boolean(reachEnableAnalysisSplitting),
       reachExcludePaths,
+      reachFallbackToRegularScan: Boolean(reachFallbackToRegularScan),
       reachRetainFactsFile: Boolean(reachRetainFactsFile),
       reachSkipCache: Boolean(reachSkipCache),
       reachUseOnlyPregeneratedSboms: Boolean(reachUseOnlyPregeneratedSboms),
@@ -20643,6 +20680,7 @@ async function scanOneRepo(repoSlug, {
       reachEcosystems: [],
       reachEnableAnalysisSplitting: false,
       reachExcludePaths: [],
+      reachFallbackToRegularScan: false,
       reachRetainFactsFile: false,
       reachSkipCache: false,
       reachUseOnlyPregeneratedSboms: false,
@@ -21939,6 +21977,13 @@ const reachabilityFlagsForReach = {
     type: 'boolean',
     default: false,
     description: `${DYNAMIC_SBOM_INFERENCE_DESCRIPTION} The reachability analysis is split per project/module accordingly.`
+  },
+  // Fallback targets scan creation, which this command never performs.
+  reachFallbackToRegularScan: {
+    type: 'boolean',
+    default: false,
+    hidden: true,
+    description: 'No-op: only `socket scan create --reach` falls back to a regular SCA scan on reachability failure.'
   }
 };
 const generalFlags = {
@@ -24093,5 +24138,5 @@ process.on('unhandledRejection', async (reason, promise) => {
   // eslint-disable-next-line n/no-process-exit
   process.exit(1);
 });
-//# debugId=4125e182-5da6-4cc5-ae30-fed3061b33a7
+//# debugId=7293854f-1543-486e-ba22-c269ec717113
 //# sourceMappingURL=cli.js.map