heroku 11.10.0 → 11.10.1-beta.0

package/CHANGELOG.md

@@ -4,6 +4,27 @@ All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
 
+## [11.10.1-beta.0](https://github.com/heroku/cli/compare/v11.10.0...v11.10.1-beta.0) (2026-09-23)
+
+
+### Bug Fixes
+
+* **deps:** bump fast-uri to 3.1.7 (closes 4 advisories) ([#3908](https://github.com/heroku/cli/issues/3908)) ([ffe207d](https://github.com/heroku/cli/commit/ffe207dc6e50fd1d6fcfddf345dde94deb1db5b3)), closes [#391](https://github.com/heroku/cli/issues/391) [#392](https://github.com/heroku/cli/issues/392) [#399](https://github.com/heroku/cli/issues/399) [#400](https://github.com/heroku/cli/issues/400)
+* **deps:** resolve GHSA-73wf-gq98-2v4g in browserslist ([#3909](https://github.com/heroku/cli/issues/3909)) ([fe3cd8b](https://github.com/heroku/cli/commit/fe3cd8b5f88b3b22491319879bdb9568db42486a)), closes [#396](https://github.com/heroku/cli/issues/396)
+* fix misleading config output when 2FA fails ([#3887](https://github.com/heroku/cli/issues/3887)) ([e0fd81f](https://github.com/heroku/cli/commit/e0fd81f0b4bafc5d2919c5e3cf83a39279299b20))
+* parse Procfile process types containing dashes in heroku local ([#3883](https://github.com/heroku/cli/issues/3883)) ([5118f40](https://github.com/heroku/cli/commit/5118f40a868e7c07604e2986efc68ea45e9feaee))
+* updates opentelemetry deps to match sentry's peer deps ([#3900](https://github.com/heroku/cli/issues/3900)) ([f66d998](https://github.com/heroku/cli/commit/f66d9984b2dd1b8c0cc6c1e4d0f1819340fc4b63))
+
+
+### Code Refactoring
+
+* drop @heroku/socksv5 fork to clear ip-address HIGH advisory ([#3939](https://github.com/heroku/cli/issues/3939)) ([af20ead](https://github.com/heroku/cli/commit/af20eadf8bfb65278e8b26bcffdea3cf1a743833))
+
+
+### Continuous Integration
+
+* automatically label each PR with a code-size bucket ([#3941](https://github.com/heroku/cli/issues/3941)) ([2d13484](https://github.com/heroku/cli/commit/2d1348438ec8ab1361a773bce30b3c5c93d8a1e6))
+
 ## [11.10.0](https://github.com/heroku/cli/compare/v11.9.0...v11.10.0) (2026-08-18)
 
 

package/dist/commands/config/set.js

@@ -43,11 +43,18 @@ RACK_ENV:  staging`)];
         });
         const varsCopy = argv.map((v) => color.name(v.split('=')[0])).join(', ');
         ux.action.start(`Setting ${varsCopy} and restarting ${color.app(flags.app)}`);
-        let { body: config } = await this.heroku.patch(`/apps/${flags.app}/config-vars`, {
-            body: vars,
-        });
-        const release = await lastRelease(this.heroku, flags.app);
-        ux.action.stop(`done, ${color.name('v' + release.version)}`);
+        let config;
+        try {
+            ({ body: config } = await this.heroku.patch(`/apps/${flags.app}/config-vars`, {
+                body: vars,
+            }));
+            const release = await lastRelease(this.heroku, flags.app);
+            ux.action.stop(`done, ${color.name('v' + release.version)}`);
+        }
+        catch (error) {
+            ux.action.stop(color.red('!'));
+            throw error;
+        }
         config = Object.fromEntries(Object.entries(config)
             .filter(([k]) => vars[k])
             .map(([k, v]) => [color.name(k), v]));

package/dist/commands/config/unset.js

@@ -34,11 +34,17 @@ Unsetting RAILS_ENV, RACK_ENV and restarting example... done, v10`)];
         }
         const vars = argv.map(v => color.name(v)).join(', ');
         ux.action.start(`Unsetting ${vars} and restarting ${color.app(flags.app)}`);
-        await this.heroku.patch(`/apps/${flags.app}/config-vars`, {
-            // body will be like {FOO: null, BAR: null}
-            body: Object.fromEntries(argv.map(v => [v, null])),
-        });
-        const release = await lastRelease();
-        ux.action.stop('done, ' + color.name(`v${release.version}`));
+        try {
+            await this.heroku.patch(`/apps/${flags.app}/config-vars`, {
+                // body will be like {FOO: null, BAR: null}
+                body: Object.fromEntries(argv.map(v => [v, null])),
+            });
+            const release = await lastRelease();
+            ux.action.stop('done, ' + color.name(`v${release.version}`));
+        }
+        catch (error) {
+            ux.action.stop(color.red('!'));
+            throw error;
+        }
     }
 }

package/dist/commands/ps/forward.js

@@ -1,11 +1,13 @@
 import { Command, flags } from '@heroku-cli/command';
 import * as color from '@heroku/heroku-cli-util/color';
-import socks from '@heroku/socksv5';
 import { Args, ux } from '@oclif/core';
+import debug from 'debug';
 import net from 'node:net';
+import { SocksClient } from 'socks';
 import tsheredoc from 'tsheredoc';
 import { HerokuExec } from '../../lib/ps-exec/exec.js';
 const heredoc = tsheredoc.default;
+const forwardDebug = debug('cli:ps:forward');
 export default class Forward extends Command {
     static args = {
         port: Args.string({ description: 'port or list of ports to forward', required: true }),
@@ -48,27 +50,72 @@ export default class Forward extends Command {
             // that's ok because localPort is only here for backwards compat
             return [ports[0], ports[1] || localPort || ports[0]];
         });
+        // Each local listener binds asynchronously, so we don't know until its
+        // 'listening'/'error' event whether the port was actually claimed. Resolve
+        // this once every listener has settled with the count that bound, so run()
+        // can fail loudly if forwarding nothing (every requested port in use)
+        // instead of silently exiting 0.
+        let resolveBoundCount;
+        const boundCountPromise = new Promise(resolve => {
+            resolveBoundCount = resolve;
+        });
         await exec.initFeature(context, this.heroku, async (configVars) => {
             await exec.createSocksProxy(context, this.heroku, configVars, (dynoIp, dynoName, socksPort) => {
+                let bound = 0;
+                let settled = 0;
+                const onSettled = () => {
+                    settled++;
+                    if (settled === portMappings.length)
+                        resolveBoundCount(bound);
+                };
                 for (const portMapping of portMappings) {
                     const [localPortNum, remotePort] = portMapping;
-                    ux.stdout(`Listening on ${color.bold(localPortNum)} and forwarding to ${color.bold(`${dynoName}:${remotePort}`)}`);
                     net.createServer(connIn => {
-                        socks.connect({
-                            auths: [socks.auth.None()], // eslint-disable-line new-cap
-                            host: '0.0.0.0',
-                            port: Number.parseInt(remotePort, 10),
-                            proxyHost: 'localhost',
-                            proxyPort: socksPort,
-                        }, socket => {
-                            connIn.pipe(socket);
-                            socket.pipe(connIn);
+                        // Without a handler a socket reset (e.g. the peer hangs up) surfaces
+                        // as an unhandled 'error' and crashes the CLI.
+                        connIn.on('error', err => {
+                            forwardDebug('local connection error: %o', err);
+                            connIn.destroy();
+                        });
+                        SocksClient.createConnection({
+                            command: 'connect',
+                            destination: { host: '0.0.0.0', port: Number.parseInt(remotePort, 10) },
+                            proxy: { host: 'localhost', port: socksPort, type: 5 },
+                        }, (err, info) => {
+                            if (err || !info) {
+                                forwardDebug('SOCKS connection to %s:%s failed: %o', dynoName, remotePort, err);
+                                connIn.destroy();
+                                return;
+                            }
+                            info.socket.on('error', socketErr => {
+                                forwardDebug('proxied socket error: %o', socketErr);
+                                connIn.destroy();
+                            });
+                            connIn.pipe(info.socket);
+                            info.socket.pipe(connIn);
                         });
-                    }).listen(Number.parseInt(localPortNum, 10));
+                        // Bind loopback-only so the forwarded port is reachable only from
+                        // this machine — it fronts a no-auth tunnel into the dyno, so it must
+                        // not be exposed to other hosts on the LAN.
+                    }).listen(Number.parseInt(localPortNum, 10), '127.0.0.1')
+                        .on('listening', () => {
+                        bound++;
+                        ux.stdout(`Listening on ${color.bold(localPortNum)} and forwarding to ${color.bold(`${dynoName}:${remotePort}`)}`);
+                        onSettled();
+                    })
+                        .on('error', (err) => {
+                        const detail = err.code === 'EADDRINUSE' ? 'port is already in use' : err.message;
+                        ux.warn(`Cannot forward to ${dynoName}:${remotePort} on local port ${localPortNum}: ${detail}`);
+                        onSettled();
+                    });
                 }
-                ux.stdout(`Use ${color.magenta('CTRL+C')} to stop port forwarding`);
             });
         }, 'forward');
+        const boundCount = await boundCountPromise;
+        if (boundCount === 0) {
+            this.error('Could not forward any of the requested ports; every requested local port is already in use.');
+        }
+        ux.stdout(`Use ${color.magenta('CTRL+C')} to stop port forwarding`);
         // Keep the process running until interrupted
         await new Promise(resolve => {
             process.once('SIGINT', resolve);

package/dist/lib/ci/source.js

@@ -1,5 +1,5 @@
 import debug from 'debug';
-import { got } from 'got';
+import got from 'got';
 import { createReadStream, promises as fs } from 'node:fs';
 import { gitService } from './git.js';
 const ciDebug = debug('ci');

package/dist/lib/local/load-foreman-procfile.js

@@ -4,7 +4,7 @@ function parseProcfile(content) {
         if (/^\s*#/.test(line)) {
             return false;
         }
-        if (/\w/.test(line) && !/^\s*\w+:/.test(line)) {
+        if (/\w/.test(line) && !/^\s*[\w-]+:/.test(line)) {
             throw new Error('line ' + (i + 1) + ' parse error: ' + line);
         }
         return line.match(/\w/);

package/dist/lib/ps-exec/socks5-server.d.ts

@@ -0,0 +1,46 @@
+import net from 'node:net';
+/**
+ * A minimal SOCKS5 server supporting only the CONNECT command with no
+ * authentication — the exact subset the `heroku ps:socks`/`ps:forward`
+ * commands require.
+ *
+ * Unlike a general SOCKS proxy, this server never dials the destination
+ * itself: the destination lives inside the dyno's private network and is only
+ * reachable through an SSH tunnel. Instead, the connection handler receives the
+ * parsed request and an `accept()` callback that hands back the raw client
+ * socket, so the caller can pipe it to an SSH `forwardOut` stream.
+ *
+ * @see https://datatracker.ietf.org/doc/html/rfc1928
+ */
+export interface SocksRequestInfo {
+    cmd: number;
+    dstAddr: string;
+    dstPort: number;
+    srcAddr: string;
+    srcPort: number;
+}
+/**
+ * Approves the connection: sends the SOCKS success reply and returns the raw
+ * client socket for the caller to bridge to its own upstream. This server only
+ * supports this intercept mode — it never dials the destination itself. Returns
+ * `null` if the connection was already settled by a prior `accept`/`deny` or the
+ * socket is no longer writable.
+ */
+export type AcceptFn = () => net.Socket | null;
+export type DenyFn = () => void;
+export type ConnectionHandler = (info: SocksRequestInfo, accept: AcceptFn, deny: DenyFn) => void;
+export declare class Socks5Server {
+    private readonly handler;
+    readonly server: net.Server;
+    constructor(handler: ConnectionHandler);
+    close(callback?: () => void): this;
+    listen(port: number, host: string, callback?: () => void): this;
+    on(event: 'error', listener: (err: NodeJS.ErrnoException) => void): this;
+    private _handleConnection;
+    private _readAddress;
+}
+declare function createServer(handler: ConnectionHandler): Socks5Server;
+declare const _default: {
+    createServer: typeof createServer;
+};
+export default _default;

package/dist/lib/ps-exec/socks5-server.js

@@ -0,0 +1,172 @@
+// cspell:ignore atyp nmethods
+import net from 'node:net';
+const SOCKS_VERSION = 0x05;
+const AUTH_NONE = 0x00;
+const AUTH_NO_ACCEPTABLE = 0xFF;
+const CMD_CONNECT = 0x01;
+const ATYP_IPV4 = 0x01;
+const ATYP_DOMAIN = 0x03;
+const ATYP_IPV6 = 0x04;
+const REP_SUCCESS = 0x00;
+const REP_GENERAL_FAILURE = 0x01;
+const REP_CMD_NOT_SUPPORTED = 0x07;
+// Guardrails against a client that connects but stalls or floods before the
+// handshake completes. A well-behaved client sends only a few hundred bytes and
+// finishes promptly; anything larger or slower is dropped.
+const HANDSHAKE_TIMEOUT_MS = 10_000;
+const MAX_HANDSHAKE_BYTES = 1024;
+// Replies carry a null bind address (0.0.0.0:0); clients doing CONNECT ignore it.
+const reply = (rep) => Buffer.from([SOCKS_VERSION, rep, 0x00, ATYP_IPV4, 0, 0, 0, 0, 0, 0]);
+export class Socks5Server {
+    handler;
+    server;
+    constructor(handler) {
+        this.handler = handler;
+        this.server = net.createServer(socket => this._handleConnection(socket));
+    }
+    close(callback) {
+        this.server.close(callback);
+        return this;
+    }
+    listen(port, host, callback) {
+        this.server.listen(port, host, callback);
+        return this;
+    }
+    // Passthrough for the underlying server's 'error' event (e.g. an EADDRINUSE
+    // bind failure), so callers can report it cleanly instead of letting it
+    // surface as an unhandled 'error' that crashes the process.
+    on(event, listener) {
+        this.server.on(event, listener);
+        return this;
+    }
+    _handleConnection(socket) {
+        socket.on('error', () => socket.destroy());
+        // Drop a client that connects but never finishes the handshake, so a slow or
+        // idle peer can't pin the socket open. Cleared once the request is parsed.
+        socket.setTimeout(HANDSHAKE_TIMEOUT_MS);
+        socket.on('timeout', () => socket.destroy());
+        let settled = false;
+        let buffer = Buffer.alloc(0);
+        // Sequential reader over the accumulating buffer. Each step consumes a fixed
+        // number of bytes once they are available and advances to the next.
+        const steps = [];
+        const readBytes = (need, run) => steps.push({ need, run });
+        const pump = () => {
+            while (steps.length > 0 && buffer.length >= steps[0].need) {
+                const { need, run } = steps.shift();
+                const bytes = buffer.subarray(0, need);
+                buffer = buffer.subarray(need);
+                run(bytes);
+            }
+        };
+        const onData = (chunk) => {
+            buffer = Buffer.concat([buffer, chunk]);
+            // While still parsing the handshake, a well-behaved client sends only a
+            // few hundred bytes; anything larger is abnormal, so refuse it rather than
+            // buffering without bound.
+            if (steps.length > 0 && buffer.length > MAX_HANDSHAKE_BYTES) {
+                socket.destroy();
+                return;
+            }
+            pump();
+        };
+        // Greeting: VER, NMETHODS, METHODS...
+        readBytes(2, header => {
+            if (header[0] !== SOCKS_VERSION)
+                return socket.destroy();
+            readBytes(header[1], methods => {
+                if (!methods.includes(AUTH_NONE)) {
+                    socket.end(Buffer.from([SOCKS_VERSION, AUTH_NO_ACCEPTABLE]));
+                    return;
+                }
+                socket.write(Buffer.from([SOCKS_VERSION, AUTH_NONE]));
+                // Request: VER, CMD, RSV, ATYP, DST.ADDR, DST.PORT
+                readBytes(4, head => {
+                    const [ver, cmd, , atyp] = head;
+                    if (ver !== SOCKS_VERSION)
+                        return socket.destroy();
+                    this._readAddress(atyp, readBytes, addr => {
+                        if (addr === null) {
+                            socket.end(reply(REP_GENERAL_FAILURE));
+                            return;
+                        }
+                        readBytes(2, portBuf => {
+                            const dstPort = portBuf.readUInt16BE(0);
+                            if (cmd !== CMD_CONNECT) {
+                                socket.end(reply(REP_CMD_NOT_SUPPORTED));
+                                return;
+                            }
+                            const info = {
+                                cmd,
+                                dstAddr: addr,
+                                dstPort,
+                                srcAddr: socket.remoteAddress ?? '',
+                                srcPort: socket.remotePort ?? 0,
+                            };
+                            const accept = () => {
+                                if (settled || !socket.writable)
+                                    return null;
+                                settled = true;
+                                socket.write(reply(REP_SUCCESS));
+                                // Stop intercepting: detach our reader and hand back any bytes
+                                // that arrived after the request so piping sees a clean stream.
+                                socket.removeListener('data', onData);
+                                if (buffer.length > 0) {
+                                    socket.unshift(buffer);
+                                    buffer = Buffer.alloc(0);
+                                }
+                                return socket;
+                            };
+                            const deny = () => {
+                                // Ignore a deny once the connection is accepted (or already
+                                // denied): writing a SOCKS reply into a live tunnel corrupts it.
+                                if (settled)
+                                    return;
+                                settled = true;
+                                if (socket.writable)
+                                    socket.end(reply(REP_GENERAL_FAILURE));
+                            };
+                            // The handshake is parsed: stop the timeout and pause reads so a
+                            // client can't flood us while the handler establishes the upstream
+                            // tunnel. accept() detaches the reader and piping resumes flow.
+                            socket.setTimeout(0);
+                            socket.pause();
+                            this.handler(info, accept, deny);
+                        });
+                    });
+                });
+            });
+        });
+        socket.on('data', onData);
+    }
+    // DST.ADDR is length-prefixed for domains and fixed-width for IPs. Calls back
+    // with the decoded address, or null on an unsupported address type.
+    _readAddress(atyp, readBytes, done) {
+        switch (atyp) {
+            case ATYP_DOMAIN: {
+                readBytes(1, lenBuf => readBytes(lenBuf[0], nameBuf => done(nameBuf.toString('utf8'))));
+                break;
+            }
+            case ATYP_IPV4: {
+                readBytes(4, b => done(`${b[0]}.${b[1]}.${b[2]}.${b[3]}`));
+                break;
+            }
+            case ATYP_IPV6: {
+                readBytes(16, b => {
+                    const groups = [];
+                    for (let i = 0; i < 16; i += 2)
+                        groups.push(b.readUInt16BE(i).toString(16));
+                    done(groups.join(':'));
+                });
+                break;
+            }
+            default: {
+                done(null);
+            }
+        }
+    }
+}
+function createServer(handler) {
+    return new Socks5Server(handler);
+}
+export default { createServer };

package/dist/lib/ps-exec/ssh.d.ts

@@ -12,4 +12,6 @@ export declare class HerokuSsh {
     private _logConnectionError;
     private _readData;
     private _readStdin;
+    private _reportProxyBindError;
+    private _stdinToRemote;
 }

package/dist/lib/ps-exec/ssh.js

@@ -1,5 +1,5 @@
 import * as color from '@heroku/heroku-cli-util/color';
-import socks from '@heroku/socksv5';
+import { Errors } from '@oclif/core';
 import { ux } from '@oclif/core/ux';
 import cliProgress from 'cli-progress';
 import debug from 'debug';
@@ -11,7 +11,12 @@ import path from 'node:path';
 import stream from 'node:stream';
 import tty from 'node:tty';
 import { Client } from 'ssh2';
+import socks5 from './socks5-server.js';
 const sshDebug = debug('cli:ps-exec:ssh');
+// Upper bound on simultaneously-live SOCKS connections (each is its own SSH
+// session). Generous enough for a browser fanning out, low enough to keep a
+// runaway local client from exhausting fds/SSH sessions.
+const MAX_SOCKS_CONNECTIONS = 128;
 export class HerokuSsh {
     connect(context, addonHost, dynoUser, privateKey, proxyKey, callback) {
         return new Promise((resolve, reject) => {
@@ -136,36 +141,76 @@ export class HerokuSsh {
     }
     socksv5(addonHost, dynoUser, privateKey, proxyKey, callback) {
         const socksPort = 1080;
-        socks.createServer((info, accept, deny) => {
+        // Each accepted SOCKS request opens its own SSH connection, so cap how many
+        // can be live at once. Without this a client that fans out many parallel
+        // connections (a browser, or a hostile local process) can drive up fd/memory
+        // and SSH-session load on both the CLI and the dyno's sshd.
+        let activeConnections = 0;
+        socks5.createServer((info, accept, deny) => {
+            if (activeConnections >= MAX_SOCKS_CONNECTIONS) {
+                sshDebug(`refusing SOCKS request: ${activeConnections} connections already active (max ${MAX_SOCKS_CONNECTIONS})`);
+                return deny();
+            }
+            activeConnections++;
             const conn = new Client();
+            let released = false;
+            // Free the slot exactly once, whenever this SSH connection closes.
+            const release = () => {
+                if (released)
+                    return;
+                released = true;
+                activeConnections--;
+            };
+            conn.on('close', release);
+            let clientSocket = null;
+            const teardown = () => {
+                if (clientSocket)
+                    clientSocket.destroy();
+                conn.end();
+            };
             conn.on('ready', () => {
                 conn.forwardOut(info.srcAddr, info.srcPort, info.dstAddr, info.dstPort, (err, stream) => {
                     if (err) {
                         conn.end();
                         return deny();
                     }
-                    const clientSocket = accept(true);
-                    if (clientSocket) {
-                        stream.pipe(clientSocket).pipe(stream).on('close', () => {
-                            conn.end();
-                        });
+                    // Guard the forwardOut stream against an unhandled 'error' before the
+                    // accept() null-check below: if accept() returns null we abandon this
+                    // stream (conn.end() emits 'close', not 'error'), but a late error on
+                    // the orphaned stream would otherwise go unhandled and crash the CLI.
+                    stream.on('error', teardown);
+                    clientSocket = accept();
+                    if (!clientSocket) {
+                        conn.end();
+                        return;
                     }
-                    else
+                    // Tear the tunnel down if either side errors, rather than letting an
+                    // unhandled 'error' event crash the CLI.
+                    clientSocket.on('error', teardown);
+                    stream.pipe(clientSocket).pipe(stream).on('close', () => {
                         conn.end();
+                    });
                 });
             }).on('error', () => {
-                deny();
+                // Before accept, reject the SOCKS request. After, the tunnel is live, so
+                // tear it down instead of injecting a late SOCKS reply into the stream.
+                if (clientSocket)
+                    teardown();
+                else
+                    deny();
             }).connect({
                 ...this._connectionDefaults(proxyKey),
                 host: addonHost,
                 privateKey,
                 username: dynoUser,
             });
+        }).on('error', (err) => {
+            this._reportProxyBindError(err, socksPort);
         }).listen(socksPort, '127.0.0.1', () => {
-            console.log(`SOCKSv5 proxy server started on port ${color.info(socksPort.toString())}`);
+            ux.stdout(`SOCKSv5 proxy server started on port ${color.info(socksPort.toString())}`);
             if (callback)
                 callback(socksPort);
-        }).useAuth(socks.auth.None()); // eslint-disable-line new-cap
+        });
     }
     async ssh(context, addonHost, dynoUser, privateKey, proxyKey) {
         sshDebug('[cli-ssh] native');
@@ -218,11 +263,22 @@ export class HerokuSsh {
         return {
             hostHash: 'sha256',
             hostVerifier(hashedKey) {
+                // proxyKey is the API-provided "ssh-rsa <base64>" host key. If it's
+                // empty or missing the base64 blob, fail closed rather than throwing
+                // out of the verifier on `Buffer.from(undefined, ...)`.
+                const keyBlob = proxyKey?.split(' ')[1];
+                if (!keyBlob) {
+                    sshDebug('proxy public key is missing or malformed; refusing host key');
+                    return false;
+                }
                 const hasher = crypto.createHash('sha256');
-                hasher.update(Buffer.from(proxyKey.split(' ')[1], 'base64'));
+                hasher.update(Buffer.from(keyBlob, 'base64'));
                 return hasher.digest('hex') === hashedKey;
             },
             port: 80,
+            // Bound how long a connecting client is held before we give up, so a
+            // stalled SSH endpoint can't pin a paused SOCKS client socket forever.
+            readyTimeout: 20_000,
         };
     }
     _logConnectionError() {
@@ -260,11 +316,38 @@ export class HerokuSsh {
             });
         }
         else {
-            stdin.pipe(new stream.Transform({
-                flush: done => c.write('\u0004', done),
-                objectMode: true,
-                transform: (chunk, _, next) => c.write(chunk, next),
-            }));
+            stdin.pipe(this._stdinToRemote(c));
         }
     }
+    // A SOCKS-server bind failure fires asynchronously, outside run()'s
+    // error-handling chain, so throwing here (ux.error) would surface as an
+    // unhandled crash with a raw stack trace. Route it through oclif's handler so
+    // it prints cleanly and exits non-zero. (Extracted as a seam so tests can stub
+    // it — Errors.handle exits the process and can't be stubbed as an ESM export.)
+    _reportProxyBindError(err, socksPort) {
+        const detail = err.code === 'EADDRINUSE'
+            ? `port ${socksPort} is already in use — stop the process using it and try again`
+            : err.message;
+        Errors.handle(new Errors.CLIError(`Could not start the SOCKS proxy server: ${detail}`, { exit: 1 }));
+    }
+    // Bridges piped stdin to the remote exec stream, appending an EOF (^D) when
+    // stdin ends. For a non-interactive command the remote stream (`c`) closes as
+    // soon as the command exits — which can happen before stdin reaches EOF — so
+    // every write is guarded on `c.writable` (don't write the trailing EOF to an
+    // already-ended stream) and a late write-after-end is swallowed as the
+    // teardown race it is, rather than surfacing as an unhandled error that
+    // crashes the CLI.
+    _stdinToRemote(c) {
+        const transform = new stream.Transform({
+            // Pass the stream callbacks straight through so a genuine write error
+            // reaches the 'error' handler below instead of being silently dropped.
+            flush: done => (c.writable ? c.write('\u0004', done) : done()),
+            transform: (chunk, _, next) => (c.writable ? c.write(chunk, next) : next()),
+        });
+        transform.on('error', (error) => {
+            if (error.code !== 'ERR_STREAM_WRITE_AFTER_END')
+                sshDebug(error);
+        });
+        return transform;
+    }
 }

package/oclif.manifest.json

@@ -21161,5 +21161,5 @@
       ]
     }
   },
-  "version": "11.10.0"
+  "version": "11.10.1-beta.0"
 }

package/package.json

@@ -1,20 +1,19 @@
 {
   "name": "heroku",
   "description": "CLI to interact with Heroku",
-  "version": "11.10.0",
+  "version": "11.10.1-beta.0",
   "author": "Heroku",
   "bin": "./bin/run.js",
   "bugs": "https://github.com/heroku/cli/issues",
   "dependencies": {
-    "@heroku-cli/command": "^13.0.0",
-    "@heroku-cli/notifications": "^1.2.6",
+    "@heroku-cli/command": "^13.2.0",
+    "@heroku-cli/notifications": "^1.2.9",
     "@heroku-cli/schema": "^1.0.25",
     "@heroku/buildpack-registry": "^1.0.1",
     "@heroku/heroku-cli-util": "^10.10.0",
     "@heroku/http-call": "^5.5.1",
     "@heroku/mcp-server": "^1.2.5",
-    "@heroku/socksv5": "^0.0.9",
-    "@inquirer/prompts": "^7.0",
+    "@inquirer/prompts": "^8.7",
     "@oclif/core": "^4.8.4",
     "@oclif/plugin-commands": "^4.1.40",
     "@oclif/plugin-help": "^6.2.37",
@@ -29,10 +28,10 @@
     "@opentelemetry/api": "^1.9.0",
     "@opentelemetry/exporter-trace-otlp-http": "^0.52.1",
     "@opentelemetry/instrumentation": "^0.52.1",
-    "@opentelemetry/resources": "^1.25.1",
-    "@opentelemetry/sdk-trace-base": "^1.25.1",
-    "@opentelemetry/sdk-trace-node": "^1.25.1",
-    "@opentelemetry/semantic-conventions": "^1.25.1",
+    "@opentelemetry/resources": "^1.30.1",
+    "@opentelemetry/sdk-trace-base": "^1.30.1",
+    "@opentelemetry/sdk-trace-node": "^1.30.1",
+    "@opentelemetry/semantic-conventions": "^1.30.1",
     "@sentry/node": "^10.27",
     "@sentry/opentelemetry": "^10.27.0",
     "@types/js-yaml": "^3.12.5",
@@ -42,14 +41,14 @@
     "chrono-node": "^2.7.6",
     "cli-progress": "^3.12.0",
     "commander": "^2.15.1",
-    "date-fns": "^2.30.0",
+    "date-fns": "^4.4.0",
     "debug": "^4.4.3",
     "eventsource": "^4",
     "execa": "^9.6.1",
     "filesize": "^10.1",
     "fs-extra": "^11.3.0",
     "glob": "^13.0.2",
-    "got": "^13.0.0",
+    "got": "^14.0.0",
     "https-proxy-agent": "^7.0.6",
     "inquirer": "^8.2.6",
     "keypair": "^1.0.4",
@@ -66,6 +65,7 @@
     "printf": "0.6.1",
     "redis-parser": "^3.0.0",
     "shell-quote": "^1.8.1",
+    "socks": "^2.8.8",
     "ssh2": "^1.16.0",
     "strftime": "^0.10.0",
     "term-img": "^7.1.0",
@@ -78,7 +78,7 @@
     "word-wrap": "^1.2.5",
     "ws": "^6.2.2",
     "yaml": "^2.0.1",
-    "yargs-parser": "18.1.3"
+    "yargs-parser": "22.0.0"
   },
   "devDependencies": {
     "@actions/core": "^3.0.0",
@@ -374,7 +374,6 @@
     "node-notifier": {
       "uuid": "^11.1.1"
     },
-    "socks": "^2.8.8",
     "express-rate-limit": "^8.5.1"
   },
   "repository": "heroku/cli",