@socketsecurity/cli 1.2.1 → 1.4.0

package/CHANGELOG.md

@@ -4,6 +4,17 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## [1.4.0](https://github.com/SocketDev/socket-cli/releases/tag/v1.4.0) - 2026-09-29
+
+### Changed
+- Updated the Coana CLI to v `15.11.4`.
+
+## [1.3.0](https://github.com/SocketDev/socket-cli/releases/tag/v1.3.0) - 2026-09-29
+
+### Added
+
+- `socket scan create --uv-members <dir...>` scans selected uv workspace members with the versions and dependency relationships pinned in their shared `uv.lock`, leaving unrelated members out of the scan. Dependencies used only by dependency groups are marked as development dependencies. Requires uv with CycloneDX export support.
+
 ## [1.2.1](https://github.com/SocketDev/socket-cli/releases/tag/v1.2.1) - 2026-09-28
 
 ### Changed

package/README.md

@@ -1,8 +1,8 @@
 # Socket CLI
 
 [![Socket Badge](https://socket.dev/api/badge/npm/package/socket)](https://socket.dev/npm/package/socket)
-[![Follow @SocketSecurity](https://raw.githubusercontent.com/SocketDev/socket-cli/v1.2.1/assets/fleet/badge-follow-x.svg)](https://twitter.com/SocketSecurity)
-[![Follow @socket.dev on Bluesky](https://raw.githubusercontent.com/SocketDev/socket-cli/v1.2.1/assets/fleet/badge-follow-bluesky.svg)](https://bsky.app/profile/socket.dev)
+[![Follow @SocketSecurity](https://raw.githubusercontent.com/SocketDev/socket-cli/v1.4.0/assets/fleet/badge-follow-x.svg)](https://twitter.com/SocketSecurity)
+[![Follow @socket.dev on Bluesky](https://raw.githubusercontent.com/SocketDev/socket-cli/v1.4.0/assets/fleet/badge-follow-bluesky.svg)](https://bsky.app/profile/socket.dev)
 
 CLI for [Socket.dev](https://socket.dev) — scan dependencies, audit packages, apply security patches, and gate installs from your terminal or CI. This is the 1.x line of the published `socket` package on npm.
 
@@ -63,6 +63,39 @@ All aliases support the flags and arguments of the commands they alias.
 
 - `socket ci` - Alias for `socket scan create --report` (creates report and exits with error if unhealthy)
 
+### Scanning uv workspace members
+
+Use `--uv-members` to scan selected directories of a uv workspace with the
+versions pinned in the workspace's shared `uv.lock`:
+
+```sh
+socket scan create --uv-members ./packages/api ./packages/worker
+```
+
+Each TARGET is a directory with its own `pyproject.toml`. uv finds the
+`uv.lock` in that directory or in its workspace root, so one scan can cover
+members of several workspaces. The scan includes each target's transitive and
+local workspace dependencies, all extras, and all dependency groups.
+Dependencies used only by dependency groups are marked as development
+dependencies. Unrelated members and the shared lockfile are not added to the
+scan.
+
+This mode requires uv on PATH with support for `uv export --format cyclonedx1.5`,
+which uv currently treats as a preview feature. The export runs offline with
+`--frozen`, so it uses the existing lockfile without resolving newer versions,
+installing packages, or changing the project.
+
+The CLI writes a `socket-uv-cdx.json` SBOM into each target directory, uploads
+only those SBOMs in place of regular manifest discovery, and removes them after
+the scan, including on failure, Ctrl-C, or SIGTERM. It stops if that file
+already exists.
+`--read-only` prepares the SBOMs without uploading them, and `--dry-run`
+validates the options without running uv.
+
+With `--reach`, pass a single target. Reachability analysis then runs on that
+member's directory. `--uv-members` cannot be combined with `--auto-manifest` or
+`--dynamic-sbom-inference`.
+
 ### Reachability analysis
 
 Socket reachability analysis comes in three forms:
@@ -138,8 +171,8 @@ MIT
 <br/>
 <div align="center">
   <picture>
-    <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.2.1/assets/fleet/socket-combomark-dark.svg">
-    <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.2.1/assets/fleet/socket-combomark-light.svg">
-    <img width="324" height="104" alt="Socket" src="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.2.1/assets/fleet/socket-combomark-light.svg">
+    <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.4.0/assets/fleet/socket-combomark-dark.svg">
+    <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.4.0/assets/fleet/socket-combomark-light.svg">
+    <img width="324" height="104" alt="Socket" src="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.4.0/assets/fleet/socket-combomark-light.svg">
   </picture>
 </div>

package/dist/cli.js

@@ -2693,7 +2693,11 @@ function assembleFacts(parsed, opts = {}) {
     finalNodes
   } = mergeByCoordinate(perRoot);
   const tool = parsed.tool || 'gradle';
-  const components = buildComponents(finalNodes);
+  const projectsByGav = new Map();
+  for (const p of parsed.projects.values()) {
+    projectsByGav.set(gav(p.group, p.name, p.version), p);
+  }
+  const components = buildComponents(finalNodes, projectsByGav);
   const projects = opts.emitProjects === false ? [] : buildProjects(parsed, directByRoot, perRoot);
   const metadata = {
     format: 'socket-facts-sbom',
@@ -2714,7 +2718,7 @@ function assembleFacts(parsed, opts = {}) {
   return {
     facts,
     report: buildReport(parsed),
-    artifactPaths: buildArtifactPaths(finalNodes, [...parsed.projects.values()], perRoot, fileExists)
+    artifactPaths: buildArtifactPaths(finalNodes, [...parsed.projects.values()], projectsByGav, perRoot, fileExists)
   };
 }
 function gav(group, name, version) {
@@ -2802,7 +2806,7 @@ function mergeByCoordinate(perRoot) {
     directByRoot
   };
 }
-function buildComponents(finalNodes) {
+function buildComponents(finalNodes, projectsByGav) {
   return [...finalNodes.keys()].sort().map(id => {
     const fn = finalNodes.get(id);
     const c = fn.coord;
@@ -2833,6 +2837,9 @@ function buildComponents(finalNodes) {
     if (!fn.prod) {
       comp.dev = true;
     }
+    if (projectsByGav.has(gav(c.group, c.name, c.version ?? ''))) {
+      comp.firstParty = true;
+    }
     if (fn.children.size) {
       comp.dependencies = [...fn.children].sort();
     }
@@ -2923,14 +2930,7 @@ function buildClasspathByProject(projects, perRoot) {
     1: ids
   }) => [key, [...ids].sort()]));
 }
-function buildArtifactPaths(finalNodes, projects, perRoot, fileExists) {
-  const projectsByGav = new Map();
-  for (const p of projects) {
-    projectsByGav.set(gav(p.group, p.name, p.version), {
-      sources: p.sources,
-      targets: p.targets
-    });
-  }
+function buildArtifactPaths(finalNodes, projects, projectsByGav, perRoot, fileExists) {
   const targetsByCoord = new Map();
   const targetsByGav = new Map();
   const sourcesByCoord = new Map();
@@ -7116,7 +7116,7 @@ function filterToPregeneratedSboms(filepaths, supportedFiles) {
     nocase: true
   }));
 }
-async function handleCreateNewScan({
+async function createNewScan({
   autoManifest,
   branchName,
   commitHash,
@@ -7137,7 +7137,7 @@ async function handleCreateNewScan({
   targets,
   tmp,
   workspace
-}) {
+}, scanFiles) {
   let scanTargets = targets;
   debug.debugFn('notice', `Creating new scan for ${orgSlug}/${workspace ? `${workspace}/` : ''}${repoName}`);
   debug.debugDir('inspect', {
@@ -7251,11 +7251,11 @@ async function handleCreateNewScan({
       reachabilityOptions: reach,
       target: targets[0]
     });
-    const packagePaths = await utils.getPackageFilesForScan(scanTargets, supportedFiles, {
+    const packagePaths = scanFiles ?? (await utils.getPackageFilesForScan(scanTargets, supportedFiles, {
       additionalIgnores: additionalScaIgnores,
       config: socketConfig,
       cwd
-    });
+    }));
     spinner.successAndStop(`Found ${packagePaths.length} ${words.pluralize('file', packagePaths.length)} to include in scan.`);
     const wasValidInput = utils.checkCommandInput(outputKind, {
       nook: true,
@@ -7436,6 +7436,14 @@ async function handleCreateNewScan({
     }
   });
 }
+async function handleCreateNewScan(config) {
+  const generated = await config.generateScanFiles?.();
+  try {
+    await createNewScan(config, generated?.files);
+  } finally {
+    await generated?.cleanup();
+  }
+}
 
 /**
  * Derive the pull request number from the CI environment. GitHub Actions
@@ -19575,6 +19583,115 @@ const cmdRepository = {
   }
 };
 
+const CLEANUP_SIGNALS = ['SIGHUP', 'SIGINT', 'SIGTERM'];
+const UV_SBOM_FILENAME = 'socket-uv-cdx.json';
+function componentIdentity(component) {
+  return JSON.stringify([component.name, component.version, component.purl]);
+}
+async function exportMemberSbom(memberDir) {
+  const sbom = await exportSbom(memberDir, '--all-groups');
+  const productionSbom = await exportSbom(memberDir, '--no-default-groups');
+  // uv can renumber bom-ref values between exports.
+  const productionPackages = new Set(productionSbom.components?.map(componentIdentity));
+  for (const component of sbom.components ?? []) {
+    component.scope = productionPackages.has(componentIdentity(component)) ? 'required' : 'optional';
+  }
+  return sbom;
+}
+async function exportSbom(memberDir, groups) {
+  let content;
+  try {
+    const {
+      stdout
+    } = await spawn.spawn('uv', ['export', '--project', memberDir, '--format', 'cyclonedx1.5', '--frozen', '--offline', '--no-python-downloads', '--all-extras', groups], {
+      cwd: memberDir,
+      signal: constants.default.abortSignal,
+      stdio: 'pipe'
+    });
+    content = stdout;
+  } catch (e) {
+    throw new utils.InputError(`Could not export the uv dependency graph for ${memberDir}. Install uv on PATH with CycloneDX export support and check that the directory is a uv project with a uv.lock in it or in its workspace root.`, e && typeof e === 'object' && 'stderr' in e ? String(e.stderr).trim() || utils.getErrorMessage(e) : utils.getErrorMessage(e));
+  }
+  return parseSbom(content, memberDir);
+}
+function parseSbom(content, memberDir) {
+  try {
+    const sbom = JSON.parse(content);
+    if (sbom?.bomFormat === 'CycloneDX' && Array.isArray(sbom.dependencies) && (sbom.components === undefined || Array.isArray(sbom.components)) && typeof sbom.metadata?.component?.name === 'string') {
+      return sbom;
+    }
+  } catch {}
+  throw new utils.InputError(`uv did not return a CycloneDX dependency graph for ${memberDir}. Update uv and try again.`);
+}
+async function generateUvMemberSboms(memberDirs) {
+  const sboms = [];
+  for (const memberDir of memberDirs) {
+    logger.logger.info(`Exporting the uv dependency graph for ${memberDir}...`);
+    // eslint-disable-next-line no-await-in-loop
+    sboms.push(await exportMemberSbom(memberDir));
+  }
+  const files = [];
+  const removeFilesSync = () => {
+    for (const file of files) {
+      fs$1.rmSync(file, {
+        force: true
+      });
+    }
+  };
+  // A signalled or exiting scan skips finally blocks, and the bin launcher
+  // SIGKILLs a signalled scan after a short grace period.
+  process.once('exit', removeFilesSync);
+  for (const signal of CLEANUP_SIGNALS) {
+    process.once(signal, removeFilesSync);
+  }
+  const cleanup = async () => {
+    process.removeListener('exit', removeFilesSync);
+    for (const signal of CLEANUP_SIGNALS) {
+      process.removeListener(signal, removeFilesSync);
+    }
+    await Promise.all(files.map(file => fs$1.promises.rm(file, {
+      force: true
+    })));
+  };
+  try {
+    for (let i = 0; i < memberDirs.length; i += 1) {
+      // The SBOM sits where the member's own manifest would, so upload paths
+      // and the reachability target line up with the member directory.
+      const filename = path.join(memberDirs[i], UV_SBOM_FILENAME);
+      // eslint-disable-next-line no-await-in-loop
+      await fs$1.promises.writeFile(filename, JSON.stringify(sboms[i]), {
+        flag: 'wx'
+      });
+      files.push(filename);
+    }
+  } catch (e) {
+    await cleanup();
+    throw e;
+  }
+  return {
+    cleanup,
+    files
+  };
+}
+function resolveUvMemberDirs(targets, cwd) {
+  const memberDirs = new Set();
+  for (const target of targets) {
+    const memberDir = path.resolve(cwd, target);
+    const relativeDir = path.relative(cwd, memberDir);
+    if (relativeDir === '..' || relativeDir.startsWith(`..${path.sep}`) || path.isAbsolute(relativeDir) || !fs$2.isDirSync(memberDir)) {
+      throw new utils.InputError(`--uv-members requires every TARGET to be a directory inside --cwd, but got ${target}`);
+    }
+    if (!fs$1.existsSync(path.join(memberDir, 'pyproject.toml'))) {
+      throw new utils.InputError(`--uv-members requires a pyproject.toml in every TARGET, but ${target} has none`);
+    }
+    if (fs$1.existsSync(path.join(memberDir, UV_SBOM_FILENAME))) {
+      throw new utils.InputError(`${path.join(target, UV_SBOM_FILENAME)} already exists. Remove it and run the scan again.`);
+    }
+    memberDirs.add(memberDir);
+  }
+  return Array.from(memberDirs);
+}
+
 async function suggestTarget() {
   // We could prefill this with sub-dirs of the current
   // dir ... but is that going to be useful?
@@ -19737,6 +19854,11 @@ const generalFlags$1 = {
     default: false,
     description: 'Set the visibility (true/false) of the scan in your dashboard.',
     shortFlag: 't'
+  },
+  uvMembers: {
+    type: 'boolean',
+    default: false,
+    description: 'Scan each TARGET directory as a uv project, using the versions pinned in its uv.lock or its workspace root uv.lock. Uploads a CycloneDX dependency graph per TARGET in place of manifest discovery, including all extras and dependency groups. Requires uv on PATH.'
   }
 };
 const cmdScanCreate = {
@@ -19806,6 +19928,7 @@ async function run$d(argv, importMeta, {
       $ ${command}
       $ ${command} ./proj --json
       $ ${command} --repo=test-repo --branch=main ./package.json
+      $ ${command} --uv-members ./packages/api ./packages/worker
   `
   };
   const cli = utils.meowOrExit({
@@ -19855,6 +19978,7 @@ async function run$d(argv, importMeta, {
   // Validate ecosystem values against the reachability-supported set.
   const reachEcosystems = utils.parseReachEcosystems(utils.cmdFlagValueToArray(cli.flags['reachEcosystems']));
   const dryRun = !!cli.flags['dryRun'];
+  const uvMembers = !!cli.flags['uvMembers'];
   let {
     autoManifest,
     branch: branchName,
@@ -19964,7 +20088,7 @@ async function run$d(argv, importMeta, {
   // to regenerate it would be misleading; the manifest data is already there
   // and will be picked up by the scan.
   const hasFactsFile = fs$1.existsSync(path.join(cwd, constants.default.DOT_SOCKET_DOT_FACTS_JSON));
-  if (detected.count > 0 && !autoManifest && !dynamicSbomInference && !hasFactsFile) {
+  if (detected.count > 0 && !autoManifest && !dynamicSbomInference && !uvMembers && !hasFactsFile) {
     logger.logger.info(`Detected ${detected.count} manifest targets we could try to generate. Please set the --auto-manifest flag if you want to include languages covered by \`socket manifest auto\` in the Scan.`);
   }
   if (updatedInput && orgSlug && targets.length) {
@@ -20016,6 +20140,11 @@ async function run$d(argv, importMeta, {
     test: !!targets.length,
     message: 'At least one TARGET (e.g. `.` or `./package.json`)',
     fail: 'missing'
+  }, {
+    nook: true,
+    test: !uvMembers || !autoManifest && !dynamicSbomInference,
+    message: '--uv-members cannot be combined with --auto-manifest or --dynamic-sbom-inference',
+    fail: 'select one source of generated SBOMs'
   }, {
     nook: true,
     test: !json || !markdown,
@@ -20065,6 +20194,7 @@ async function run$d(argv, importMeta, {
   if (!wasValidInput) {
     return;
   }
+  const uvMemberDirs = uvMembers ? resolveUvMemberDirs(targets, cwd) : undefined;
   if (dryRun) {
     logger.logger.log(constants.default.DRY_RUN_BAILING_NOW);
     return;
@@ -20077,6 +20207,7 @@ async function run$d(argv, importMeta, {
     committers: committers && String(committers) || '',
     cwd,
     defaultBranch: Boolean(defaultBranch),
+    generateScanFiles: uvMemberDirs ? () => generateUvMemberSboms(uvMemberDirs) : undefined,
     interactive: Boolean(interactive),
     orgSlug,
     outputKind,
@@ -24275,5 +24406,5 @@ process.on('unhandledRejection', async (reason, promise) => {
   // eslint-disable-next-line n/no-process-exit
   process.exit(1);
 });
-//# debugId=45e6f932-d7fe-49d0-91f3-6a45a49eecd3
+//# debugId=df6cd218-d465-449e-b81a-890e662d0baf
 //# sourceMappingURL=cli.js.map