securewithtrace 0.11.0 → 0.12.0

package/README.md

@@ -53,6 +53,7 @@ tracecli vulnerabilities list --severity HIGH
 
 - **Authenticate securely** with device authorization flow (`auth login/logout/status`)
 - **List and filter repositories** connected to your Trace organization (`repo list`, `repo filter`)
+- **Find repositories by dependency** with optional version filtering (`repo list --dependency`)
 - **Clone repositories** with secure token handling (`repo clone`)
 - **Filter vulnerabilities** by repo, severity, and status (`vulnerabilities list`)
 - **Export results as JSON or TSV** for automation (`vulnerabilities list --output json`)
@@ -82,6 +83,18 @@ tracecli repo list --filter "platform=GITHUB" --filter "repo:trace" --filter "st
 # Alias command for filtering
 tracecli repo filter --filter "language:typescript" --filter "branch=main"
 
+# Find repositories that use a specific dependency
+tracecli repo list --dependency lodash
+
+# Filter by dependency at a specific version
+tracecli repo list --dependency lodash@4.17.21
+
+# Filter by scoped package with partial version match
+tracecli repo list --dependency @types/node@20
+
+# Dependency results as JSON
+tracecli repo list --dependency react --json | jq '.[].fullName'
+
 # Clone by owner/repo shorthand
 tracecli repo clone securewithtrace/trace
 
@@ -136,6 +149,7 @@ Repository filter options:
 - `--filter`: repeatable advanced expression in the form `<field><operator><value>`
   - Supported fields: `platform`, `status`, `url`, `repo`, `branch`, `language`
   - Supported operators: `=` (exact), `!=` (not exact), `:` (contains), `!:` (not contains)
+- `--dependency`: filter by dependency name with optional `@version` (e.g. `lodash`, `lodash@4.17`, `@types/node@20`)
 
 ### Pentests
 

package/dist/index.js

@@ -25748,6 +25748,19 @@ function validateBranchName(branch) {
   }
   return branch;
 }
+function parseDependencyFilter(filter) {
+  const isScoped = filter.startsWith("@");
+  const separatorIndex = isScoped ? filter.indexOf("@", 1) : filter.indexOf("@");
+  if (separatorIndex === -1) {
+    return { name: filter };
+  }
+  const name = filter.slice(0, separatorIndex);
+  const version2 = filter.slice(separatorIndex + 1);
+  if (!name || !version2) {
+    return { name: filter };
+  }
+  return { name, version: version2 };
+}
 function parseCloneDepth(value) {
   const depth = Number.parseInt(value, 10);
   if (!Number.isInteger(depth) || depth < 1) {
@@ -25958,11 +25971,18 @@ function addRepositoryFilterOptions(command) {
     "Advanced filter expression. Repeatable. Examples: platform=GITHUB, repo:trace, status!=DISCONNECTED, language!:typescript",
     collectFilterExpression,
     []
-  ).option("--json", "Output as JSON");
+  ).option("--json", "Output as JSON").option(
+    "--dependency <pkg>",
+    "Filter repositories that use a dependency (e.g. lodash, lodash@4.17.21, @types/node@20)"
+  );
 }
 async function runRepositoryListCommand(options) {
-  let filteredRepositories;
   const organizationId = await resolveOrganizationId();
+  if (options.dependency) {
+    await runDependencyFilter(organizationId, options);
+    return;
+  }
+  let filteredRepositories;
   const result = await authenticatedRequest(
     (client) => client.repository.listRepositories({
       params: { organizationId }
@@ -25998,6 +26018,59 @@ async function runRepositoryListCommand(options) {
     console.log(`${url2}  (${platform}, ${status})`);
   }
 }
+async function runDependencyFilter(organizationId, options) {
+  const { name, version: version2 } = parseDependencyFilter(options.dependency);
+  const result = await authenticatedRequest(
+    (client) => client.dependency.searchDependencies({
+      params: { organizationId },
+      body: {
+        query: name,
+        ...version2 ? { versionPrefix: version2 } : {},
+        pageSize: 100
+      }
+    })
+  );
+  if (result.status !== 200) {
+    console.error(`Failed to search dependencies (status ${result.status}).`);
+    process.exit(1);
+  }
+  const repoMap = /* @__PURE__ */ new Map();
+  for (const pkg of result.body.packages) {
+    if (pkg.name.toLowerCase() !== name.toLowerCase()) {
+      continue;
+    }
+    for (const repo of pkg.repositories) {
+      const existing = repoMap.get(repo.repositoryId);
+      const versionStrings = repo.versions.map((v) => v.version);
+      if (existing) {
+        for (const v of versionStrings) {
+          if (!existing.versions.includes(v)) {
+            existing.versions.push(v);
+          }
+        }
+      } else {
+        repoMap.set(repo.repositoryId, {
+          fullName: repo.fullName,
+          versions: versionStrings
+        });
+      }
+    }
+  }
+  const repos = Array.from(repoMap.values());
+  if (repos.length === 0) {
+    const label = version2 ? `${name}@${version2}` : name;
+    console.log(`No repositories found using dependency '${label}'.`);
+    return;
+  }
+  if (options.json) {
+    console.log(JSON.stringify(repos, null, 2));
+    return;
+  }
+  for (const repo of repos) {
+    const versions = repo.versions.join(", ");
+    console.log(`${repo.fullName}  (${versions})`);
+  }
+}
 function createListCommand2() {
   return addRepositoryFilterOptions(
     new Command("list").description("List repositories in your organization")

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "securewithtrace",
-  "version": "0.11.0",
+  "version": "0.12.0",
   "description": "Official Trace CLI for vulnerability intelligence in your terminal",
   "type": "module",
   "bin": {