socket 0.14.16 → 0.14.18

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts","../src/utils/formatting.ts","../src/utils/sorts.ts","../src/flags.ts","../src/utils/meow-with-subcommands.ts","../src/commands/cdxgen.ts","../src/utils/api-helpers.ts","../src/utils/format-issues.ts","../src/commands/info.ts","../src/commands/login.ts","../src/commands/logout.ts","../src/commands/npm.ts","../src/commands/npx.ts","../src/utils/fs.ts","../src/utils/json.ts","../src/utils/strings.ts","../src/utils/package-manager-detector.ts","../src/utils/arrays.ts","../src/utils/promises.ts","../src/utils/regexps.ts","../src/commands/optimize.ts","../src/commands/organization.ts","../src/commands/raw-npm.ts","../src/commands/raw-npx.ts","../src/commands/report/view.ts","../src/commands/report/create.ts","../src/commands/report/index.ts","../src/commands/wrapper.ts","../src/commands/scan/create.ts","../src/commands/scan/delete.ts","../src/commands/scan/list.ts","../src/commands/scan/metadata.ts","../src/commands/scan/stream.ts","../src/commands/scan/index.ts","../src/commands/audit-log.ts","../src/commands/repos/create.ts","../src/commands/repos/delete.ts","../src/commands/repos/list.ts","../src/commands/repos/update.ts","../src/commands/repos/view.ts","../src/commands/repos/index.ts","../src/commands/dependencies.ts","../src/commands/analytics.ts","../src/commands/diff-scan/get.ts","../src/commands/diff-scan/index.ts","../src/commands/threat-feed.ts","../src/commands/index.ts"],"names":[],"mappings":""}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts","../src/utils/formatting.ts","../src/utils/sorts.ts","../src/flags.ts","../src/utils/meow-with-subcommands.ts","../src/commands/cdxgen.ts","../src/utils/api-helpers.ts","../src/utils/format-issues.ts","../src/commands/info.ts","../src/commands/login.ts","../src/commands/logout.ts","../src/commands/npm.ts","../src/commands/npx.ts","../src/utils/fs.ts","../src/utils/strings.ts","../src/utils/package-manager-detector.ts","../src/utils/arrays.ts","../src/utils/promises.ts","../src/utils/regexps.ts","../src/commands/optimize.ts","../src/commands/organization.ts","../src/commands/raw-npm.ts","../src/commands/raw-npx.ts","../src/commands/report/view.ts","../src/commands/report/create.ts","../src/commands/report/index.ts","../src/commands/wrapper.ts","../src/commands/scan/create.ts","../src/commands/scan/delete.ts","../src/commands/scan/list.ts","../src/commands/scan/metadata.ts","../src/commands/scan/stream.ts","../src/commands/scan/index.ts","../src/commands/audit-log.ts","../src/commands/repos/create.ts","../src/commands/repos/delete.ts","../src/commands/repos/list.ts","../src/commands/repos/update.ts","../src/commands/repos/view.ts","../src/commands/repos/index.ts","../src/commands/dependencies.ts","../src/commands/analytics.ts","../src/commands/diff-scan/get.ts","../src/commands/diff-scan/index.ts","../src/commands/threat-feed.ts","../src/commands/index.ts"],"names":[],"mappings":""}

package/dist/cli.js

@@ -4,31 +4,33 @@
 var vendor = require('./vendor.js');
 var require$$0 = require('node:fs');
 var require$$1 = require('node:path');
-var require$$2$5 = require('node:url');
+var require$$2$6 = require('node:url');
 var require$$6 = require('pony-cause');
 var require$$1$1 = require('@npmcli/promise-spawn');
 var require$$5 = require('yargs-parser');
 var sdk = require('./sdk.js');
 var require$$1$2 = require('@inquirer/prompts');
-var require$$3$2 = require('@npmcli/package-json');
-var require$$4 = require('@socketsecurity/registry');
-var require$$6$1 = require('npm-package-arg');
-var require$$8 = require('pacote');
-var require$$3$1 = require('semver');
-var require$$1$3 = require('@socketregistry/hyrious__bun.lockb');
-var require$$3 = require('browserslist');
-var require$$5$1 = require('which');
-var require$$2 = require('@apideck/better-ajv-errors');
-var require$$3$3 = require('@socketsecurity/config');
+var require$$1$4 = require('node:fs/promises');
+var require$$1$3 = require('@npmcli/package-json');
+var require$$5$1 = require('@socketsecurity/registry');
+var require$$7 = require('npm-package-arg');
+var require$$9 = require('pacote');
+var require$$3 = require('semver');
+var require$$11 = require('tinyglobby');
+var require$$12 = require('yaml');
+var require$$2 = require('@socketregistry/hyrious__bun.lockb');
+var require$$4 = require('browserslist');
+var require$$6$1 = require('which');
+var require$$2$1 = require('@apideck/better-ajv-errors');
+var require$$3$1 = require('@socketsecurity/config');
 var pathResolve = require('./path-resolve.js');
-var require$$2$1 = require('node:os');
-var require$$3$4 = require('node:readline');
+var require$$2$2 = require('node:os');
+var require$$3$2 = require('node:readline');
 var require$$0$1 = require('node:process');
-var require$$2$2 = require('node:readline/promises');
-var require$$2$3 = require('chalk-table');
-var require$$1$4 = require('node:fs/promises');
-var require$$2$4 = require('blessed');
-var require$$3$5 = require('blessed-contrib');
+var require$$2$3 = require('node:readline/promises');
+var require$$2$4 = require('chalk-table');
+var require$$2$5 = require('blessed');
+var require$$3$3 = require('blessed-contrib');
 var require$$0$2 = require('node:util');
 
 var cli$1 = {};
@@ -163,7 +165,6 @@ cdxgen.cdxgen = {
   description: 'Create an SBOM with CycloneDX generator (cdxgen)',
   async run(argv_) {
     const yargv = {
-      __proto__: null,
       ..._yargsParser(argv_, yargsConfig)
     };
     const unknown = yargv._;
@@ -330,7 +331,7 @@ Object.defineProperty(formatIssues, "__esModule", {
 formatIssues.formatSeverityCount = formatSeverityCount;
 formatIssues.getSeverityCount = getSeverityCount;
 var _misc$2 = sdk.misc;
-var _objects$4 = sdk.objects;
+var _objects$3 = sdk.objects;
 const SEVERITIES_BY_ORDER = ['critical', 'high', 'middle', 'low'];
 function getDesiredSeverities(lowestToInclude) {
   const result = [];
@@ -352,7 +353,7 @@ function formatSeverityCount(severityCount) {
   return (0, _misc$2.stringJoinWithSeparateFinalSeparator)(summary);
 }
 function getSeverityCount(issues, lowestToInclude) {
-  const severityCount = (0, _objects$4.pick)({
+  const severityCount = (0, _objects$3.pick)({
     low: 0,
     middle: 0,
     high: 0,
@@ -416,7 +417,7 @@ var _chalkMarkdown$3 = sdk.chalkMarkdown;
 var _errors$k = sdk.errors;
 var _formatIssues$1 = formatIssues;
 var _formatting$m = formatting;
-var _objects$3 = sdk.objects;
+var _objects$2 = sdk.objects;
 var _sdk$j = sdk.sdk;
 const info = info$1.info = {
   description: 'Look up info regarding a package',
@@ -443,7 +444,6 @@ const info = info$1.info = {
 
 function setupCommand$m(name, description, argv, importMeta) {
   const flags = {
-    __proto__: null,
     ..._flags$k.commonFlags,
     ..._flags$k.outputFlags,
     ..._flags$k.validationFlags
@@ -533,7 +533,7 @@ function formatPackageDataOutput({
       License: Math.floor(score.license.score * 100)
     };
     Object.entries(scoreResult).map(score => console.log(`- ${score[0]}: ${formatScore(score[1])}`));
-    if ((0, _objects$3.objectSome)(severityCount)) {
+    if ((0, _objects$2.objectSome)(severityCount)) {
       const issueSummary = (0, _formatIssues$1.formatSeverityCount)(severityCount);
       console.log('\n');
       spinner[strict ? 'fail' : 'succeed'](`Package has these issues: ${issueSummary}`);
@@ -557,7 +557,7 @@ function formatPackageDataOutput({
       console.log(_chalk$h.default.dim('\nOr rerun', _chalk$h.default.italic(name), 'using the', _chalk$h.default.italic('--json'), 'flag to get full JSON output'));
     }
   }
-  if (strict && (0, _objects$3.objectSome)(severityCount)) {
+  if (strict && (0, _objects$2.objectSome)(severityCount)) {
     process.exit(1);
   }
 }
@@ -835,8 +835,6 @@ npx.npx = {
 
 var optimize$1 = {};
 
-var packageManagerDetector = {};
-
 var fs = {};
 
 Object.defineProperty(fs, "__esModule", {
@@ -890,22 +888,7 @@ async function readFileUtf8(filepath, options) {
   });
 }
 
-var json = {};
-
-Object.defineProperty(json, "__esModule", {
-  value: true
-});
-json.parseJSONObject = parseJSONObject;
-var _objects$2 = sdk.objects;
-function parseJSONObject(jsonStr) {
-  try {
-    const value = JSON.parse(jsonStr);
-    if ((0, _objects$2.isObjectObject)(value)) {
-      return value;
-    }
-  } catch {}
-  return null;
-}
+var packageManagerDetector = {};
 
 var strings = {};
 
@@ -923,13 +906,13 @@ Object.defineProperty(packageManagerDetector, "__esModule", {
 packageManagerDetector.AGENTS = void 0;
 packageManagerDetector.detect = detect;
 var _nodePath$3 = require$$1;
-var _hyrious__bun = require$$1$3;
+var _packageJson$1 = require$$1$3;
+var _hyrious__bun = require$$2;
 var _promiseSpawn$3 = require$$1$1;
-var _browserslist = require$$3;
-var _semver$1 = require$$3$1;
-var _which = require$$5$1;
-var _fs = fs;
-var _json = json;
+var _browserslist = require$$4;
+var _semver$1 = require$$3;
+var _which = require$$6$1;
+var _fs$1 = fs;
 var _objects$1 = sdk.objects;
 var _strings$1 = strings;
 const AGENTS = packageManagerDetector.AGENTS = ['bun', 'npm', 'pnpm', 'yarn'];
@@ -983,7 +966,6 @@ const LOCKS = {
   // it has to be handled differently.
   'node_modules/.package-lock.json': 'npm'
 };
-const PNPM_WORKSPACE = 'pnpm-workspace';
 const readLockFileByAgent = (() => {
   function wrapReader(reader) {
     return async (lockPath, agentExecPath) => {
@@ -997,7 +979,7 @@ const readLockFileByAgent = (() => {
     bun: wrapReader(async (lockPath, agentExecPath) => {
       let lockBuffer;
       try {
-        lockBuffer = await (0, _fs.readFileBinary)(lockPath);
+        lockBuffer = await (0, _fs$1.readFileBinary)(lockPath);
       } catch {
         return undefined;
       }
@@ -1008,27 +990,27 @@ const readLockFileByAgent = (() => {
       // https://bun.sh/guides/install/yarnlock
       return (await _promiseSpawn$3(agentExecPath, [lockPath])).stdout;
     }),
-    npm: wrapReader(async lockPath => await (0, _fs.readFileUtf8)(lockPath)),
-    pnpm: wrapReader(async lockPath => await (0, _fs.readFileUtf8)(lockPath)),
-    yarn: wrapReader(async lockPath => await (0, _fs.readFileUtf8)(lockPath))
+    npm: wrapReader(async lockPath => await (0, _fs$1.readFileUtf8)(lockPath)),
+    pnpm: wrapReader(async lockPath => await (0, _fs$1.readFileUtf8)(lockPath)),
+    yarn: wrapReader(async lockPath => await (0, _fs$1.readFileUtf8)(lockPath))
   };
 })();
 async function detect({
   cwd = process.cwd(),
   onUnknown
 } = {}) {
-  let lockPath = await (0, _fs.findUp)(Object.keys(LOCKS), {
+  let lockPath = await (0, _fs$1.findUp)(Object.keys(LOCKS), {
     cwd
   });
   const isHiddenLockFile = lockPath?.endsWith('.package-lock.json') ?? false;
-  const pkgJsonPath = lockPath ? _nodePath$3.resolve(lockPath, `${isHiddenLockFile ? '../' : ''}../package.json`) : await (0, _fs.findUp)('package.json', {
+  const pkgJsonPath = lockPath ? _nodePath$3.resolve(lockPath, `${isHiddenLockFile ? '../' : ''}../package.json`) : await (0, _fs$1.findUp)('package.json', {
     cwd
   });
+  const pkgPath = (0, _fs$1.existsSync)(pkgJsonPath) ? _nodePath$3.dirname(pkgJsonPath) : undefined;
+  const pkgJson = pkgPath ? await _packageJson$1.load(pkgPath) : undefined;
   // Read Corepack `packageManager` field in package.json:
   // https://nodejs.org/api/packages.html#packagemanager
-  const pkgJsonStr = (0, _fs.existsSync)(pkgJsonPath) ? await (0, _fs.readFileUtf8)(pkgJsonPath) : undefined;
-  const pkgJson = typeof pkgJsonStr === 'string' ? (0, _json.parseJSONObject)(pkgJsonStr) ?? undefined : undefined;
-  const pkgManager = (0, _strings$1.isNonEmptyString)(pkgJson?.['packageManager']) ? pkgJson['packageManager'] : undefined;
+  const pkgManager = (0, _strings$1.isNonEmptyString)(pkgJson?.content?.packageManager) ? pkgJson.content.packageManager : undefined;
   let agent;
   let agentVersion;
   if (pkgManager) {
@@ -1057,25 +1039,20 @@ async function detect({
     node: true
   };
   let lockSrc;
-  let isPrivate = false;
-  let isWorkspace = false;
   let minimumNodeVersion = maintainedNodeVersions.previous;
   if (pkgJson) {
-    const pkgPath = _nodePath$3.dirname(pkgJsonPath);
-    isPrivate = !!pkgJson['private'];
-    isWorkspace = !!pkgJson['workspaces'] || (0, _fs.existsSync)(_nodePath$3.join(pkgPath, `${PNPM_WORKSPACE}.yaml`)) || (0, _fs.existsSync)(_nodePath$3.join(pkgPath, `${PNPM_WORKSPACE}.yml`));
-    const browserField = pkgJson['browser'];
+    const browserField = pkgJson.content.browser;
     if ((0, _strings$1.isNonEmptyString)(browserField) || (0, _objects$1.isObjectObject)(browserField)) {
       targets.browser = true;
     }
-    const nodeRange = pkgJson['engines']?.['node'];
+    const nodeRange = pkgJson.content.engines?.['node'];
     if ((0, _strings$1.isNonEmptyString)(nodeRange)) {
       const coerced = _semver$1.coerce(nodeRange);
       if (coerced && _semver$1.lt(coerced, minimumNodeVersion)) {
         minimumNodeVersion = coerced.version;
       }
     }
-    const browserslistQuery = pkgJson['browserslist'];
+    const browserslistQuery = pkgJson.content['browserslist'];
     if (Array.isArray(browserslistQuery)) {
       const browserslistTargets = _browserslist(browserslistQuery).map(s => s.toLowerCase()).toSorted(alphaNumericComparator);
       const browserslistNodeTargets = browserslistTargets.filter(v => v.startsWith('node ')).map(v => v.slice(5 /*'node '.length*/));
@@ -1098,14 +1075,11 @@ async function detect({
     agent,
     agentExecPath,
     agentVersion,
-    isPrivate,
-    isWorkspace,
     lockPath,
     lockSrc,
     minimumNodeVersion,
     pkgJson,
-    pkgJsonPath,
-    pkgJsonStr,
+    pkgPath,
     supported: targets.browser || targets.node,
     targets
   };
@@ -1198,27 +1172,32 @@ Object.defineProperty(optimize$1, "__esModule", {
   value: true
 });
 optimize$1.optimize = void 0;
+var _promises$2 = require$$1$4;
 var _nodePath$2 = require$$1;
 var _promiseSpawn$2 = require$$1$1;
-var _packageJson = require$$3$2;
-var _registry = require$$4;
+var _packageJson = require$$1$3;
+var _registry = require$$5$1;
 var _meow$m = _interopRequireDefault$n(vendor.build);
-var _npmPackageArg = require$$6$1;
+var _npmPackageArg = require$$7;
 var _ora$i = _interopRequireDefault$n(vendor.ora);
-var _pacote = require$$8;
-var _semver = require$$3$1;
+var _pacote = require$$9;
+var _semver = require$$3;
+var _tinyglobby = require$$11;
+var _yaml = require$$12;
 var _flags$j = flags$1;
 var _formatting$k = formatting;
+var _fs = fs;
 var _objects = sdk.objects;
 var _packageManagerDetector = packageManagerDetector;
-var _promises$2 = promises;
+var _promises2 = promises;
 var _regexps = regexps;
 var _sorts$1 = sorts;
 var _strings = strings;
-const distPath$1 = __dirname;
 const COMMAND_TITLE = 'Socket Optimize';
 const OVERRIDES_FIELD_NAME = 'overrides';
+const PNPM_WORKSPACE = 'pnpm-workspace';
 const RESOLUTIONS_FIELD_NAME = 'resolutions';
+const distPath$1 = __dirname;
 const manifestNpmOverrides = (0, _registry.getManifestData)('npm');
 const packumentCache = new Map();
 const getOverridesDataByAgent = {
@@ -1278,47 +1257,33 @@ const lockIncludesByAgent = {
   }
 };
 const updateManifestByAgent = {
-  __proto__: null,
-  npm(editablePkgJson, overrides) {
-    editablePkgJson.update({
-      __proto__: null,
+  npm(pkgJson, overrides) {
+    pkgJson.update({
       [OVERRIDES_FIELD_NAME]: overrides
     });
   },
-  pnpm(editablePkgJson, overrides) {
-    editablePkgJson.update({
+  pnpm(pkgJson, overrides) {
+    pkgJson.update({
       pnpm: {
-        __proto__: null,
-        ...editablePkgJson.content['pnpm'],
+        ...pkgJson.content['pnpm'],
         [OVERRIDES_FIELD_NAME]: overrides
       }
     });
   },
-  yarn(editablePkgJson, overrides) {
-    editablePkgJson.update({
-      __proto__: null,
+  yarn(pkgJson, overrides) {
+    pkgJson.update({
       [RESOLUTIONS_FIELD_NAME]: overrides
     });
   }
 };
-async function addOverrides({
-  agent,
-  isPrivate,
-  isWorkspace,
-  lockSrc,
-  lockIncludes,
-  manifestEntries,
-  pkgJsonPath,
-  pin
-}, state) {
-  const editablePkgJson = await _packageJson.load(_nodePath$2.dirname(pkgJsonPath));
+function getDependencyEntries(pkgJson) {
   const {
     dependencies,
     devDependencies,
-    peerDependencies,
-    optionalDependencies
-  } = editablePkgJson.content;
-  const depEntries = [['dependencies', dependencies ? {
+    optionalDependencies,
+    peerDependencies
+  } = pkgJson;
+  return [['dependencies', dependencies ? {
     __proto__: null,
     ...dependencies
   } : undefined], ['devDependencies', devDependencies ? {
@@ -1333,16 +1298,71 @@ async function addOverrides({
   } : undefined]].filter(({
     1: o
   }) => o);
+}
+async function getWorkspaces(agent, pkgPath, pkgJson) {
+  if (agent !== 'pnpm') {
+    return Array.isArray(pkgJson['workspaces']) ? pkgJson['workspaces'].filter(_strings.isNonEmptyString) : undefined;
+  }
+  for (const workspacePath of [_nodePath$2.join(pkgPath, `${PNPM_WORKSPACE}.yaml`), _nodePath$2.join(pkgPath, `${PNPM_WORKSPACE}.yml`)]) {
+    if ((0, _fs.existsSync)(workspacePath)) {
+      let packages;
+      try {
+        // eslint-disable-next-line no-await-in-loop
+        packages = (0, _yaml.parse)(await _promises$2.readFile(workspacePath, 'utf8'))?.packages;
+      } catch {}
+      if (Array.isArray(packages)) {
+        return packages.filter(_strings.isNonEmptyString);
+      }
+    }
+  }
+  return undefined;
+}
+function workspaceToGlobPattern(workspace) {
+  const {
+    length
+  } = workspace;
+  // If the workspace ends with "/"
+  if (workspace.charCodeAt(length - 1) === 47 /*'/'*/) {
+    return `${workspace}/*/package.json`;
+  }
+  // If the workspace ends with "/**"
+  if (workspace.charCodeAt(length - 1) === 42 /*'*'*/ && workspace.charCodeAt(length - 2) === 42 /*'*'*/ && workspace.charCodeAt(length - 3) === 47 /*'/'*/) {
+    return `${workspace}/*/**/package.json`;
+  }
+  // Things like "packages/a" or "packages/*"
+  return `${workspace}/package.json`;
+}
+async function addOverrides({
+  agent,
+  lockIncludes,
+  lockSrc,
+  manifestEntries,
+  pkgJson: editablePkgJson,
+  pkgPath,
+  pin,
+  rootPath
+}, state = {
+  added: new Set(),
+  updated: new Set()
+}) {
+  if (editablePkgJson === undefined) {
+    editablePkgJson = await _packageJson.load(pkgPath);
+  }
+  const pkgJson = editablePkgJson.content;
+  const isRoot = pkgPath === rootPath;
+  const depEntries = getDependencyEntries(pkgJson);
+  const workspaces = await getWorkspaces(agent, pkgPath, pkgJson);
+  const isWorkspace = !!workspaces;
   const overridesDataObjects = [];
-  if (isPrivate || isWorkspace) {
-    overridesDataObjects.push(getOverridesDataByAgent[agent](editablePkgJson.content));
+  if (pkgJson['private'] || isWorkspace) {
+    overridesDataObjects.push(getOverridesDataByAgent[agent](pkgJson));
   } else {
-    overridesDataObjects.push(getOverridesDataByAgent['npm'](editablePkgJson.content), getOverridesDataByAgent['yarn'](editablePkgJson.content));
+    overridesDataObjects.push(getOverridesDataByAgent['npm'](pkgJson), getOverridesDataByAgent['yarn'](pkgJson));
   }
+  const spinner = isRoot ? (0, _ora$i.default)('Fetching override manifests...').start() : undefined;
   const depAliasMap = new Map();
-  const spinner = (0, _ora$i.default)(`Fetching override manifests...`).start();
   // Chunk package names to process them in parallel 3 at a time.
-  await (0, _promises$2.pEach)(manifestEntries, 3, async ({
+  await (0, _promises2.pEach)(manifestEntries, 3, async ({
     1: data
   }) => {
     const {
@@ -1350,6 +1370,7 @@ async function addOverrides({
       package: origPkgName,
       version
     } = data;
+    const major = _semver.major(version);
     for (const {
       1: depObj
     } of depEntries) {
@@ -1373,24 +1394,37 @@ async function addOverrides({
         });
       }
     }
+    if (!isRoot) {
+      return;
+    }
     // Chunk package names to process them in parallel 3 at a time.
-    await (0, _promises$2.pEach)(overridesDataObjects, 3, async ({
+    await (0, _promises2.pEach)(overridesDataObjects, 3, async ({
       overrides,
       type
     }) => {
       const overrideExists = (0, _objects.hasOwn)(overrides, origPkgName);
       if (overrideExists || lockIncludes(lockSrc, origPkgName)) {
-        // With npm one may not set an override for a package that one directly
-        // depends on unless both the dependency and the override itself share
-        // the exact same spec. To make this limitation easier to deal with,
-        // overrides may also be defined as a reference to a spec for a direct
-        // dependency by prefixing the name of the package to match the version
-        // of with a $.
-        // https://docs.npmjs.com/cli/v8/configuring-npm/package-json#overrides
-        const oldSpec = overrides[origPkgName];
+        const oldSpec = overrideExists ? overrides[origPkgName] : undefined;
         const depAlias = depAliasMap.get(origPkgName);
-        const thisVersion = overrideExists && (0, _strings.isNonEmptyString)(oldSpec) ? (await fetchPackageManifest(oldSpec.startsWith('$') ? depAlias?.id ?? oldSpec : oldSpec))?.version ?? version : version;
-        const newSpec = depAlias && type === 'npm' ? `$${origPkgName}` : `npm:${regPkgName}@^${pin ? thisVersion : _semver.major(thisVersion)}`;
+        let newSpec = `npm:${regPkgName}@^${pin ? version : major}`;
+        let thisVersion = version;
+        if (depAlias && type === 'npm') {
+          // With npm one may not set an override for a package that one directly
+          // depends on unless both the dependency and the override itself share
+          // the exact same spec. To make this limitation easier to deal with,
+          // overrides may also be defined as a reference to a spec for a direct
+          // dependency by prefixing the name of the package to match the version
+          // of with a $.
+          // https://docs.npmjs.com/cli/v8/configuring-npm/package-json#overrides
+          newSpec = `$${origPkgName}`;
+        } else if (overrideExists && pin) {
+          const thisSpec = oldSpec.startsWith('$') ? depAlias?.id ?? newSpec : oldSpec ?? newSpec;
+          thisVersion = _semver.coerce(_npmPackageArg(thisSpec).rawSpec)?.version ?? version;
+          if (_semver.major(thisVersion) !== major) {
+            thisVersion = (await fetchPackageManifest(thisSpec))?.version ?? version;
+          }
+          newSpec = `npm:${regPkgName}@^${pin ? thisVersion : _semver.major(thisVersion)}`;
+        }
         if (newSpec !== oldSpec) {
           if (overrideExists) {
             state.updated.add(regPkgName);
@@ -1402,7 +1436,34 @@ async function addOverrides({
       }
     });
   });
-  spinner.stop();
+  if (workspaces) {
+    const wsPkgJsonPaths = await (0, _tinyglobby.glob)(workspaces.map(workspaceToGlobPattern), {
+      absolute: true,
+      cwd: pkgPath
+    });
+    // Chunk package names to process them in parallel 3 at a time.
+    await (0, _promises2.pEach)(wsPkgJsonPaths, 3, async wsPkgJsonPath => {
+      const {
+        added,
+        updated
+      } = await addOverrides({
+        agent,
+        lockSrc,
+        lockIncludes,
+        manifestEntries,
+        pin,
+        pkgPath: _nodePath$2.dirname(wsPkgJsonPath),
+        rootPath
+      });
+      for (const regPkgName of added) {
+        state.added.add(regPkgName);
+      }
+      for (const regPkgName of updated) {
+        state.updated.add(regPkgName);
+      }
+    });
+  }
+  spinner?.stop();
   if (state.added.size || state.updated.size) {
     editablePkgJson.update(Object.fromEntries(depEntries));
     for (const {
@@ -1417,7 +1478,6 @@ async function addOverrides({
 }
 async function fetchPackageManifest(pkgNameOrId, options) {
   const pacoteOptions = {
-    __proto__: null,
     ...options,
     packumentCache,
     preferOffline: true
@@ -1453,13 +1513,11 @@ const optimize = optimize$1.optimize = {
     const {
       agent,
       agentExecPath,
-      isPrivate,
-      isWorkspace,
       lockSrc,
       lockPath,
       minimumNodeVersion,
-      pkgJsonPath,
       pkgJson,
+      pkgPath,
       supported
     } = await (0, _packageManagerDetector.detect)({
       cwd,
@@ -1476,7 +1534,7 @@ const optimize = optimize$1.optimize = {
       console.log(`✘ ${COMMAND_TITLE}: No ${lockName} found`);
       return;
     }
-    if (pkgJson === undefined) {
+    if (pkgPath === undefined) {
       console.log(`✘ ${COMMAND_TITLE}: No package.json found`);
       return;
     }
@@ -1494,18 +1552,17 @@ const optimize = optimize$1.optimize = {
         1: data
       }) => _semver.satisfies(_semver.coerce(data.engines.node), nodeRange));
       await addOverrides({
-        __proto__: null,
         agent: agent === 'bun' ? 'yarn' : agent,
-        isPrivate,
-        isWorkspace,
         lockIncludes,
         lockSrc,
         manifestEntries,
         pin,
-        pkgJsonPath
+        pkgJson,
+        pkgPath,
+        rootPath: pkgPath
       }, state);
     }
-    const pkgJsonChanged = state.updated.size > 0 || state.updated.size > 0;
+    const pkgJsonChanged = state.added.size > 0 || state.updated.size > 0;
     if (state.updated.size > 0) {
       console.log(`Updated ${state.updated.size} Socket.dev optimized overrides ${state.added.size ? '.' : '🚀'}`);
     }
@@ -1526,7 +1583,6 @@ const optimize = optimize$1.optimize = {
           await _promiseSpawn$2(process.execPath, [wrapperPath, 'install'], {
             stdio: 'pipe',
             env: {
-              __proto__: null,
               ...process.env,
               UPDATE_SOCKET_OVERRIDES_IN_PACKAGE_LOCK_FILE: '1'
             }
@@ -1552,7 +1608,6 @@ const optimize = optimize$1.optimize = {
 
 function setupCommand$l(name, description, argv, importMeta) {
   const flags = {
-    __proto__: null,
     ..._flags$j.commonFlags,
     pin: {
       type: 'boolean',
@@ -1668,7 +1723,6 @@ const rawNpm = rawNpm$1.rawNpm = {
 };
 async function setupCommand$j(name, description, argv, importMeta) {
   const flags = {
-    __proto__: null,
     ..._flags$i.commonFlags,
     ..._flags$i.validationFlags
   };
@@ -1729,7 +1783,6 @@ const rawNpx = rawNpx$1.rawNpx = {
 };
 async function setupCommand$i(name, description, argv, importMeta) {
   const flags = {
-    __proto__: null,
     ..._flags$h.commonFlags,
     ..._flags$h.validationFlags
   };
@@ -1814,7 +1867,6 @@ const view$2 = view$3.view = {
 
 function setupCommand$h(name, description, argv, importMeta) {
   const flags = {
-    __proto__: null,
     ..._flags$g.commonFlags,
     ..._flags$g.outputFlags,
     ..._flags$g.validationFlags
@@ -1925,8 +1977,8 @@ Object.defineProperty(create$5, "__esModule", {
 });
 create$5.create = void 0;
 var _nodePath$1 = require$$1;
-var _betterAjvErrors = require$$2;
-var _config = require$$3$3;
+var _betterAjvErrors = require$$2$1;
+var _config = require$$3$1;
 var _meow$h = _interopRequireDefault$i(vendor.build);
 var _ora$f = _interopRequireDefault$i(vendor.ora);
 var _ponyCause$2 = require$$6;
@@ -1995,7 +2047,6 @@ const create$4 = create$5.create = {
 
 async function setupCommand$g(name, description, argv, importMeta) {
   const flags = {
-    __proto__: null,
     ..._flags$f.commonFlags,
     ..._flags$f.outputFlags,
     ..._flags$f.validationFlags,
@@ -2183,7 +2234,6 @@ async function meowWithSubcommands(subcommands, options) {
     }
   }
   const flags = {
-    __proto__: null,
     ..._flags$e.commonFlags,
     ...additionalOptions.flags
   };
@@ -2245,8 +2295,8 @@ Object.defineProperty(wrapper$1, "__esModule", {
 });
 wrapper$1.wrapper = void 0;
 var _nodeFs$2 = require$$0;
-var _nodeOs = require$$2$1;
-var _nodeReadline = require$$3$4;
+var _nodeOs = require$$2$2;
+var _nodeReadline = require$$3$2;
 var _meow$f = _interopRequireDefault$g(vendor.build);
 var _flags$d = flags$1;
 var _formatting$e = formatting;
@@ -2406,7 +2456,7 @@ Object.defineProperty(create$3, "__esModule", {
 });
 create$3.create = void 0;
 var _nodeProcess = require$$0$1;
-var _promises$1 = require$$2$2;
+var _promises$1 = require$$2$3;
 var _chalk$e = _interopRequireDefault$f(vendor.source);
 var _meow$e = _interopRequireDefault$f(vendor.build);
 var _open = _interopRequireDefault$f(vendor.open);
@@ -2643,7 +2693,6 @@ const del$1 = _delete$3.del = {
 
 function setupCommand$d(name, description, argv, importMeta) {
   const flags = {
-    __proto__: null,
     ..._flags$c.commonFlags,
     ..._flags$c.outputFlags
   };
@@ -2701,7 +2750,7 @@ Object.defineProperty(list$3, "__esModule", {
 });
 list$3.list = void 0;
 var _chalk$c = _interopRequireDefault$d(vendor.source);
-var _chalkTable$3 = require$$2$3;
+var _chalkTable$3 = require$$2$4;
 var _meow$c = _interopRequireDefault$d(vendor.build);
 var _ora$c = _interopRequireDefault$d(vendor.ora);
 var _flags$b = flags$1;
@@ -2772,7 +2821,6 @@ const listFullScanFlags = {
 
 function setupCommand$c(name, description, argv, importMeta) {
   const flags = {
-    __proto__: null,
     ..._flags$b.commonFlags,
     ...listFullScanFlags,
     ..._flags$b.outputFlags
@@ -2893,7 +2941,6 @@ const metadata = metadata$1.metadata = {
 
 function setupCommand$b(name, description, argv, importMeta) {
   const flags = {
-    __proto__: null,
     ..._flags$a.commonFlags,
     ..._flags$a.outputFlags
   };
@@ -2982,7 +3029,6 @@ const stream = stream$1.stream = {
 
 function setupCommand$a(name, description, argv, importMeta) {
   const flags = {
-    __proto__: null,
     ..._flags$9.commonFlags,
     ..._flags$9.outputFlags
   };
@@ -3123,7 +3169,6 @@ const auditLogFlags = {
 
 function setupCommand$9(name, description, argv, importMeta) {
   const flags = {
-    __proto__: null,
     ...auditLogFlags,
     ..._flags$8.commonFlags,
     ..._flags$8.outputFlags
@@ -3276,7 +3321,6 @@ const repositoryCreationFlags = {
 
 function setupCommand$8(name, description, argv, importMeta) {
   const flags = {
-    __proto__: null,
     ..._flags$7.commonFlags,
     ..._flags$7.outputFlags,
     ...repositoryCreationFlags
@@ -3417,7 +3461,7 @@ Object.defineProperty(list$1, "__esModule", {
 });
 list$1.list = void 0;
 var _chalk$6 = _interopRequireDefault$7(vendor.source);
-var _chalkTable$2 = require$$2$3;
+var _chalkTable$2 = require$$2$4;
 var _meow$6 = _interopRequireDefault$7(vendor.build);
 var _ora$6 = _interopRequireDefault$7(vendor.ora);
 var _flags$6 = flags$1;
@@ -3475,7 +3519,6 @@ const listRepoFlags = {
 
 function setupCommand$6(name, description, argv, importMeta) {
   const flags = {
-    __proto__: null,
     ..._flags$6.commonFlags,
     ...listRepoFlags,
     ..._flags$6.outputFlags
@@ -3616,7 +3659,6 @@ const repositoryUpdateFlags = {
 
 function setupCommand$5(name, description, argv, importMeta) {
   const flags = {
-    __proto__: null,
     ..._flags$5.commonFlags,
     ..._flags$5.outputFlags,
     ...repositoryUpdateFlags
@@ -3682,7 +3724,7 @@ Object.defineProperty(view$1, "__esModule", {
 });
 view$1.view = void 0;
 var _chalk$4 = _interopRequireDefault$5(vendor.source);
-var _chalkTable$1 = require$$2$3;
+var _chalkTable$1 = require$$2$4;
 var _meow$4 = _interopRequireDefault$5(vendor.build);
 var _ora$4 = _interopRequireDefault$5(vendor.ora);
 var _flags$4 = flags$1;
@@ -3715,7 +3757,6 @@ const view = view$1.view = {
 
 function setupCommand$4(name, description, argv, importMeta) {
   const flags = {
-    __proto__: null,
     ..._flags$4.commonFlags,
     ..._flags$4.outputFlags
   };
@@ -3828,7 +3869,7 @@ Object.defineProperty(dependencies$1, "__esModule", {
 });
 dependencies$1.dependencies = void 0;
 var _chalk$3 = _interopRequireDefault$4(vendor.source);
-var _chalkTable = require$$2$3;
+var _chalkTable = require$$2$4;
 var _meow$3 = _interopRequireDefault$4(vendor.build);
 var _ora$3 = _interopRequireDefault$4(vendor.ora);
 var _flags$3 = flags$1;
@@ -3869,7 +3910,6 @@ const dependenciesFlags = {
 
 function setupCommand$3(name, description, argv, importMeta) {
   const flags = {
-    __proto__: null,
     ..._flags$3.commonFlags,
     ...dependenciesFlags,
     ..._flags$3.outputFlags
@@ -3963,8 +4003,8 @@ Object.defineProperty(analytics$1, "__esModule", {
 });
 analytics$1.analytics = void 0;
 var _promises = require$$1$4;
-var _blessed$1 = require$$2$4;
-var _blessedContrib$1 = require$$3$5;
+var _blessed$1 = require$$2$5;
+var _blessedContrib$1 = require$$3$3;
 var _chalk$2 = _interopRequireDefault$3(vendor.source);
 var _meow$2 = _interopRequireDefault$3(vendor.build);
 var _ora$2 = _interopRequireDefault$3(vendor.ora);
@@ -4030,7 +4070,6 @@ const analyticsFlags = {
 
 function setupCommand$2(name, description, argv, importMeta) {
   const flags = {
-    __proto__: null,
     ..._flags$2.commonFlags,
     ..._flags$2.outputFlags,
     ...analyticsFlags
@@ -4343,7 +4382,6 @@ const getDiffScanFlags = {
 
 function setupCommand$1(name, description, argv, importMeta) {
   const flags = {
-    __proto__: null,
     ..._flags$1.commonFlags,
     ...getDiffScanFlags,
     ..._flags$1.outputFlags
@@ -4460,8 +4498,8 @@ Object.defineProperty(threatFeed$1, "__esModule", {
   value: true
 });
 threatFeed$1.threatFeed = void 0;
-var _blessed = require$$2$4;
-var _blessedContrib = require$$3$5;
+var _blessed = require$$2$5;
+var _blessedContrib = require$$3$3;
 var _meow = _interopRequireDefault$1(vendor.build);
 var _ora = _interopRequireDefault$1(vendor.ora);
 var _flags = flags$1;
@@ -4519,7 +4557,6 @@ const threatFeedFlags = {
 
 function setupCommand(name, description, argv, importMeta) {
   const flags = {
-    __proto__: null,
     ..._flags.commonFlags,
     ..._flags.outputFlags,
     ...threatFeedFlags
@@ -4842,7 +4879,7 @@ var _interopRequireWildcard = vendor.interopRequireWildcard.default;
 var _interopRequireDefault = vendor.interopRequireDefault.default;
 var _nodeFs = require$$0;
 var _nodePath = require$$1;
-var _nodeUrl = require$$2$5;
+var _nodeUrl = require$$2$6;
 var _chalk = _interopRequireDefault(vendor.source);
 var _ponyCause = require$$6;
 var _updateNotifier = _interopRequireDefault(vendor.updateNotifier);

package/dist/link.js

@@ -2,7 +2,7 @@
 
 var require$$0 = require('node:fs');
 var require$$1 = require('node:path');
-var require$$5 = require('which');
+var require$$6 = require('which');
 
 var link = {};
 
@@ -12,7 +12,7 @@ Object.defineProperty(link, "__esModule", {
 link.installLinks = installLinks;
 var _nodeFs = require$$0;
 var _nodePath = require$$1;
-var _which = require$$5;
+var _which = require$$6;
 function installLinks(realDirname, binName) {
   const realShadowBinDir = realDirname;
   // find package manager being shadowed by this process

package/dist/npm-injection.js

@@ -8,16 +8,16 @@ var require$$2$1 = require('node:events');
 var require$$4 = require('node:https');
 var require$$3 = require('node:readline');
 var require$$5 = require('node:stream');
-var require$$8$1 = require('node:timers/promises');
+var require$$8 = require('node:timers/promises');
 var require$$3$1 = require('@socketsecurity/config');
-var require$$6$1 = require('npm-package-arg');
+var require$$7 = require('npm-package-arg');
 var require$$3$2 = require('semver');
 var sdk = require('./sdk.js');
 var require$$1$1 = require('node:net');
 var require$$2 = require('node:os');
 var require$$6 = require('../package.json');
 var pathResolve = require('./path-resolve.js');
-var require$$8 = require('pacote');
+var require$$9 = require('pacote');
 
 var npmInjection$1 = {};
 
@@ -390,12 +390,12 @@ var _nodeHttps = require$$4;
 var _nodePath$1 = require$$1;
 var _nodeReadline = require$$3;
 var _nodeStream = require$$5;
-var _promises = require$$8$1;
+var _promises = require$$8;
 var _config = require$$3$1;
 var _chalk = _interopRequireDefault(vendor.source);
 var _isInteractive = _interopRequireDefault(vendor.isInteractive);
 var _ora = _interopRequireWildcard(vendor.ora);
-var _npmPackageArg = require$$6$1;
+var _npmPackageArg = require$$7;
 var _semver = require$$3$2;
 var _constants = sdk.constants;
 var _ttyServer = ttyServer$1;
@@ -444,7 +444,7 @@ let tarball;
 try {
   tarball = require(_nodePath$1.join(npmNmPath, 'pacote')).tarball;
 } catch {
-  tarball = require$$8.tarball;
+  tarball = require$$9.tarball;
 }
 const Arborist = require(arboristClassPath);
 const Edge = require(arboristEdgeClassPath);

package/dist/path-resolve.js

@@ -4,7 +4,7 @@ var require$$1$1 = require('node:fs/promises');
 var require$$1 = require('node:path');
 var require$$2 = require('ignore');
 var require$$3 = require('micromatch');
-var require$$4 = require('tinyglobby');
+var require$$11 = require('tinyglobby');
 
 var pathResolve = {};
 
@@ -51,7 +51,7 @@ var _promises = require$$1$1;
 var _nodePath = require$$1;
 var _ignore = require$$2;
 var _micromatch = require$$3;
-var _tinyglobby = require$$4;
+var _tinyglobby = require$$11;
 var _ignoreByDefault = ignoreByDefault;
 async function filterGlobResultToSupportedFiles(entries, supportedFiles) {
   const patterns = ['golang', 'npm', 'pypi'].reduce((r, n) => {
@@ -72,7 +72,6 @@ async function globWithGitIgnore(patterns, options) {
   };
   const projectIgnorePaths = socketConfig?.projectIgnorePaths;
   const ignoreFiles = await (0, _tinyglobby.glob)(['**/.gitignore'], {
-    __proto__: null,
     absolute: true,
     cwd,
     expandDirectories: true
@@ -80,7 +79,6 @@ async function globWithGitIgnore(patterns, options) {
   const ignores = [...(0, _ignoreByDefault.directoryPatterns)(), ...(Array.isArray(projectIgnorePaths) ? ignoreFileLinesToGlobPatterns(projectIgnorePaths, _nodePath.join(cwd, '.gitignore'), cwd) : []), ...(await Promise.all(ignoreFiles.map(async filepath => ignoreFileToGlobPatterns(await _promises.readFile(filepath, 'utf8'), filepath, cwd)))).flat()];
   const hasNegatedPattern = ignores.some(p => p.charCodeAt(0) === 33 /*'!'*/);
   const globOptions = {
-    __proto__: null,
     absolute: true,
     cwd,
     expandDirectories: false,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "socket",
-  "version": "0.14.16",
+  "version": "0.14.18",
   "description": "CLI tool for Socket.dev",
   "homepage": "http://github.com/SocketDev/socket-cli",
   "license": "MIT",
@@ -79,6 +79,7 @@
     "tinyglobby": "^0.2.10",
     "which": "^5.0.0",
     "write-file-atomic": "^6.0.0",
+    "yaml": "^2.6.0",
     "yargs-parser": "^21.1.1"
   },
   "devDependencies": {
@@ -145,9 +146,6 @@
     "validate-npm-package-name": "^6.0.0"
   },
   "overrides": {
-    "@cyclonedx/cdxgen": {
-      "packageurl-js": "https://registry.npmjs.org/packageurl-js/-/packageurl-js-2.0.1.tgz"
-    },
     "aggregate-error": "npm:@socketregistry/aggregate-error@^1",
     "es-define-property": "npm:@socketregistry/es-define-property@^1",
     "function-bind": "npm:@socketregistry/function-bind@^1",
@@ -161,12 +159,14 @@
     "is-core-module": "npm:@socketregistry/is-core-module@^1",
     "isarray": "npm:@socketregistry/isarray@^1",
     "npm-package-arg": "$npm-package-arg",
+    "packageurl-js": "https://registry.npmjs.org/packageurl-js/-/packageurl-js-2.0.1.tgz",
     "path-parse": "npm:@socketregistry/path-parse@^1",
     "safe-buffer": "npm:@socketregistry/safe-buffer@^1",
     "safer-buffer": "npm:@socketregistry/safer-buffer@^1",
     "semver": "$semver",
     "set-function-length": "npm:@socketregistry/set-function-length@^1",
-    "side-channel": "npm:@socketregistry/side-channel@^1"
+    "side-channel": "npm:@socketregistry/side-channel@^1",
+    "yaml": "$yaml"
   },
   "resolutions": {
     "aggregate-error": "npm:@socketregistry/aggregate-error@^1",
@@ -182,12 +182,14 @@
     "is-core-module": "npm:@socketregistry/is-core-module@^1",
     "isarray": "npm:@socketregistry/isarray@^1",
     "npm-package-arg": "^12.0.0",
+    "packageurl-js": "https://registry.npmjs.org/packageurl-js/-/packageurl-js-2.0.1.tgz",
     "path-parse": "npm:@socketregistry/path-parse@^1",
     "safe-buffer": "npm:@socketregistry/safe-buffer@^1",
     "safer-buffer": "npm:@socketregistry/safer-buffer@^1",
     "semver": "^7.6.3",
     "set-function-length": "npm:@socketregistry/set-function-length@^1",
-    "side-channel": "npm:@socketregistry/side-channel@^1"
+    "side-channel": "npm:@socketregistry/side-channel@^1",
+    "yaml": "^2.6.0"
   },
   "engines": {
     "node": "^20.9.0 || >=22.0.0"