@socketsecurity/cli 1.1.178 → 1.1.180

package/CHANGELOG.md

@@ -4,6 +4,24 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## [1.1.180](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.180) - 2026-09-25
+
+### Changed
+- A failed Conda manifest step now stops `--auto-manifest` instead of uploading a scan that under-reports your `pip:` dependencies, matching how Gradle, Maven and sbt already behave.
+
+### Fixed
+- `--auto-manifest` now reads whichever Conda environment file your project uses, `environment.yml` or `environment.yaml`. Repos on the `.yaml` spelling no longer need a `socket.json` workaround.
+- The Conda `requirements.txt` now lands in the directory you targeted, so scans pick it up even when you run the CLI from somewhere else.
+
+## [1.1.179](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.179) - 2026-09-24
+
+### Changed
+- Updated the Coana CLI to v `15.10.55`.
+- Generated Maven, Gradle and sbt `.socket.facts.json` files are now substantially smaller, making uploads for large JVM projects faster and more reliable.
+
+### Fixed
+- Running `socket manifest maven` or `socket manifest scala` on a directory without a build now fails with a clear message, instead of crashing (Maven) or silently producing a bogus Socket facts file (sbt).
+
 ## [1.1.178](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.178) - 2026-09-23
 
 ### Changed

package/README.md

@@ -1,8 +1,8 @@
 # Socket CLI
 
 [![Socket Badge](https://socket.dev/api/badge/npm/package/socket)](https://socket.dev/npm/package/socket)
-[![Follow @SocketSecurity](https://raw.githubusercontent.com/SocketDev/socket-cli/v1.1.178/assets/fleet/badge-follow-x.svg)](https://twitter.com/SocketSecurity)
-[![Follow @socket.dev on Bluesky](https://raw.githubusercontent.com/SocketDev/socket-cli/v1.1.178/assets/fleet/badge-follow-bluesky.svg)](https://bsky.app/profile/socket.dev)
+[![Follow @SocketSecurity](https://raw.githubusercontent.com/SocketDev/socket-cli/v1.1.180/assets/fleet/badge-follow-x.svg)](https://twitter.com/SocketSecurity)
+[![Follow @socket.dev on Bluesky](https://raw.githubusercontent.com/SocketDev/socket-cli/v1.1.180/assets/fleet/badge-follow-bluesky.svg)](https://bsky.app/profile/socket.dev)
 
 CLI for [Socket.dev](https://socket.dev) — scan dependencies, audit packages, apply security patches, and gate installs from your terminal or CI. This is the 1.x line of the published `socket` package on npm.
 
@@ -138,8 +138,8 @@ MIT
 <br/>
 <div align="center">
   <picture>
-    <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.1.178/assets/fleet/socket-combomark-dark.svg">
-    <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.1.178/assets/fleet/socket-combomark-light.svg">
-    <img width="324" height="104" alt="Socket" src="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.1.178/assets/fleet/socket-combomark-light.svg">
+    <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.1.180/assets/fleet/socket-combomark-dark.svg">
+    <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.1.180/assets/fleet/socket-combomark-light.svg">
+    <img width="324" height="104" alt="Socket" src="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.1.180/assets/fleet/socket-combomark-light.svg">
   </picture>
 </div>

package/dist/cli.js

@@ -1821,6 +1821,10 @@ function reachMemoryLimitToMb(value) {
 // = classpath entries (jars / module output dirs); `sources` = module source
 // roots.
 
+function projectClasspathKey(project) {
+  return `${project.subprojectDir} ${project.namespace ?? ''}:${project.name}`;
+}
+
 // Coordinate-based (not `id`-based) so it also matches foreign SBOMs like
 // CycloneDX. Empty segments dropped.
 function mavenCoordinateKey(groupId, artifactId, type, classifier, version) {
@@ -1877,7 +1881,10 @@ function sortByPurl(entries) {
 function accumulateSidecar(acc, facts, artifactPaths, factsFile) {
   acc.set(factsFile, {
     components: facts.components.map(comp => attachPaths(comp, artifactPaths)),
-    projects: (facts.projects ?? []).map(proj => attachPaths(proj, artifactPaths))
+    projects: (facts.projects ?? []).map(proj => ({
+      ...attachPaths(proj, artifactPaths),
+      classpath: [...(artifactPaths.classpathByProject.get(projectClasspathKey(proj)) ?? [])]
+    }))
   });
 }
 function hasResolvedPathsSidecarEntries(sidecar) {
@@ -2283,6 +2290,39 @@ function formatMissingEnvVarRefs(missing) {
   return `references ${names}, which ${verb} not set in this environment`;
 }
 
+// PATH fallback when no `bin` and no project wrapper.
+const DEFAULT_BUILD_TOOL_BIN = {
+  __proto__: null,
+  gradle: 'gradle',
+  maven: 'mvn',
+  sbt: 'sbt'
+};
+
+// Project-local wrapper, preferred because it pins the expected build-tool
+// version. sbt has no wrapper convention. POSIX names only (no win32 target).
+const BUILD_TOOL_WRAPPER = {
+  __proto__: null,
+  gradle: 'gradlew',
+  maven: 'mvnw'
+};
+
+// sbt happily runs in any directory, synthesizing a default project from its
+// name, so an sbt run outside a build yields a plausible but bogus SBOM. Maven
+// and Gradle refuse such a directory themselves.
+function looksLikeSbtBuild(projectDir) {
+  return fs$1.existsSync(path.resolve(projectDir, 'build.sbt')) || fs$1.existsSync(path.resolve(projectDir, 'project'));
+}
+function resolveBuildToolBin(tool, projectDir, bin) {
+  if (bin) {
+    return bin;
+  }
+  const wrapperName = BUILD_TOOL_WRAPPER[tool];
+  if (wrapperName && fs$1.existsSync(path.resolve(projectDir, wrapperName))) {
+    return `./${wrapperName}`;
+  }
+  return DEFAULT_BUILD_TOOL_BIN[tool];
+}
+
 // Gradle's variant-aware resolver: distinct exceptions give mutually-exclusive
 // phrasing, so most-specific-first substring checks classify reliably.
 function classifyGradleFailure(detail) {
@@ -2646,10 +2686,10 @@ function assembleFacts(parsed, opts = {}) {
   const {
     directByRoot,
     finalNodes
-  } = mergePathSensitive(perRoot);
+  } = mergeByCoordinate(perRoot);
   const tool = parsed.tool || 'gradle';
   const components = buildComponents(finalNodes);
-  const projects = opts.emitProjects === false ? [] : buildProjects(parsed, finalNodes, directByRoot, perRoot);
+  const projects = opts.emitProjects === false ? [] : buildProjects(parsed, directByRoot, perRoot);
   const metadata = {
     format: 'socket-facts-sbom',
     tool,
@@ -2669,15 +2709,12 @@ function assembleFacts(parsed, opts = {}) {
   return {
     facts,
     report: buildReport(parsed),
-    artifactPaths: buildArtifactPaths(finalNodes, [...parsed.projects.values()], fileExists)
+    artifactPaths: buildArtifactPaths(finalNodes, [...parsed.projects.values()], perRoot, fileExists)
   };
 }
 function gav(group, name, version) {
   return `${group}:${name}:${version}`;
 }
-function shortHash(s) {
-  return require$$0.createHash('sha256').update(s, 'utf8').digest('hex').slice(0, 12);
-}
 function buildPerRoot(parsed) {
   const out = new Map();
   for (const [rootId, r] of parsed.roots) {
@@ -2697,7 +2734,7 @@ function buildPerRoot(parsed) {
     for (const [coordId, n] of r.nodes) {
       nodes.set(coordId, {
         coord: n.coord,
-        children: [...(childrenByParent.get(coordId) ?? [])].sort(),
+        children: [...(childrenByParent.get(coordId) ?? [])],
         direct: n.direct,
         targets: n.targets
       });
@@ -2711,62 +2748,10 @@ function buildPerRoot(parsed) {
   return out;
 }
 
-// A coordinate with identical subtrees everywhere collapses to one node (id =
-// coordId); divergent subtrees each get a content-addressed id
-// (`<coordId>#<subtree-hash>`) so per-subproject overrides stay distinct.
-function mergePathSensitive(perRoot) {
-  const memo = new Map();
-  const nodesOf = rootId => perRoot.get(rootId)?.nodes;
-  function computeSig(rootId, coordId, onPath) {
-    const memoKey = rootId + ' ' + coordId;
-    const cached = memo.get(memoKey);
-    if (cached !== undefined) {
-      return cached;
-    }
-    if (onPath.has(coordId)) {
-      // Cycle: back-edge as leaf.
-      return coordId;
-    }
-    const node = nodesOf(rootId)?.get(coordId);
-    if (!node) {
-      return coordId;
-    }
-    onPath.add(coordId);
-    const childSigs = node.children.map(c => computeSig(rootId, c, onPath));
-    onPath.delete(coordId);
-    // Digest, not the raw string: caching expanded subtree strings OOMs on
-    // reconverging DAGs; a fixed-size digest keeps the pass O(V+E).
-    const sig = coordId + '{' + childSigs.join(',') + '}';
-    const digest = require$$0.createHash('sha256').update(sig, 'utf8').digest('hex').slice(0, 16);
-    memo.set(memoKey, digest);
-    return digest;
-  }
-
-  // Sorted iteration keeps cyclic-graph signatures stable run-to-run.
-  const sigsByCoord = new Map();
-  for (const rootId of [...perRoot.keys()].sort()) {
-    const nodes = perRoot.get(rootId).nodes;
-    for (const coordId of [...nodes.keys()].sort()) {
-      const sig = computeSig(rootId, coordId, new Set());
-      let set = sigsByCoord.get(coordId);
-      if (!set) {
-        set = new Set();
-        sigsByCoord.set(coordId, set);
-      }
-      set.add(sig);
-    }
-  }
-  const divergent = coordId => (sigsByCoord.get(coordId)?.size ?? 0) > 1;
-  const emittedIdMemo = new Map();
-  const emittedIdFor = (rootId, coordId) => {
-    const k = rootId + ' ' + coordId;
-    let v = emittedIdMemo.get(k);
-    if (v === undefined) {
-      v = divergent(coordId) ? coordId + '#' + shortHash(computeSig(rootId, coordId, new Set())) : coordId;
-      emittedIdMemo.set(k, v);
-    }
-    return v;
-  };
+// Components are merged by coordinate across every resolution root; which
+// coordinates belong to which subproject is kept separately (classpathByProject)
+// for reachability, which needs each subproject's exact classpath.
+function mergeByCoordinate(perRoot) {
   const finalNodes = new Map();
   const directByRoot = new Map();
   for (const [rootId, {
@@ -2774,8 +2759,7 @@ function mergePathSensitive(perRoot) {
     prod
   }] of perRoot) {
     for (const [coordId, node] of nodes) {
-      const eid = emittedIdFor(rootId, coordId);
-      let fn = finalNodes.get(eid);
+      let fn = finalNodes.get(coordId);
       if (!fn) {
         fn = {
           coord: node.coord,
@@ -2784,7 +2768,7 @@ function mergePathSensitive(perRoot) {
           direct: false,
           targets: new Set()
         };
-        finalNodes.set(eid, fn);
+        finalNodes.set(coordId, fn);
       }
       if (prod) {
         fn.prod = true;
@@ -2793,7 +2777,7 @@ function mergePathSensitive(perRoot) {
         fn.direct = true;
       }
       for (const c of node.children) {
-        fn.children.add(emittedIdFor(rootId, c));
+        fn.children.add(c);
       }
       for (const t of node.targets) {
         fn.targets.add(t);
@@ -2804,7 +2788,7 @@ function mergePathSensitive(perRoot) {
           d = new Set();
           directByRoot.set(rootId, d);
         }
-        d.add(eid);
+        d.add(coordId);
       }
     }
   }
@@ -2850,17 +2834,7 @@ function buildComponents(finalNodes) {
     return comp;
   });
 }
-function buildProjects(parsed, finalNodes, directByRoot, perRoot) {
-  const idsByGav = new Map();
-  for (const [id, fn] of finalNodes) {
-    const key = gav(fn.coord.group, fn.coord.name, fn.coord.version ?? '');
-    let set = idsByGav.get(key);
-    if (!set) {
-      set = new Set();
-      idsByGav.set(key, set);
-    }
-    set.add(id);
-  }
+function buildProjects(parsed, directByRoot, perRoot) {
   const directByProject = new Map();
   for (const [rootId, ids] of directByRoot) {
     const pk = perRoot.get(rootId)?.projectKey ?? '';
@@ -2882,8 +2856,7 @@ function buildProjects(parsed, finalNodes, directByRoot, perRoot) {
         version: p.version
       } : {}),
       subprojectDir: p.dir,
-      dependencies: [...(directByProject.get(p.projectKey) ?? [])].sort(),
-      resolvedAs: [...(idsByGav.get(gav(p.group, p.name, p.version)) ?? [])].sort()
+      dependencies: [...(directByProject.get(p.projectKey) ?? [])].sort()
     };
     return entry;
   });
@@ -2909,7 +2882,43 @@ function unionInto(map, key, add) {
     map.set(key, [...add]);
   }
 }
-function buildArtifactPaths(finalNodes, projects, fileExists) {
+function buildClasspathByProject(projects, perRoot) {
+  const idsByProjectKey = new Map();
+  for (const {
+    nodes,
+    projectKey
+  } of perRoot.values()) {
+    let set = idsByProjectKey.get(projectKey);
+    if (!set) {
+      set = new Set();
+      idsByProjectKey.set(projectKey, set);
+    }
+    for (const coordId of nodes.keys()) {
+      set.add(coordId);
+    }
+  }
+  const classpathByProject = new Map();
+  for (const p of projects) {
+    const key = projectClasspathKey({
+      name: p.name,
+      namespace: p.group,
+      subprojectDir: p.dir
+    });
+    let set = classpathByProject.get(key);
+    if (!set) {
+      set = new Set();
+      classpathByProject.set(key, set);
+    }
+    for (const id of idsByProjectKey.get(p.projectKey) ?? []) {
+      set.add(id);
+    }
+  }
+  return new Map([...classpathByProject].map(({
+    0: key,
+    1: ids
+  }) => [key, [...ids].sort()]));
+}
+function buildArtifactPaths(finalNodes, projects, perRoot, fileExists) {
   const projectsByGav = new Map();
   for (const p of projects) {
     projectsByGav.set(gav(p.group, p.name, p.version), {
@@ -2970,7 +2979,8 @@ function buildArtifactPaths(finalNodes, projects, fileExists) {
     targetsByCoord,
     targetsByGav,
     sourcesByCoord,
-    coords
+    coords,
+    classpathByProject: buildClasspathByProject(projects, perRoot)
   };
 }
 function buildReport(parsed) {
@@ -2999,32 +3009,6 @@ function buildReport(parsed) {
   };
 }
 
-// PATH fallback when no `bin` and no project wrapper.
-const DEFAULT_BUILD_TOOL_BIN = {
-  __proto__: null,
-  gradle: 'gradle',
-  maven: 'mvn',
-  sbt: 'sbt'
-};
-
-// Project-local wrapper, preferred because it pins the expected build-tool
-// version. sbt has no wrapper convention. POSIX names only (no win32 target).
-const BUILD_TOOL_WRAPPER = {
-  __proto__: null,
-  gradle: 'gradlew',
-  maven: 'mvnw'
-};
-function resolveBuildToolBin(tool, projectDir, bin) {
-  if (bin) {
-    return bin;
-  }
-  const wrapperName = BUILD_TOOL_WRAPPER[tool];
-  if (wrapperName && fs$1.existsSync(path.resolve(projectDir, wrapperName))) {
-    return `./${wrapperName}`;
-  }
-  return DEFAULT_BUILD_TOOL_BIN[tool];
-}
-
 // Single source of truth for --exclude-paths glob semantics against a JVM
 // build root's subproject dirs: anchored, relative, case-sensitive; `*`
 // within one path segment, `**` across zero or more segments, `?` within one
@@ -3592,6 +3576,11 @@ async function runManifestFacts({
     }
     resolvedJavaHome = expanded.value;
   }
+  if (ecosystem === 'sbt' && !looksLikeSbtBuild(cwd)) {
+    process.exitCode = 1;
+    logger.logger.fail(`No sbt build found at \`${cwd}\` (expected a build.sbt file or a project directory).`);
+    return null;
+  }
   logger.logger.info(`Generating Socket facts for the ${ecosystem} project at \`${cwd}\` ...`);
   const scriptOpts = {
     bin: bin || undefined,
@@ -3701,7 +3690,11 @@ async function runManifestFacts({
     logger.logger.warn(`No resolvable ${ecosystem} dependencies found; nothing to upload.`);
     return;
   }
-  await fs$1.promises.writeFile(factsPath, JSON.stringify(facts, null, 2), 'utf8');
+  const socketCliVersion = constants.default.ENV.INLINED_SOCKET_CLI_VERSION;
+  if (facts.metadata && socketCliVersion) {
+    facts.metadata.socketCliVersion = socketCliVersion;
+  }
+  await fs$1.promises.writeFile(factsPath, JSON.stringify(facts), 'utf8');
   if (withFiles && sidecarAcc) {
     // Key by the symlink-resolved path so the sidecar's keys are comparable
     // regardless of which caller's cwd it was joined against (the recursive
@@ -4009,6 +4002,16 @@ async function runDynamicSbomInference({
 // The point here is to attempt to detect the various supported manifest files
 // the CLI can generate. This would be environments that we can't do server side
 
+// Conda reads both spellings of the environment file.
+function findCondaFile(cwd) {
+  if (fs$1.existsSync(path.join(cwd, constants.ENVIRONMENT_YML))) {
+    return constants.ENVIRONMENT_YML;
+  }
+  if (fs$1.existsSync(path.join(cwd, constants.ENVIRONMENT_YAML))) {
+    return constants.ENVIRONMENT_YAML;
+  }
+  return '';
+}
 async function detectManifestActions(
 // Passing in null means we attempt detection for every supported language
 // regardless of local socket.json status. Sometimes we want that.
@@ -4019,6 +4022,7 @@ sockJson, cwd = process.cwd()) {
     // TODO
     count: 0,
     conda: false,
+    condaFile: '',
     gradle: false,
     maven: false,
     sbt: false
@@ -4056,13 +4060,11 @@ sockJson, cwd = process.cwd()) {
   if (sockJson?.defaults?.manifest?.conda?.disabled) {
     debug.debugLog('notice', `[DEBUG] - conda auto-detection is disabled in ${constants.SOCKET_JSON}`);
   } else {
-    const envyml = path.join(cwd, constants.ENVIRONMENT_YML);
-    const hasEnvyml = fs$1.existsSync(envyml);
-    const envyaml = path.join(cwd, constants.ENVIRONMENT_YAML);
-    const hasEnvyaml = !hasEnvyml && fs$1.existsSync(envyaml);
-    if (hasEnvyml || hasEnvyaml) {
-      debug.debugLog('notice', '[DEBUG] - Detected an environment.yml Conda file');
+    const condaFile = findCondaFile(cwd);
+    if (condaFile) {
+      debug.debugLog('notice', `[DEBUG] - Detected the Conda file ${condaFile}`);
       output.conda = true;
+      output.condaFile = condaFile;
       output.count += 1;
     }
   }
@@ -6905,7 +6907,10 @@ async function handleManifestConda({
   verbose
 }) {
   const data = await convertCondaToRequirements(filename, cwd, verbose);
-  await outputRequirements(data, outputKind, out);
+
+  // --auto-manifest only collects the generated file when it lands inside
+  // the dir being scanned.
+  await outputRequirements(data, outputKind, out === '-' ? out : path.resolve(cwd, out));
 }
 
 // Under --auto-manifest, a manifest generator that failed — raising the exit
@@ -7025,14 +7030,17 @@ async function generateAutoManifest({
     abortManifestRunIfFailed('maven', beforeExitCode);
   }
   if (!sockJson?.defaults?.manifest?.conda?.disabled && detected.conda) {
-    logger.logger.log('Detected an environment.yml file, running default Conda generator...');
+    const condaFile = sockJson.defaults?.manifest?.conda?.infile || detected.condaFile || constants.ENVIRONMENT_YML;
+    logger.logger.log(`Detected ${condaFile}, running default Conda generator...`);
+    const beforeExitCode = process.exitCode;
     await handleManifestConda({
       cwd,
-      filename: sockJson.defaults?.manifest?.conda?.infile ?? 'environment.yml',
+      filename: condaFile,
       outputKind,
       out: sockJson.defaults?.manifest?.conda?.outfile ?? constants.REQUIREMENTS_TXT,
       verbose: Boolean(sockJson.defaults?.manifest?.conda?.verbose)
     });
+    abortManifestRunIfFailed('conda', beforeExitCode);
   }
   if (!sockJson?.defaults?.manifest?.bazel?.disabled && detected.bazel) {
     const bazelConfig = sockJson?.defaults?.manifest?.bazel;
@@ -12427,7 +12435,7 @@ async function run$F(argv, importMeta, {
       filename = sockJson.defaults?.manifest?.conda?.infile;
       logger.logger.info(`Using default --file from ${constants.SOCKET_JSON}:`, filename);
     } else {
-      filename = constants.ENVIRONMENT_YML;
+      filename = findCondaFile(cwd) || constants.ENVIRONMENT_YML;
     }
   }
   if (stdout === undefined && sockJson.defaults?.manifest?.conda?.stdout !== undefined) {
@@ -24138,5 +24146,5 @@ process.on('unhandledRejection', async (reason, promise) => {
   // eslint-disable-next-line n/no-process-exit
   process.exit(1);
 });
-//# debugId=7293854f-1543-486e-ba22-c269ec717113
+//# debugId=d61b6b1f-4e7a-4403-b8f9-087745dd936f
 //# sourceMappingURL=cli.js.map