@socketsecurity/lib 5.11.0 → 5.11.1

package/CHANGELOG.md

@@ -5,6 +5,15 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [5.11.1](https://github.com/SocketDev/socket-lib/releases/tag/v5.11.1) - 2026-03-24
+
+### Added
+
+- **dlx/binary**: Added `sha256` option to `dlxBinary()`, `downloadBinary()`, and `downloadBinaryFile()`
+  - Enables SHA-256 checksum verification for binary downloads via httpDownload
+  - Verification happens during download (fails early if checksum mismatches)
+  - Complements existing `integrity` option (SRI sha512 format, verified post-download)
+
 ## [5.11.0](https://github.com/SocketDev/socket-lib/releases/tag/v5.11.0) - 2026-03-23
 
 ### Added

package/dist/dlx/binary.d.ts

@@ -13,6 +13,12 @@ export interface DlxBinaryOptions {
      * Expected SRI integrity hash (sha512-<base64>) for verification.
      */
     integrity?: string | undefined;
+    /**
+     * Expected SHA-256 hex checksum for verification.
+     * Passed to httpDownload for inline verification during download.
+     * This is more secure than post-download verification as it fails early.
+     */
+    sha256?: string | undefined;
     /**
      * Cache TTL in milliseconds (default: 7 days).
      */
@@ -127,8 +133,14 @@ export declare function downloadBinary(options: Omit<DlxBinaryOptions, 'spawnOpt
  * Download a file from a URL with integrity checking and concurrent download protection.
  * Uses processLock to prevent multiple processes from downloading the same binary simultaneously.
  * Internal helper function for downloading binary files.
+ *
+ * Supports two integrity verification methods:
+ * - sha256: Hex SHA-256 checksum (verified inline during download via httpDownload)
+ * - integrity: SRI format sha512-<base64> (verified post-download)
+ *
+ * The sha256 option is preferred as it fails early during download if the checksum doesn't match.
  */
-export declare function downloadBinaryFile(url: string, destPath: string, integrity?: string | undefined): Promise<string>;
+export declare function downloadBinaryFile(url: string, destPath: string, integrity?: string | undefined, sha256?: string | undefined): Promise<string>;
 /**
  * Execute a cached binary without re-downloading.
  * Similar to executePackage from dlx-package.

package/dist/dlx/binary.js

@@ -111,6 +111,7 @@ async function dlxBinary(args, options, spawnExtra) {
     force: userForce = false,
     integrity,
     name,
+    sha256,
     spawnOptions,
     url,
     yes
@@ -168,7 +169,12 @@ Ensure the filesystem is writable or set SOCKET_DLX_DIR to a writable location.`
         { cause: e }
       );
     }
-    computedIntegrity = await downloadBinaryFile(url, binaryPath, integrity);
+    computedIntegrity = await downloadBinaryFile(
+      url,
+      binaryPath,
+      integrity,
+      sha256
+    );
     const stats = await fs.promises.stat(binaryPath);
     await writeBinaryCacheMetadata(
       cacheEntryDir,
@@ -200,6 +206,7 @@ async function downloadBinary(options) {
     force = false,
     integrity,
     name,
+    sha256,
     url
   } = { __proto__: null, ...options };
   const fs = /* @__PURE__ */ getFs();
@@ -240,7 +247,8 @@ Ensure the filesystem is writable or set SOCKET_DLX_DIR to a writable location.`
     const computedIntegrity = await downloadBinaryFile(
       url,
       binaryPath,
-      integrity
+      integrity,
+      sha256
     );
     const stats = await fs.promises.stat(binaryPath);
     await writeBinaryCacheMetadata(
@@ -257,7 +265,7 @@ Ensure the filesystem is writable or set SOCKET_DLX_DIR to a writable location.`
     downloaded
   };
 }
-async function downloadBinaryFile(url, destPath, integrity) {
+async function downloadBinaryFile(url, destPath, integrity, sha256) {
   const crypto = /* @__PURE__ */ getCrypto();
   const fs = /* @__PURE__ */ getFs();
   const path = /* @__PURE__ */ getPath();
@@ -275,7 +283,7 @@ async function downloadBinaryFile(url, destPath, integrity) {
         }
       }
       try {
-        await (0, import_http_request.httpDownload)(url, destPath);
+        await (0, import_http_request.httpDownload)(url, destPath, sha256 ? { sha256 } : void 0);
       } catch (e) {
         throw new Error(
           `Failed to download binary from ${url}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@socketsecurity/lib",
-  "version": "5.11.0",
-  "packageManager": "pnpm@10.32.1",
+  "version": "5.11.1",
+  "packageManager": "pnpm@10.33.0",
   "license": "MIT",
   "description": "Core utilities and infrastructure for Socket.dev security tools",
   "keywords": [
@@ -734,7 +734,7 @@
     "@socketregistry/is-unicode-supported": "1.0.5",
     "@socketregistry/packageurl-js": "1.3.5",
     "@socketregistry/yocto-spinner": "1.0.25",
-    "@socketsecurity/lib-stable": "npm:@socketsecurity/lib@5.9.0",
+    "@socketsecurity/lib-stable": "npm:@socketsecurity/lib@5.11.0",
     "@types/node": "24.9.2",
     "@typescript/native-preview": "7.0.0-dev.20250920.1",
     "@vitest/coverage-v8": "4.0.3",