@socketsecurity/cli 1.1.30 → 1.1.32

package/CHANGELOG.md

@@ -4,6 +4,21 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## [1.1.32](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.32) - 2025-11-20
+
+### Changed
+- Updated @coana-tech/cli to 14.12.90
+- Updated @cyclonedx/cdxgen to 11.11.0
+
+### Fixed
+- Resolved `--limit` flag behavior to correctly restrict vulnerability processing in `socket fix` local mode
+- Exclude `.socket.facts.json` files from `socket fix` manifest uploads
+
+## [1.1.31](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.31) - 2025-11-19
+
+### Fixed
+- Enhanced pull request descriptions to remove duplicate package listings for cleaner, more readable output
+
 ## [1.1.30](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.30) - 2025-11-18
 
 ### Changed

package/dist/cli.js

@@ -3327,6 +3327,13 @@ async function cleanupErrorBranches(branch, cwd, remoteBranchExists) {
 }
 
 const GITHUB_ADVISORIES_URL = 'https://github.com/advisories';
+
+/**
+ * Extract unique package names with ecosystems from vulnerability details.
+ */
+function getUniquePackages(details) {
+  return [...new Set(details.vulnerabilities.nodes.map(v => `${v.package.name} (${v.package.ecosystem})`))];
+}
 function getSocketFixBranchName(ghsaId) {
   return `socket/fix/${ghsaId}`;
 }
@@ -3346,14 +3353,14 @@ function getSocketFixPullRequestBody(ghsaIds, ghsaDetails) {
     if (!details) {
       return body;
     }
-    const packages = details.vulnerabilities.nodes.map(v => `${v.package.name} (${v.package.ecosystem})`);
+    const packages = getUniquePackages(details);
     return [body, '', '', `**Vulnerability Summary:** ${details.summary}`, '', `**Severity:** ${details.severity}`, '', `**Affected Packages:** ${arrays.joinAnd(packages)}`].join('\n');
   }
   return [`[Socket](${constants.default.SOCKET_WEBSITE_URL}) fixes for ${vulnCount} GHSAs.`, '', '**Fixed Vulnerabilities:**', ...ghsaIds.map(id => {
     const details = ghsaDetails?.get(id);
     const item = `- [${id}](${GITHUB_ADVISORIES_URL}/${id})`;
     if (details) {
-      const packages = details.vulnerabilities.nodes.map(v => `${v.package.name}`);
+      const packages = getUniquePackages(details);
       return `${item} - ${details.summary} (${arrays.joinAnd(packages)})`;
     }
     return item;
@@ -3666,6 +3673,29 @@ async function getFixEnv() {
   };
 }
 
+/**
+ * Discovers GHSA IDs by running coana without applying fixes.
+ * Returns a list of GHSA IDs, optionally limited.
+ */
+async function discoverGhsaIds(orgSlug, tarHash, fixConfig, options) {
+  const {
+    cwd = process.cwd(),
+    limit,
+    spinner
+  } = {
+    __proto__: null,
+    ...options
+  };
+  const foundCResult = await utils.spawnCoanaDlx(['compute-fixes-and-upgrade-purls', cwd, '--manifests-tar-hash', tarHash, ...(fixConfig.rangeStyle ? ['--range-style', fixConfig.rangeStyle] : []), ...(fixConfig.minimumReleaseAge ? ['--minimum-release-age', fixConfig.minimumReleaseAge] : []), ...(fixConfig.include.length ? ['--include', ...fixConfig.include] : []), ...(fixConfig.exclude.length ? ['--exclude', ...fixConfig.exclude] : []), ...(fixConfig.disableMajorUpdates ? ['--disable-major-updates'] : []), ...(fixConfig.showAffectedDirectDependencies ? ['--show-affected-direct-dependencies'] : []), ...fixConfig.unknownFlags], orgSlug, {
+    cwd,
+    spinner
+  });
+  if (foundCResult.ok) {
+    const foundIds = utils.cmdFlagValueToArray(/(?<=Vulnerabilities found:).*/.exec(foundCResult.data));
+    return limit !== undefined ? foundIds.slice(0, limit) : foundIds;
+  }
+  return [];
+}
 async function coanaFix(fixConfig) {
   const {
     applyFixes,
@@ -3702,7 +3732,10 @@ async function coanaFix(fixConfig) {
   const scanFilepaths = await utils.getPackageFilesForScan(['.'], supportedFiles, {
     cwd
   });
-  const uploadCResult = await utils.handleApiCall(sockSdk.uploadManifestFiles(orgSlug, scanFilepaths), {
+  // Exclude any .socket.facts.json files that happen to be in the scan
+  // folder before the analysis was run.
+  const filepathsToUpload = scanFilepaths.filter(p => path.basename(p).toLowerCase() !== constants.DOT_SOCKET_DOT_FACTS_JSON);
+  const uploadCResult = await utils.handleApiCall(sockSdk.uploadManifestFiles(orgSlug, filepathsToUpload), {
     description: 'upload manifests',
     spinner
   });
@@ -3734,8 +3767,19 @@ async function coanaFix(fixConfig) {
         logger.logger.info('Running in local mode - fixes will be applied directly to your working directory.\n' + getCiEnvInstructions());
       }
     }
-    const ids = isAll ? ['all'] : ghsas.slice(0, limit);
-    if (!ids.length) {
+    let ids;
+    if (isAll && limit > 0) {
+      ids = await discoverGhsaIds(orgSlug, tarHash, fixConfig, {
+        cwd,
+        limit,
+        spinner
+      });
+    } else if (limit > 0) {
+      ids = ghsas.slice(0, limit);
+    } else {
+      ids = [];
+    }
+    if (limit < 1 || ids.length === 0) {
       spinner?.stop();
       return {
         ok: true,
@@ -3749,7 +3793,7 @@ async function coanaFix(fixConfig) {
     const tmpDir = os.tmpdir();
     const tmpFile = path.join(tmpDir, `socket-fix-${Date.now()}.json`);
     try {
-      const fixCResult = await utils.spawnCoanaDlx(['compute-fixes-and-upgrade-purls', cwd, '--manifests-tar-hash', tarHash, '--apply-fixes-to', ...(isAll ? ['all'] : ghsas), ...(fixConfig.rangeStyle ? ['--range-style', fixConfig.rangeStyle] : []), ...(minimumReleaseAge ? ['--minimum-release-age', minimumReleaseAge] : []), ...(include.length ? ['--include', ...include] : []), ...(exclude.length ? ['--exclude', ...exclude] : []), ...(!applyFixes ? [constants.FLAG_DRY_RUN] : []), '--output-file', tmpFile, ...(disableMajorUpdates ? ['--disable-major-updates'] : []), ...(showAffectedDirectDependencies ? ['--show-affected-direct-dependencies'] : []), ...fixConfig.unknownFlags], fixConfig.orgSlug, {
+      const fixCResult = await utils.spawnCoanaDlx(['compute-fixes-and-upgrade-purls', cwd, '--manifests-tar-hash', tarHash, '--apply-fixes-to', ...ids, ...(fixConfig.rangeStyle ? ['--range-style', fixConfig.rangeStyle] : []), ...(minimumReleaseAge ? ['--minimum-release-age', minimumReleaseAge] : []), ...(include.length ? ['--include', ...include] : []), ...(exclude.length ? ['--exclude', ...exclude] : []), ...(!applyFixes ? [constants.FLAG_DRY_RUN] : []), '--output-file', tmpFile, ...(disableMajorUpdates ? ['--disable-major-updates'] : []), ...(showAffectedDirectDependencies ? ['--show-affected-direct-dependencies'] : []), ...fixConfig.unknownFlags], fixConfig.orgSlug, {
         cwd,
         spinner,
         stdio: 'inherit'
@@ -3781,7 +3825,7 @@ async function coanaFix(fixConfig) {
       // Clean up the temporary file.
       try {
         await fs$1.promises.unlink(tmpFile);
-      } catch (e) {
+      } catch {
         // Ignore cleanup errors.
       }
     }
@@ -3808,14 +3852,11 @@ async function coanaFix(fixConfig) {
   const shouldSpawnCoana = adjustedLimit > 0;
   let ids;
   if (shouldSpawnCoana && isAll) {
-    const foundCResult = await utils.spawnCoanaDlx(['compute-fixes-and-upgrade-purls', cwd, '--manifests-tar-hash', tarHash, ...(fixConfig.rangeStyle ? ['--range-style', fixConfig.rangeStyle] : []), ...(minimumReleaseAge ? ['--minimum-release-age', minimumReleaseAge] : []), ...(include.length ? ['--include', ...include] : []), ...(exclude.length ? ['--exclude', ...exclude] : []), ...(disableMajorUpdates ? ['--disable-major-updates'] : []), ...(showAffectedDirectDependencies ? ['--show-affected-direct-dependencies'] : []), ...fixConfig.unknownFlags], fixConfig.orgSlug, {
+    ids = await discoverGhsaIds(orgSlug, tarHash, fixConfig, {
       cwd,
+      limit: adjustedLimit,
       spinner
     });
-    if (foundCResult.ok) {
-      const foundIds = utils.cmdFlagValueToArray(/(?<=Vulnerabilities found:).*/.exec(foundCResult.data));
-      ids = foundIds.slice(0, adjustedLimit);
-    }
   } else if (shouldSpawnCoana) {
     ids = ghsas.slice(0, adjustedLimit);
   }
@@ -15270,5 +15311,5 @@ void (async () => {
     await utils.captureException(e);
   }
 })();
-//# debugId=dbcc0fa8-7ea6-462d-9ebe-824e2129f7b8
+//# debugId=24f79e28-d381-4303-8ec8-8eade398a936
 //# sourceMappingURL=cli.js.map