@socketsecurity/cli 1.1.31 → 1.1.32

package/CHANGELOG.md

@@ -4,6 +4,16 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## [1.1.32](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.32) - 2025-11-20
+
+### Changed
+- Updated @coana-tech/cli to 14.12.90
+- Updated @cyclonedx/cdxgen to 11.11.0
+
+### Fixed
+- Resolved `--limit` flag behavior to correctly restrict vulnerability processing in `socket fix` local mode
+- Exclude `.socket.facts.json` files from `socket fix` manifest uploads
+
 ## [1.1.31](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.31) - 2025-11-19
 
 ### Fixed

package/dist/cli.js

@@ -3673,6 +3673,29 @@ async function getFixEnv() {
   };
 }
 
+/**
+ * Discovers GHSA IDs by running coana without applying fixes.
+ * Returns a list of GHSA IDs, optionally limited.
+ */
+async function discoverGhsaIds(orgSlug, tarHash, fixConfig, options) {
+  const {
+    cwd = process.cwd(),
+    limit,
+    spinner
+  } = {
+    __proto__: null,
+    ...options
+  };
+  const foundCResult = await utils.spawnCoanaDlx(['compute-fixes-and-upgrade-purls', cwd, '--manifests-tar-hash', tarHash, ...(fixConfig.rangeStyle ? ['--range-style', fixConfig.rangeStyle] : []), ...(fixConfig.minimumReleaseAge ? ['--minimum-release-age', fixConfig.minimumReleaseAge] : []), ...(fixConfig.include.length ? ['--include', ...fixConfig.include] : []), ...(fixConfig.exclude.length ? ['--exclude', ...fixConfig.exclude] : []), ...(fixConfig.disableMajorUpdates ? ['--disable-major-updates'] : []), ...(fixConfig.showAffectedDirectDependencies ? ['--show-affected-direct-dependencies'] : []), ...fixConfig.unknownFlags], orgSlug, {
+    cwd,
+    spinner
+  });
+  if (foundCResult.ok) {
+    const foundIds = utils.cmdFlagValueToArray(/(?<=Vulnerabilities found:).*/.exec(foundCResult.data));
+    return limit !== undefined ? foundIds.slice(0, limit) : foundIds;
+  }
+  return [];
+}
 async function coanaFix(fixConfig) {
   const {
     applyFixes,
@@ -3709,7 +3732,10 @@ async function coanaFix(fixConfig) {
   const scanFilepaths = await utils.getPackageFilesForScan(['.'], supportedFiles, {
     cwd
   });
-  const uploadCResult = await utils.handleApiCall(sockSdk.uploadManifestFiles(orgSlug, scanFilepaths), {
+  // Exclude any .socket.facts.json files that happen to be in the scan
+  // folder before the analysis was run.
+  const filepathsToUpload = scanFilepaths.filter(p => path.basename(p).toLowerCase() !== constants.DOT_SOCKET_DOT_FACTS_JSON);
+  const uploadCResult = await utils.handleApiCall(sockSdk.uploadManifestFiles(orgSlug, filepathsToUpload), {
     description: 'upload manifests',
     spinner
   });
@@ -3741,8 +3767,19 @@ async function coanaFix(fixConfig) {
         logger.logger.info('Running in local mode - fixes will be applied directly to your working directory.\n' + getCiEnvInstructions());
       }
     }
-    const ids = isAll ? ['all'] : ghsas.slice(0, limit);
-    if (!ids.length) {
+    let ids;
+    if (isAll && limit > 0) {
+      ids = await discoverGhsaIds(orgSlug, tarHash, fixConfig, {
+        cwd,
+        limit,
+        spinner
+      });
+    } else if (limit > 0) {
+      ids = ghsas.slice(0, limit);
+    } else {
+      ids = [];
+    }
+    if (limit < 1 || ids.length === 0) {
       spinner?.stop();
       return {
         ok: true,
@@ -3756,7 +3793,7 @@ async function coanaFix(fixConfig) {
     const tmpDir = os.tmpdir();
     const tmpFile = path.join(tmpDir, `socket-fix-${Date.now()}.json`);
     try {
-      const fixCResult = await utils.spawnCoanaDlx(['compute-fixes-and-upgrade-purls', cwd, '--manifests-tar-hash', tarHash, '--apply-fixes-to', ...(isAll ? ['all'] : ghsas), ...(fixConfig.rangeStyle ? ['--range-style', fixConfig.rangeStyle] : []), ...(minimumReleaseAge ? ['--minimum-release-age', minimumReleaseAge] : []), ...(include.length ? ['--include', ...include] : []), ...(exclude.length ? ['--exclude', ...exclude] : []), ...(!applyFixes ? [constants.FLAG_DRY_RUN] : []), '--output-file', tmpFile, ...(disableMajorUpdates ? ['--disable-major-updates'] : []), ...(showAffectedDirectDependencies ? ['--show-affected-direct-dependencies'] : []), ...fixConfig.unknownFlags], fixConfig.orgSlug, {
+      const fixCResult = await utils.spawnCoanaDlx(['compute-fixes-and-upgrade-purls', cwd, '--manifests-tar-hash', tarHash, '--apply-fixes-to', ...ids, ...(fixConfig.rangeStyle ? ['--range-style', fixConfig.rangeStyle] : []), ...(minimumReleaseAge ? ['--minimum-release-age', minimumReleaseAge] : []), ...(include.length ? ['--include', ...include] : []), ...(exclude.length ? ['--exclude', ...exclude] : []), ...(!applyFixes ? [constants.FLAG_DRY_RUN] : []), '--output-file', tmpFile, ...(disableMajorUpdates ? ['--disable-major-updates'] : []), ...(showAffectedDirectDependencies ? ['--show-affected-direct-dependencies'] : []), ...fixConfig.unknownFlags], fixConfig.orgSlug, {
         cwd,
         spinner,
         stdio: 'inherit'
@@ -3788,7 +3825,7 @@ async function coanaFix(fixConfig) {
       // Clean up the temporary file.
       try {
         await fs$1.promises.unlink(tmpFile);
-      } catch (e) {
+      } catch {
         // Ignore cleanup errors.
       }
     }
@@ -3815,14 +3852,11 @@ async function coanaFix(fixConfig) {
   const shouldSpawnCoana = adjustedLimit > 0;
   let ids;
   if (shouldSpawnCoana && isAll) {
-    const foundCResult = await utils.spawnCoanaDlx(['compute-fixes-and-upgrade-purls', cwd, '--manifests-tar-hash', tarHash, ...(fixConfig.rangeStyle ? ['--range-style', fixConfig.rangeStyle] : []), ...(minimumReleaseAge ? ['--minimum-release-age', minimumReleaseAge] : []), ...(include.length ? ['--include', ...include] : []), ...(exclude.length ? ['--exclude', ...exclude] : []), ...(disableMajorUpdates ? ['--disable-major-updates'] : []), ...(showAffectedDirectDependencies ? ['--show-affected-direct-dependencies'] : []), ...fixConfig.unknownFlags], fixConfig.orgSlug, {
+    ids = await discoverGhsaIds(orgSlug, tarHash, fixConfig, {
       cwd,
+      limit: adjustedLimit,
       spinner
     });
-    if (foundCResult.ok) {
-      const foundIds = utils.cmdFlagValueToArray(/(?<=Vulnerabilities found:).*/.exec(foundCResult.data));
-      ids = foundIds.slice(0, adjustedLimit);
-    }
   } else if (shouldSpawnCoana) {
     ids = ghsas.slice(0, adjustedLimit);
   }
@@ -15277,5 +15311,5 @@ void (async () => {
     await utils.captureException(e);
   }
 })();
-//# debugId=4f8753fd-5919-4ea2-a850-0b907ec7bd09
+//# debugId=24f79e28-d381-4303-8ec8-8eade398a936
 //# sourceMappingURL=cli.js.map