@socketsecurity/lib 5.5.0 → 5.5.2

package/CHANGELOG.md

@@ -5,6 +5,22 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [5.5.2](https://github.com/SocketDev/socket-lib/releases/tag/v5.5.2) - 2026-01-20
+
+### Changed
+
+- **dlx/package**: Use `getSocketCacacheDir()` instead of `getPacoteCachePath()` for Arborist cache configuration
+  - Ensures consistent use of Socket's shared cacache directory (`~/.socket/_cacache`)
+  - Removes dependency on pacote cache path extraction which could fail
+  - Simplifies cache configuration by using reliable Socket path utility
+
+## [5.5.1](https://github.com/SocketDev/socket-lib/releases/tag/v5.5.1) - 2026-01-12
+
+### Fixed
+
+- Fixed dotenvx compatibility with pre-commit hooks
+- Fixed empty releases being returned when finding latest release
+
 ## [5.5.0](https://github.com/SocketDev/socket-lib/releases/tag/v5.5.0) - 2026-01-12
 
 ### Added

package/dist/constants/agents.d.ts

@@ -6,7 +6,7 @@ export declare const BUN = "bun";
 export declare const VLT = "vlt";
 export declare const NPX = "npx";
 // NPM binary path - resolved at runtime using which.
-export declare const NPM_BIN_PATH: any;
+export declare const NPM_BIN_PATH: string;
 // NPM CLI entry point - resolved at runtime from npm bin location.
 // NOTE: This is kept for backward compatibility but NPM_BIN_PATH should be used instead
 // because cli.js exports a function that must be invoked, not executed directly.

package/dist/constants/packages.js

@@ -111,7 +111,7 @@ function getPacoteCachePath() {
         "x",
         {}
       ).cache : "";
-      _pacoteCachePath = (0, import_normalize.normalizePath)(cachePath);
+      _pacoteCachePath = cachePath ? (0, import_normalize.normalizePath)(cachePath) : "";
     } catch {
       _pacoteCachePath = "";
     }

package/dist/dlx/package.js

@@ -35,12 +35,10 @@ __export(package_exports, {
 });
 module.exports = __toCommonJS(package_exports);
 var import_platform = require("../constants/platform");
-var import_packages = require("../constants/packages");
 var import_cache = require("./cache");
 var import_arborist = __toESM(require("../external/@npmcli/arborist"));
 var import_libnpmexec = __toESM(require("../external/libnpmexec"));
 var import_npm_package_arg = __toESM(require("../external/npm-package-arg"));
-var import_pacote = __toESM(require("../external/pacote"));
 var import_fs = require("../fs");
 var import_normalize = require("../paths/normalize");
 var import_socket = require("../paths/socket");
@@ -122,15 +120,11 @@ Ensure the filesystem is writable or set SOCKET_DLX_DIR to a writable location.`
           return { installed: false, packageDir };
         }
       }
-      const pacoteCachePath = (0, import_packages.getPacoteCachePath)();
       try {
-        await import_pacote.default.extract(packageSpec, installedDir, {
-          // Use consistent pacote cache path (respects npm cache locations when available).
-          cache: pacoteCachePath || path.join(packageDir, ".cache")
-        });
         const arb = new import_arborist.default({
-          path: installedDir,
-          cache: pacoteCachePath || path.join(packageDir, ".cache"),
+          path: packageDir,
+          // Use Socket's shared cacache directory (~/.socket/_cacache).
+          cache: (0, import_socket.getSocketCacacheDir)(),
           // Skip devDependencies (production-only like npx).
           omit: ["dev"],
           // Security: Skip install/preinstall/postinstall scripts to prevent arbitrary code execution.
@@ -144,8 +138,7 @@ Ensure the filesystem is writable or set SOCKET_DLX_DIR to a writable location.`
           // Suppress output (unneeded for ephemeral dlx installs).
           silent: true
         });
-        await arb.buildIdealTree();
-        await arb.reify({ save: false });
+        await arb.reify({ save: true, add: [packageSpec] });
       } catch (e) {
         const code = e.code;
         if (code === "E404" || code === "ETARGET") {

package/dist/errors.d.ts

@@ -0,0 +1,6 @@
+/**
+ * @fileoverview Error utilities with cause chain support.
+ * Provides helpers for working with error causes and stack traces.
+ */
+import { messageWithCauses, stackWithCauses } from './external/pony-cause';
+export { messageWithCauses, stackWithCauses };

package/dist/errors.js

@@ -0,0 +1,31 @@
+"use strict";
+/* Socket Lib - Built with esbuild */
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var errors_exports = {};
+__export(errors_exports, {
+  messageWithCauses: () => import_pony_cause.messageWithCauses,
+  stackWithCauses: () => import_pony_cause.stackWithCauses
+});
+module.exports = __toCommonJS(errors_exports);
+var import_pony_cause = require("./external/pony-cause");
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  messageWithCauses,
+  stackWithCauses
+});

package/dist/external/pony-cause.js

@@ -0,0 +1,148 @@
+"use strict";
+/**
+ * Bundled from pony-cause
+ * This is a zero-dependency bundle created by esbuild.
+ */
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+var __commonJS = (cb, mod) => function __require() {
+  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+};
+
+// node_modules/.pnpm/pony-cause@2.1.11/node_modules/pony-cause/lib/error-with-cause.js
+var require_error_with_cause = __commonJS({
+  "node_modules/.pnpm/pony-cause@2.1.11/node_modules/pony-cause/lib/error-with-cause.js"(exports2, module2) {
+    "use strict";
+    var ErrorWithCause = class _ErrorWithCause extends Error {
+      static {
+        __name(this, "ErrorWithCause");
+      }
+      // linemod-prefix-with: export
+      /**
+       * @param {string} message
+       * @param {{ cause?: T }} options
+       */
+      constructor(message, { cause } = {}) {
+        super(message);
+        this.name = _ErrorWithCause.name;
+        if (cause) {
+          this.cause = cause;
+        }
+        this.message = message;
+      }
+    };
+    module2.exports = {
+      // linemod-remove
+      ErrorWithCause
+      // linemod-remove
+    };
+  }
+});
+
+// node_modules/.pnpm/pony-cause@2.1.11/node_modules/pony-cause/lib/helpers.js
+var require_helpers = __commonJS({
+  "node_modules/.pnpm/pony-cause@2.1.11/node_modules/pony-cause/lib/helpers.js"(exports2, module2) {
+    "use strict";
+    var findCauseByReference = /* @__PURE__ */ __name((err, reference) => {
+      if (!err || !reference) return;
+      if (!(err instanceof Error)) return;
+      if (!(reference.prototype instanceof Error) && // @ts-ignore
+      reference !== Error) return;
+      const seen = /* @__PURE__ */ new Set();
+      let currentErr = err;
+      while (currentErr && !seen.has(currentErr)) {
+        seen.add(currentErr);
+        if (currentErr instanceof reference) {
+          return currentErr;
+        }
+        currentErr = getErrorCause(currentErr);
+      }
+    }, "findCauseByReference");
+    var getErrorCause = /* @__PURE__ */ __name((err) => {
+      if (!err || typeof err !== "object" || !("cause" in err)) {
+        return;
+      }
+      if (typeof err.cause === "function") {
+        const causeResult = err.cause();
+        return causeResult instanceof Error ? causeResult : void 0;
+      } else {
+        return err.cause instanceof Error ? err.cause : void 0;
+      }
+    }, "getErrorCause");
+    var _stackWithCauses = /* @__PURE__ */ __name((err, seen) => {
+      if (!(err instanceof Error)) return "";
+      const stack = err.stack || "";
+      if (seen.has(err)) {
+        return stack + "\ncauses have become circular...";
+      }
+      const cause = getErrorCause(err);
+      if (cause) {
+        seen.add(err);
+        return stack + "\ncaused by: " + _stackWithCauses(cause, seen);
+      } else {
+        return stack;
+      }
+    }, "_stackWithCauses");
+    var stackWithCauses = /* @__PURE__ */ __name((err) => _stackWithCauses(err, /* @__PURE__ */ new Set()), "stackWithCauses");
+    var _messageWithCauses = /* @__PURE__ */ __name((err, seen, skip) => {
+      if (!(err instanceof Error)) return "";
+      const message = skip ? "" : err.message || "";
+      if (seen.has(err)) {
+        return message + ": ...";
+      }
+      const cause = getErrorCause(err);
+      if (cause) {
+        seen.add(err);
+        const skipIfVErrorStyleCause = "cause" in err && typeof err.cause === "function";
+        return message + (skipIfVErrorStyleCause ? "" : ": ") + _messageWithCauses(cause, seen, skipIfVErrorStyleCause);
+      } else {
+        return message;
+      }
+    }, "_messageWithCauses");
+    var messageWithCauses = /* @__PURE__ */ __name((err) => _messageWithCauses(err, /* @__PURE__ */ new Set()), "messageWithCauses");
+    module2.exports = {
+      // linemod-remove
+      findCauseByReference,
+      // linemod-remove
+      getErrorCause,
+      // linemod-remove
+      stackWithCauses,
+      // linemod-remove
+      messageWithCauses
+      // linemod-remove
+    };
+  }
+});
+
+// node_modules/.pnpm/pony-cause@2.1.11/node_modules/pony-cause/index.js
+var require_pony_cause = __commonJS({
+  "node_modules/.pnpm/pony-cause@2.1.11/node_modules/pony-cause/index.js"(exports2, module2) {
+    "use strict";
+    var { ErrorWithCause } = require_error_with_cause();
+    var {
+      // linemod-replace-with: export {
+      findCauseByReference,
+      getErrorCause,
+      messageWithCauses,
+      stackWithCauses
+    } = require_helpers();
+    module2.exports = {
+      // linemod-remove
+      ErrorWithCause,
+      // linemod-remove
+      findCauseByReference,
+      // linemod-remove
+      getErrorCause,
+      // linemod-remove
+      stackWithCauses,
+      // linemod-remove
+      messageWithCauses
+      // linemod-remove
+    };
+  }
+});
+
+// src/external/pony-cause.js
+module.exports = require_pony_cause();

package/dist/releases/github.js

@@ -139,6 +139,9 @@ async function getLatestRelease(toolPrefix, repoConfig, options = {}) {
           if (!tag2.startsWith(toolPrefix)) {
             return false;
           }
+          if (!assets || assets.length === 0) {
+            return false;
+          }
           if (isMatch) {
             const hasMatchingAsset = assets.some(
               (a) => isMatch(a.name)

package/dist/spawn.d.ts

@@ -158,6 +158,12 @@ export interface SpawnSyncReturns<T> {
     signal: NodeJS.Signals | null;
     error?: Error | undefined;
 }
+/**
+ * Enhances spawn error with better context.
+ * Converts generic "command failed" to detailed error with command, exit code, and stderr.
+ */
+/*@__NO_SIDE_EFFECTS__*/
+export declare function enhanceSpawnError(error: unknown): unknown;
 /**
  * Check if a value is a spawn error with expected error properties.
  * Tests for common error properties from child process failures.

package/dist/spawn.js

@@ -29,6 +29,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var spawn_exports = {};
 __export(spawn_exports, {
+  enhanceSpawnError: () => enhanceSpawnError,
   isSpawnError: () => isSpawnError,
   isStdioType: () => isStdioType,
   spawn: () => spawn,
@@ -36,6 +37,7 @@ __export(spawn_exports, {
 });
 module.exports = __toCommonJS(spawn_exports);
 var import_process = require("./constants/process");
+var import_errors = require("./errors");
 var import_promise_spawn = __toESM(require("./external/@npmcli/promise-spawn"));
 var import_arrays = require("./arrays");
 var import_bin = require("./bin");
@@ -53,6 +55,7 @@ function getPath() {
 }
 const abortSignal = (0, import_process.getAbortSignal)();
 const spinner = (0, import_spinner.getDefaultSpinner)();
+const stackCache = /* @__PURE__ */ new WeakMap();
 const windowsScriptExtRegExp = /\.(?:cmd|bat|ps1)$/i;
 let _child_process;
 // @__NO_SIDE_EFFECTS__
@@ -63,6 +66,79 @@ function getChildProcess() {
   return _child_process;
 }
 // @__NO_SIDE_EFFECTS__
+function enhanceSpawnError(error) {
+  if (error === null || typeof error !== "object") {
+    return error;
+  }
+  if (!/* @__PURE__ */ isSpawnError(error)) {
+    return error;
+  }
+  const err = error;
+  const { args, cmd, code, signal, stderr } = err;
+  const stderrText = typeof stderr === "string" ? stderr : stderr?.toString() ?? "";
+  let enhancedMessage = `Command failed: ${cmd}`;
+  if (args && args.length > 0) {
+    const argsStr = args.join(" ");
+    if (argsStr.length < 100) {
+      enhancedMessage += ` ${argsStr}`;
+    } else {
+      enhancedMessage += ` ${argsStr.slice(0, 97)}...`;
+    }
+  }
+  if (signal) {
+    enhancedMessage += ` (terminated by ${signal})`;
+  } else if (code !== void 0) {
+    enhancedMessage += ` (exit code ${code})`;
+  }
+  const trimmedStderr = stderrText.trim();
+  if (trimmedStderr) {
+    const firstLine = trimmedStderr.split("\n")[0];
+    if (firstLine.length < 200) {
+      enhancedMessage += `
+${firstLine}`;
+    } else {
+      enhancedMessage += `
+${firstLine.slice(0, 197)}...`;
+    }
+  }
+  const isSynthetic = err.message === "command failed";
+  if (isSynthetic) {
+    Object.defineProperty(err, "message", {
+      __proto__: null,
+      value: enhancedMessage,
+      writable: true,
+      enumerable: false,
+      configurable: true
+    });
+    return err;
+  }
+  const enhancedError = new Error(enhancedMessage, {
+    cause: err
+  });
+  const descriptors = Object.getOwnPropertyDescriptors(err);
+  delete descriptors.message;
+  delete descriptors.stack;
+  Object.defineProperties(enhancedError, descriptors);
+  Object.defineProperty(enhancedError, "stack", {
+    __proto__: null,
+    configurable: true,
+    enumerable: false,
+    get() {
+      let stack = stackCache.get(enhancedError);
+      if (stack === void 0) {
+        try {
+          stack = (0, import_errors.stackWithCauses)(err);
+        } catch {
+          stack = err.stack ?? new Error().stack ?? "";
+        }
+        stackCache.set(enhancedError, stack);
+      }
+      return stack;
+    }
+  });
+  return enhancedError;
+}
+// @__NO_SIDE_EFFECTS__
 function isSpawnError(value) {
   if (value === null || typeof value !== "object") {
     return false;
@@ -152,7 +228,9 @@ function spawn(cmd, args, options, extra) {
       }
       return strippedResult;
     }).catch((error) => {
-      throw /* @__PURE__ */ stripAnsiFromSpawnResult(error);
+      const strippedError = /* @__PURE__ */ stripAnsiFromSpawnResult(error);
+      const enhancedError = /* @__PURE__ */ enhanceSpawnError(strippedError);
+      throw enhancedError;
     });
   } else {
     newSpawnPromise = spawnPromise.then((result) => {
@@ -162,6 +240,9 @@ function spawn(cmd, args, options, extra) {
         return res;
       }
       return result;
+    }).catch((error) => {
+      const enhancedError = /* @__PURE__ */ enhanceSpawnError(error);
+      throw enhancedError;
     });
   }
   if (shouldRestartSpinner) {
@@ -215,6 +296,7 @@ function spawnSync(cmd, args, options) {
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  enhanceSpawnError,
   isSpawnError,
   isStdioType,
   spawn,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@socketsecurity/lib",
-  "version": "5.5.0",
+  "version": "5.5.2",
   "packageManager": "pnpm@10.28.0",
   "license": "MIT",
   "description": "Core utilities and infrastructure for Socket.dev security tools",
@@ -359,6 +359,10 @@
       "types": "./dist/env/xdg.d.ts",
       "default": "./dist/env/xdg.js"
     },
+    "./errors": {
+      "types": "./dist/errors.d.ts",
+      "default": "./dist/errors.js"
+    },
     "./fs": {
       "types": "./dist/fs.d.ts",
       "default": "./dist/fs.js"
@@ -726,7 +730,7 @@
     "@socketregistry/is-unicode-supported": "1.0.5",
     "@socketregistry/packageurl-js": "1.3.5",
     "@socketregistry/yocto-spinner": "1.0.25",
-    "@socketsecurity/lib-stable": "npm:@socketsecurity/lib@5.4.0",
+    "@socketsecurity/lib-stable": "npm:@socketsecurity/lib@5.5.0",
     "@types/node": "24.9.2",
     "@typescript/native-preview": "7.0.0-dev.20250920.1",
     "@vitest/coverage-v8": "4.0.3",
@@ -760,6 +764,7 @@
     "npm-package-arg": "13.0.0",
     "pacote": "21.0.1",
     "picomatch": "2.3.1",
+    "pony-cause": "2.1.11",
     "semver": "7.7.2",
     "signal-exit": "4.1.0",
     "spdx-correct": "3.2.0",
@@ -795,6 +800,7 @@
       "@sigstore/sign": "4.1.0",
       "ansi-regex": "6.2.2",
       "debug": "4.4.3",
+      "execa": "5.1.1",
       "has-flag": "5.0.1",
       "isexe": "3.1.1",
       "lru-cache": "11.2.2",
@@ -812,7 +818,8 @@
     "patchedDependencies": {
       "@npmcli/run-script@10.0.0": "patches/@npmcli__run-script@10.0.0.patch",
       "@sigstore/sign@4.1.0": "patches/@sigstore__sign@4.1.0.patch",
-      "node-gyp@11.5.0": "patches/node-gyp@11.5.0.patch"
+      "node-gyp@11.5.0": "patches/node-gyp@11.5.0.patch",
+      "execa@5.1.1": "patches/execa@5.1.1.patch"
     }
   }
 }