@socketsecurity/cli 1.1.36 → 1.1.38

package/dist/types/utils/cve-to-ghsa.d.mts

@@ -1,6 +1,7 @@
 import type { CResult } from '../types.mts';
 /**
  * Converts CVE IDs to GHSA IDs using GitHub API.
+ * CVE to GHSA mappings are permanent, so we cache for 30 days.
  */
 export declare function convertCveToGhsa(cveId: string): Promise<CResult<string>>;
 //# sourceMappingURL=cve-to-ghsa.d.mts.map

package/dist/types/utils/cve-to-ghsa.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"cve-to-ghsa.d.mts","sourceRoot":"","sources":["../../../src/utils/cve-to-ghsa.mts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAE3C;;GAEG;AACH,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CA6B1B"}
+{"version":3,"file":"cve-to-ghsa.d.mts","sourceRoot":"","sources":["../../../src/utils/cve-to-ghsa.mts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAE3C;;;GAGG;AACH,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CA8C1B"}

package/dist/types/utils/glob.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"glob.d.mts","sourceRoot":"","sources":["../../../src/utils/glob.mts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,2BAA2B,CAAA;AACtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAA;AACvD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAA;AACjE,OAAO,KAAK,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAA;AA4IvD,wBAAgB,0BAA0B,CACxC,SAAS,EAAE,MAAM,EAAE,GAAG,SAAS,MAAM,EAAE,EACvC,cAAc,EAAE,sBAAsB,CAAC,yBAAyB,CAAC,CAAC,MAAM,CAAC,GACxE,MAAM,EAAE,CAGV;AAED,wBAAgB,wBAAwB,CACtC,cAAc,EAAE,sBAAsB,CAAC,yBAAyB,CAAC,CAAC,MAAM,CAAC,GACxE,MAAM,EAAE,CASV;AAED,KAAK,wBAAwB,GAAG,WAAW,GAAG;IAC5C,YAAY,CAAC,EAAE,SAAS,GAAG,SAAS,CAAA;CACrC,CAAA;AAED,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,MAAM,EAAE,GAAG,SAAS,MAAM,EAAE,EACtC,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,MAAM,EAAE,CAAC,CA+EnB;AAED,wBAAsB,aAAa,CACjC,KAAK,EAAE,KAAK,EACZ,GAAG,SAAgB,GAClB,OAAO,CAAC,MAAM,EAAE,CAAC,CASnB;AAED,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,MAAM,EAChB,cAAc,EAAE,sBAAsB,CAAC,yBAAyB,CAAC,CAAC,MAAM,CAAC,WAI1E;AAED,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,MAAM,EAAE,GAAG,SAAS,MAAM,EAAE,EACnC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,GACvB,MAAM,EAAE,CAcV"}
+{"version":3,"file":"glob.d.mts","sourceRoot":"","sources":["../../../src/utils/glob.mts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,2BAA2B,CAAA;AACtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAA;AACvD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAA;AACjE,OAAO,KAAK,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAA;AA4IvD,wBAAgB,0BAA0B,CACxC,SAAS,EAAE,MAAM,EAAE,GAAG,SAAS,MAAM,EAAE,EACvC,cAAc,EAAE,sBAAsB,CAAC,yBAAyB,CAAC,CAAC,MAAM,CAAC,GACxE,MAAM,EAAE,CAGV;AAED,wBAAgB,wBAAwB,CACtC,cAAc,EAAE,sBAAsB,CAAC,yBAAyB,CAAC,CAAC,MAAM,CAAC,GACxE,MAAM,EAAE,CASV;AAED,KAAK,wBAAwB,GAAG,WAAW,GAAG;IAC5C,YAAY,CAAC,EAAE,SAAS,GAAG,SAAS,CAAA;CACrC,CAAA;AAED,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,MAAM,EAAE,GAAG,SAAS,MAAM,EAAE,EACtC,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,MAAM,EAAE,CAAC,CA+EnB;AAED,wBAAsB,aAAa,CACjC,KAAK,EAAE,KAAK,EACZ,GAAG,SAAgB,GAClB,OAAO,CAAC,MAAM,EAAE,CAAC,CASnB;AAED,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,MAAM,EAChB,cAAc,EAAE,sBAAsB,CAAC,yBAAyB,CAAC,CAAC,MAAM,CAAC,WAI1E;AAED,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,MAAM,EAAE,GAAG,SAAS,MAAM,EAAE,EACnC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,GACvB,MAAM,EAAE,CAgBV"}

package/dist/types/utils/path-resolve.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"path-resolve.d.mts","sourceRoot":"","sources":["../../../src/utils/path-resolve.mts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAA;AACvD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAA;AAEjE,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG;IACvD,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,GAAG,SAAS,CAAA;IACxB,QAAQ,EAAE,OAAO,CAAA;CAClB,CA2BA;AAED,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CA+CzE;AAED,MAAM,MAAM,0BAA0B,GAAG;IACvC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACxB,MAAM,CAAC,EAAE,SAAS,GAAG,SAAS,CAAA;CAC/B,CAAA;AAED,wBAAsB,sBAAsB,CAC1C,UAAU,EAAE,MAAM,EAAE,EACpB,cAAc,EAAE,sBAAsB,CAAC,yBAAyB,CAAC,CAAC,MAAM,CAAC,EACzE,OAAO,CAAC,EAAE,0BAA0B,GAAG,SAAS,GAC/C,OAAO,CAAC,MAAM,EAAE,CAAC,CAYnB"}
+{"version":3,"file":"path-resolve.d.mts","sourceRoot":"","sources":["../../../src/utils/path-resolve.mts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAA;AACvD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAA;AAEjE,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG;IACvD,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,GAAG,SAAS,CAAA;IACxB,QAAQ,EAAE,OAAO,CAAA;CAClB,CA2BA;AAED,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CA+CzE;AAED,MAAM,MAAM,0BAA0B,GAAG;IACvC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACxB,MAAM,CAAC,EAAE,SAAS,GAAG,SAAS,CAAA;CAC/B,CAAA;AAED,wBAAsB,sBAAsB,CAC1C,UAAU,EAAE,MAAM,EAAE,EACpB,cAAc,EAAE,sBAAsB,CAAC,yBAAyB,CAAC,CAAC,MAAM,CAAC,EACzE,OAAO,CAAC,EAAE,0BAA0B,GAAG,SAAS,GAC/C,OAAO,CAAC,MAAM,EAAE,CAAC,CAenB"}

package/dist/utils.js

@@ -4220,15 +4220,17 @@ function isPnpmLockfileScanCommand(command) {
 
 /**
  * Converts CVE IDs to GHSA IDs using GitHub API.
+ * CVE to GHSA mappings are permanent, so we cache for 30 days.
  */
 async function convertCveToGhsa(cveId) {
   try {
     const cacheKey = `cve-to-ghsa-${cveId}`;
     const octokit = getOctokit();
+    const THIRTY_DAYS_MS = 30 * 24 * 60 * 60 * 1000;
     const response = await cacheFetch(cacheKey, () => octokit.rest.securityAdvisories.listGlobalAdvisories({
       cve_id: cveId,
       per_page: 1
-    }));
+    }), THIRTY_DAYS_MS);
     if (!response.data.length) {
       return {
         ok: false,
@@ -4240,9 +4242,13 @@ async function convertCveToGhsa(cveId) {
       data: response.data[0].ghsa_id
     };
   } catch (e) {
+    const errorCause = getErrorCause(e);
+    const errorLower = errorCause.toLowerCase();
+    // Detect GitHub API rate limit and network errors.
+    const isRateLimitOrNetworkError = errorLower.includes('rate limit') || errorLower.includes('epipe') || errorLower.includes('econnreset') || errorLower.includes('status: 403') || errorLower.includes('status code 403');
     return {
       ok: false,
-      message: `Failed to convert CVE to GHSA: ${getErrorCause(e)}`
+      message: isRateLimitOrNetworkError ? 'GitHub API rate limit exceeded while converting CVE to GHSA. Wait an hour or set SOCKET_CLI_GITHUB_TOKEN environment variable with a personal access token for higher limits.' : `Failed to convert CVE to GHSA: ${errorCause}`
     };
   }
 }
@@ -6215,5 +6221,5 @@ exports.updateConfigValue = updateConfigValue;
 exports.walkNestedMap = walkNestedMap;
 exports.webLink = webLink;
 exports.writeSocketJson = writeSocketJson;
-//# debugId=f7f6f837-e9a9-4b4e-a7ab-36f286008941
+//# debugId=652cf0d7-6cf6-49b1-86ba-204b62a4be68
 //# sourceMappingURL=utils.js.map