@socketsecurity/cli 1.4.0 → 1.4.2

package/CHANGELOG.md

@@ -4,6 +4,19 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## [1.4.2](https://github.com/SocketDev/socket-cli/releases/tag/v1.4.2) - 2026-10-05
+
+### Changed
+- Updated the Coana CLI to v `15.11.6`.
+
+## [1.4.1](https://github.com/SocketDev/socket-cli/releases/tag/v1.4.1) - 2026-09-30
+
+### Changed
+- Updated the Coana CLI to v `15.11.5`.
+
+### Fixed
+- `socket fix` pull requests now include every file a fix changes, such as `package.json` override bumps, and work when run from a subdirectory of the repository.
+
 ## [1.4.0](https://github.com/SocketDev/socket-cli/releases/tag/v1.4.0) - 2026-09-29
 
 ### Changed

package/README.md

@@ -1,8 +1,8 @@
 # Socket CLI
 
 [![Socket Badge](https://socket.dev/api/badge/npm/package/socket)](https://socket.dev/npm/package/socket)
-[![Follow @SocketSecurity](https://raw.githubusercontent.com/SocketDev/socket-cli/v1.4.0/assets/fleet/badge-follow-x.svg)](https://twitter.com/SocketSecurity)
-[![Follow @socket.dev on Bluesky](https://raw.githubusercontent.com/SocketDev/socket-cli/v1.4.0/assets/fleet/badge-follow-bluesky.svg)](https://bsky.app/profile/socket.dev)
+[![Follow @SocketSecurity](https://raw.githubusercontent.com/SocketDev/socket-cli/v1.4.2/assets/fleet/badge-follow-x.svg)](https://twitter.com/SocketSecurity)
+[![Follow @socket.dev on Bluesky](https://raw.githubusercontent.com/SocketDev/socket-cli/v1.4.2/assets/fleet/badge-follow-bluesky.svg)](https://bsky.app/profile/socket.dev)
 
 CLI for [Socket.dev](https://socket.dev) — scan dependencies, audit packages, apply security patches, and gate installs from your terminal or CI. This is the 1.x line of the published `socket` package on npm.
 
@@ -171,8 +171,8 @@ MIT
 <br/>
 <div align="center">
   <picture>
-    <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.4.0/assets/fleet/socket-combomark-dark.svg">
-    <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.4.0/assets/fleet/socket-combomark-light.svg">
-    <img width="324" height="104" alt="Socket" src="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.4.0/assets/fleet/socket-combomark-light.svg">
+    <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.4.2/assets/fleet/socket-combomark-dark.svg">
+    <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.4.2/assets/fleet/socket-combomark-light.svg">
+    <img width="324" height="104" alt="Socket" src="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.4.2/assets/fleet/socket-combomark-light.svg">
   </picture>
 </div>

package/dist/cli.js

@@ -8973,6 +8973,24 @@ async function discoverGhsaIds(orgSlug, tarHash, options) {
 function isFactsFile(filepath) {
   return path.basename(filepath).toLowerCase() === constants.DOT_SOCKET_DOT_FACTS_JSON;
 }
+async function gitWorkingTreeChanges(cwd) {
+  const {
+    0: modifiedCResult,
+    1: untrackedCResult
+  } = await Promise.all([utils.gitUnstagedModifiedFiles(cwd), utils.gitUntrackedFiles(cwd)]);
+  return {
+    modified: modifiedCResult.ok ? modifiedCResult.data : [],
+    untracked: untrackedCResult.ok ? untrackedCResult.data : []
+  };
+}
+
+// Coana's modifiedFiles may under-report; untracked files still need it or a
+// manifest name, so build output in repos without a .gitignore stays out.
+function selectFixedFiles(before, after, writtenFiles, scanBaseNames) {
+  const dirtyBefore = new Set([...before.modified, ...before.untracked]);
+  const isFromFix = relPath => !!writtenFiles?.has(relPath) || !dirtyBefore.has(relPath);
+  return [...after.modified.filter(isFromFix), ...after.untracked.filter(relPath => isFromFix(relPath) && (!!writtenFiles?.has(relPath) || scanBaseNames.has(path.basename(relPath))))];
+}
 function readWrittenFiles(outputFile) {
   const result = fs$2.readJsonSync(outputFile, {
     throws: false
@@ -9308,6 +9326,9 @@ async function coanaFixWithFacts(fixConfig, factsSlot) {
     // eslint-disable-next-line no-await-in-loop
     await factsSlot?.generated?.restore();
 
+    // eslint-disable-next-line no-await-in-loop
+    const changesBefore = await gitWorkingTreeChanges(cwd);
+
     // Create a temporary file for Coana output.
     const tmpDir = os.tmpdir();
     const tmpFile = path.join(tmpDir, `socket-fix-${ghsaId}-${Date.now()}.json`);
@@ -9333,16 +9354,9 @@ async function coanaFixWithFacts(fixConfig, factsSlot) {
       }
       continue ghsaLoop;
     }
-
-    // Check for modified files after applying the fix.
-    // eslint-disable-next-line no-await-in-loop
-    const unstagedCResult = await utils.gitUnstagedModifiedFiles(cwd);
-    // Build scripts the fix edits need not be manifests the scan uploads,
-    // and files it creates are untracked.
-    const writtenFiles = readWrittenFiles(tmpFile);
+    const modifiedFiles = selectFixedFiles(changesBefore,
     // eslint-disable-next-line no-await-in-loop
-    const untrackedCResult = await utils.gitUntrackedFiles(cwd);
-    const modifiedFiles = writtenFiles ? [...(unstagedCResult.ok ? unstagedCResult.data : []), ...(untrackedCResult.ok ? untrackedCResult.data : [])].filter(relPath => writtenFiles.has(relPath)) : unstagedCResult.ok ? unstagedCResult.data.filter(relPath => scanBaseNames.has(path.basename(relPath))) : [];
+    await gitWorkingTreeChanges(cwd), readWrittenFiles(tmpFile), scanBaseNames);
     if (!modifiedFiles.length) {
       debug.debugFn('notice', `skip: no changes for ${ghsaId}`);
       // Clean up temp file before continuing.
@@ -24406,5 +24420,5 @@ process.on('unhandledRejection', async (reason, promise) => {
   // eslint-disable-next-line n/no-process-exit
   process.exit(1);
 });
-//# debugId=df6cd218-d465-449e-b81a-890e662d0baf
+//# debugId=71bcae26-79e9-4006-9570-248817c517a
 //# sourceMappingURL=cli.js.map