socket 0.14.18 → 0.14.20

package/README.md

@@ -27,6 +27,7 @@ socket wrapper --enable
   [`@socketregistry`](https://github.com/SocketDev/socket-registry) overrides
 
   - `--pin` - Pin overrides to their latest version
+  - `--prod` - Only add overrides for production dependencies
 
 - `socket raw-npm` and `socket raw-npx` - Temporarily disable the Socket
   'safe-npm' wrapper.

package/dist/cli.js

@@ -14,7 +14,7 @@ var require$$1$4 = require('node:fs/promises');
 var require$$1$3 = require('@npmcli/package-json');
 var require$$5$1 = require('@socketsecurity/registry');
 var require$$7 = require('npm-package-arg');
-var require$$9 = require('pacote');
+var require$$0$1 = require('pacote');
 var require$$3 = require('semver');
 var require$$11 = require('tinyglobby');
 var require$$12 = require('yaml');
@@ -26,12 +26,12 @@ var require$$3$1 = require('@socketsecurity/config');
 var pathResolve = require('./path-resolve.js');
 var require$$2$2 = require('node:os');
 var require$$3$2 = require('node:readline');
-var require$$0$1 = require('node:process');
+var require$$0$2 = require('node:process');
 var require$$2$3 = require('node:readline/promises');
 var require$$2$4 = require('chalk-table');
 var require$$2$5 = require('blessed');
 var require$$3$3 = require('blessed-contrib');
-var require$$0$2 = require('node:util');
+var require$$0$3 = require('node:util');
 
 var cli$1 = {};
 
@@ -285,7 +285,7 @@ apiHelpers.queryAPI = queryAPI;
 var _chalk$i = _interopRequireDefault$r(vendor.source);
 var _ponyCause$4 = require$$6;
 var _errors$l = sdk.errors;
-var _constants = sdk.constants;
+var _constants$1 = sdk.constants;
 function handleUnsuccessfulApiResponse(_name, result, spinner) {
   const resultError = 'error' in result && result.error && typeof result.error === 'object' ? result.error : {};
   const message = 'message' in resultError && typeof resultError.message === 'string' ? resultError.message : 'No error message returned';
@@ -315,7 +315,7 @@ async function handleAPIError(code) {
   }
 }
 async function queryAPI(path, apiKey) {
-  return await fetch(`${_constants.API_V0_URL}/${path}`, {
+  return await fetch(`${_constants$1.API_V0_URL}/${path}`, {
     method: 'GET',
     headers: {
       Authorization: 'Basic ' + btoa(`${apiKey}:${apiKey}`)
@@ -915,7 +915,7 @@ var _which = require$$6$1;
 var _fs$1 = fs;
 var _objects$1 = sdk.objects;
 var _strings$1 = strings;
-const AGENTS = packageManagerDetector.AGENTS = ['bun', 'npm', 'pnpm', 'yarn'];
+const AGENTS = packageManagerDetector.AGENTS = ['bun', 'npm', 'pnpm', 'yarn/berry', 'yarn/classic'];
 const numericCollator = new Intl.Collator(undefined, {
   numeric: true,
   sensitivity: 'base'
@@ -952,7 +952,7 @@ const LOCKS = {
   'bun.lockb': 'bun',
   'pnpm-lock.yaml': 'pnpm',
   'pnpm-lock.yml': 'pnpm',
-  'yarn.lock': 'yarn',
+  'yarn.lock': 'yarn/classic',
   // If both package-lock.json and npm-shrinkwrap.json are present in the root
   // of a project, npm-shrinkwrap.json will take precedence and package-lock.json
   // will be ignored.
@@ -988,11 +988,12 @@ const readLockFileByAgent = (() => {
       } catch {}
       // To print a Yarn lockfile to your console without writing it to disk use `bun bun.lockb`.
       // https://bun.sh/guides/install/yarnlock
-      return (await _promiseSpawn$3(agentExecPath, [lockPath])).stdout;
+      return (await _promiseSpawn$3(agentExecPath, [lockPath])).stdout.trim();
     }),
     npm: wrapReader(async lockPath => await (0, _fs$1.readFileUtf8)(lockPath)),
     pnpm: wrapReader(async lockPath => await (0, _fs$1.readFileUtf8)(lockPath)),
-    yarn: wrapReader(async lockPath => await (0, _fs$1.readFileUtf8)(lockPath))
+    'yarn/berry': wrapReader(async lockPath => await (0, _fs$1.readFileUtf8)(lockPath)),
+    'yarn/classic': wrapReader(async lockPath => await (0, _fs$1.readFileUtf8)(lockPath))
   };
 })();
 async function detect({
@@ -1007,10 +1008,11 @@ async function detect({
     cwd
   });
   const pkgPath = (0, _fs$1.existsSync)(pkgJsonPath) ? _nodePath$3.dirname(pkgJsonPath) : undefined;
-  const pkgJson = pkgPath ? await _packageJson$1.load(pkgPath) : undefined;
+  const editablePkgJson = pkgPath ? await _packageJson$1.load(pkgPath) : undefined;
+  const pkgJson = editablePkgJson?.content;
   // Read Corepack `packageManager` field in package.json:
   // https://nodejs.org/api/packages.html#packagemanager
-  const pkgManager = (0, _strings$1.isNonEmptyString)(pkgJson?.content?.packageManager) ? pkgJson.content.packageManager : undefined;
+  const pkgManager = (0, _strings$1.isNonEmptyString)(pkgJson?.packageManager) ? pkgJson.packageManager : undefined;
   let agent;
   let agentVersion;
   if (pkgManager) {
@@ -1020,7 +1022,7 @@ async function detect({
       const version = pkgManager.slice(atSignIndex + 1);
       if (version && AGENTS.includes(name)) {
         agent = name;
-        agentVersion = version;
+        agentVersion = _semver$1.coerce(version) ?? undefined;
       }
     }
   }
@@ -1034,6 +1036,18 @@ async function detect({
   const agentExecPath = (await _which(agent, {
     nothrow: true
   })) ?? agent;
+  if (agentVersion === undefined) {
+    try {
+      agentVersion = _semver$1.coerce(
+      // All package managers support the "--version" flag.
+      (await _promiseSpawn$3(agentExecPath, ['--version'], {
+        cwd
+      })).stdout) ?? undefined;
+    } catch {}
+  }
+  if (agent === 'yarn/classic' && (agentVersion?.major ?? 0) > 1) {
+    agent = 'yarn/berry';
+  }
   const targets = {
     browser: false,
     node: true
@@ -1041,18 +1055,18 @@ async function detect({
   let lockSrc;
   let minimumNodeVersion = maintainedNodeVersions.previous;
   if (pkgJson) {
-    const browserField = pkgJson.content.browser;
+    const browserField = pkgJson.browser;
     if ((0, _strings$1.isNonEmptyString)(browserField) || (0, _objects$1.isObjectObject)(browserField)) {
       targets.browser = true;
     }
-    const nodeRange = pkgJson.content.engines?.['node'];
+    const nodeRange = pkgJson.engines?.['node'];
     if ((0, _strings$1.isNonEmptyString)(nodeRange)) {
       const coerced = _semver$1.coerce(nodeRange);
       if (coerced && _semver$1.lt(coerced, minimumNodeVersion)) {
         minimumNodeVersion = coerced.version;
       }
     }
-    const browserslistQuery = pkgJson.content['browserslist'];
+    const browserslistQuery = pkgJson['browserslist'];
     if (Array.isArray(browserslistQuery)) {
       const browserslistTargets = _browserslist(browserslistQuery).map(s => s.toLowerCase()).toSorted(alphaNumericComparator);
       const browserslistNodeTargets = browserslistTargets.filter(v => v.startsWith('node ')).map(v => v.slice(5 /*'node '.length*/));
@@ -1078,7 +1092,7 @@ async function detect({
     lockPath,
     lockSrc,
     minimumNodeVersion,
-    pkgJson,
+    pkgJson: editablePkgJson,
     pkgPath,
     supported: targets.browser || targets.node,
     targets
@@ -1180,10 +1194,11 @@ var _registry = require$$5$1;
 var _meow$m = _interopRequireDefault$n(vendor.build);
 var _npmPackageArg = require$$7;
 var _ora$i = _interopRequireDefault$n(vendor.ora);
-var _pacote = require$$9;
+var _pacote = require$$0$1;
 var _semver = require$$3;
 var _tinyglobby = require$$11;
 var _yaml = require$$12;
+var _constants = sdk.constants;
 var _flags$j = flags$1;
 var _formatting$k = formatting;
 var _fs = fs;
@@ -1193,17 +1208,27 @@ var _promises2 = promises;
 var _regexps = regexps;
 var _sorts$1 = sorts;
 var _strings = strings;
+//import cacache from 'cacache'
+
+//import { packumentCache, pacoteCachePath } from '../constants'
+
 const COMMAND_TITLE = 'Socket Optimize';
 const OVERRIDES_FIELD_NAME = 'overrides';
 const PNPM_WORKSPACE = 'pnpm-workspace';
 const RESOLUTIONS_FIELD_NAME = 'resolutions';
 const distPath$1 = __dirname;
 const manifestNpmOverrides = (0, _registry.getManifestData)('npm');
-const packumentCache = new Map();
 const getOverridesDataByAgent = {
+  bun(pkgJson) {
+    const overrides = pkgJson?.resolutions ?? {};
+    return {
+      type: 'yarn/berry',
+      overrides
+    };
+  },
   // npm overrides documentation:
   // https://docs.npmjs.com/cli/v10/configuring-npm/package-json#overrides
-  npm: pkgJson => {
+  npm(pkgJson) {
     const overrides = pkgJson?.overrides ?? {};
     return {
       type: 'npm',
@@ -1212,7 +1237,7 @@ const getOverridesDataByAgent = {
   },
   // pnpm overrides documentation:
   // https://pnpm.io/package_json#pnpmoverrides
-  pnpm: pkgJson => {
+  pnpm(pkgJson) {
     const overrides = pkgJson?.pnpm?.overrides ?? {};
     return {
       type: 'pnpm',
@@ -1221,31 +1246,25 @@ const getOverridesDataByAgent = {
   },
   // Yarn resolutions documentation:
   // https://yarnpkg.com/configuration/manifest#resolutions
-  yarn: pkgJson => {
+  'yarn/berry'(pkgJson) {
     const overrides = pkgJson?.resolutions ?? {};
     return {
-      type: 'yarn',
+      type: 'yarn/berry',
+      overrides
+    };
+  },
+  // Yarn resolutions documentation:
+  // https://classic.yarnpkg.com/en/docs/selective-version-resolutions
+  'yarn/classic'(pkgJson) {
+    const overrides = pkgJson?.resolutions ?? {};
+    return {
+      type: 'yarn/classic',
       overrides
     };
   }
 };
-const lockIncludesByAgent = {
-  npm: (lockSrc, name) => {
-    // Detects the package name in the following cases:
-    //   "name":
-    return lockSrc.includes(`"${name}":`);
-  },
-  pnpm: (lockSrc, name) => {
-    const escapedName = (0, _regexps.escapeRegExp)(name);
-    return new RegExp(
-    // Detects the package name in the following cases:
-    //   /name/
-    //   'name'
-    //   name:
-    //   name@
-    `(?<=^\\s*)(?:(['/])${escapedName}\\1|${escapedName}(?=[:@]))`, 'm').test(lockSrc);
-  },
-  yarn: (lockSrc, name) => {
+const lockIncludesByAgent = (() => {
+  const yarn = (lockSrc, name) => {
     const escapedName = (0, _regexps.escapeRegExp)(name);
     return new RegExp(
     // Detects the package name in the following cases:
@@ -1254,9 +1273,34 @@ const lockIncludesByAgent = {
     //   name@
     //   , name@
     `(?<=(?:^\\s*|,\\s*)"?)${escapedName}(?=@)`, 'm').test(lockSrc);
-  }
-};
+  };
+  return {
+    bun: yarn,
+    npm(lockSrc, name) {
+      // Detects the package name in the following cases:
+      //   "name":
+      return lockSrc.includes(`"${name}":`);
+    },
+    pnpm(lockSrc, name) {
+      const escapedName = (0, _regexps.escapeRegExp)(name);
+      return new RegExp(
+      // Detects the package name in the following cases:
+      //   /name/
+      //   'name'
+      //   name:
+      //   name@
+      `(?<=^\\s*)(?:(['/])${escapedName}\\1|${escapedName}(?=[:@]))`, 'm').test(lockSrc);
+    },
+    'yarn/berry': yarn,
+    'yarn/classic': yarn
+  };
+})();
 const updateManifestByAgent = {
+  bun(pkgJson, overrides) {
+    pkgJson.update({
+      [RESOLUTIONS_FIELD_NAME]: overrides
+    });
+  },
   npm(pkgJson, overrides) {
     pkgJson.update({
       [OVERRIDES_FIELD_NAME]: overrides
@@ -1270,12 +1314,88 @@ const updateManifestByAgent = {
       }
     });
   },
-  yarn(pkgJson, overrides) {
+  'yarn/berry'(pkgJson, overrides) {
+    pkgJson.update({
+      [RESOLUTIONS_FIELD_NAME]: overrides
+    });
+  },
+  'yarn/classic'(pkgJson, overrides) {
     pkgJson.update({
       [RESOLUTIONS_FIELD_NAME]: overrides
     });
   }
 };
+const lsByAgent = {
+  async bun(agentExecPath, cwd, _rootPath) {
+    try {
+      // Bun does not support filtering by production packages yet.
+      // https://github.com/oven-sh/bun/issues/8283
+      return (await _promiseSpawn$2(agentExecPath, ['pm', 'ls', '--all'], {
+        cwd
+      })).stdout;
+    } catch {}
+    return '';
+  },
+  async npm(agentExecPath, cwd, rootPath) {
+    try {
+      let {
+        stdout
+      } = await _promiseSpawn$2(agentExecPath, ['ls', '--parseable', '--omit', 'dev', '--all'], {
+        cwd
+      });
+      stdout = stdout.trim();
+      stdout = stdout.replaceAll(cwd, '');
+      stdout = rootPath === cwd ? stdout : stdout.replaceAll(rootPath, '');
+      return stdout.replaceAll('\\', '/');
+    } catch {}
+    return '';
+  },
+  async pnpm(agentExecPath, cwd, rootPath) {
+    try {
+      let {
+        stdout
+      } = await _promiseSpawn$2(agentExecPath, ['ls', '--parseable', '--prod', '--depth', 'Infinity'], {
+        cwd
+      });
+      stdout = stdout.trim();
+      stdout = stdout.replaceAll(cwd, '');
+      stdout = rootPath === cwd ? stdout : stdout.replaceAll(rootPath, '');
+      return stdout.replaceAll('\\', '/');
+    } catch {}
+    return '';
+  },
+  async 'yarn/berry'(agentExecPath, cwd, _rootPath) {
+    try {
+      return (
+        // Yarn Berry does not support filtering by production packages yet.
+        // https://github.com/yarnpkg/berry/issues/5117
+        (await _promiseSpawn$2(agentExecPath, ['info', '--recursive', '--name-only'], {
+          cwd
+        })).stdout.trim()
+      );
+    } catch {}
+    return '';
+  },
+  async 'yarn/classic'(agentExecPath, cwd, _rootPath) {
+    try {
+      // However, Yarn Classic does support it.
+      // https://github.com/yarnpkg/yarn/releases/tag/v1.0.0
+      // > Fix: Excludes dev dependencies from the yarn list output when the
+      //   environment is production
+      return (await _promiseSpawn$2(agentExecPath, ['list', '--prod'], {
+        cwd
+      })).stdout.trim();
+    } catch {}
+    return '';
+  }
+};
+const depsIncludesByAgent = {
+  bun: (stdout, name) => stdout.includes(` ${name}@`),
+  npm: (stdout, name) => stdout.includes(`/${name}\n`),
+  pnpm: (stdout, name) => stdout.includes(`/${name}\n`),
+  'yarn/berry': (stdout, name) => stdout.includes(` ${name}@`),
+  'yarn/classic': (stdout, name) => stdout.includes(` ${name}@`)
+};
 function getDependencyEntries(pkgJson) {
   const {
     dependencies,
@@ -1334,22 +1454,30 @@ function workspaceToGlobPattern(workspace) {
 }
 async function addOverrides({
   agent,
-  lockIncludes,
+  agentExecPath,
   lockSrc,
   manifestEntries,
+  pin,
   pkgJson: editablePkgJson,
   pkgPath,
-  pin,
+  prod,
   rootPath
 }, state = {
   added: new Set(),
+  spinner: undefined,
   updated: new Set()
 }) {
   if (editablePkgJson === undefined) {
     editablePkgJson = await _packageJson.load(pkgPath);
   }
+  const {
+    spinner
+  } = state;
   const pkgJson = editablePkgJson.content;
   const isRoot = pkgPath === rootPath;
+  const isLockScanned = isRoot && !prod;
+  const thingToScan = isLockScanned ? lockSrc : await lsByAgent[agent](agentExecPath, pkgPath, rootPath);
+  const thingScanner = isLockScanned ? lockIncludesByAgent[agent] : depsIncludesByAgent[agent];
   const depEntries = getDependencyEntries(pkgJson);
   const workspaces = await getWorkspaces(agent, pkgPath, pkgJson);
   const isWorkspace = !!workspaces;
@@ -1357,9 +1485,11 @@ async function addOverrides({
   if (pkgJson['private'] || isWorkspace) {
     overridesDataObjects.push(getOverridesDataByAgent[agent](pkgJson));
   } else {
-    overridesDataObjects.push(getOverridesDataByAgent['npm'](pkgJson), getOverridesDataByAgent['yarn'](pkgJson));
+    overridesDataObjects.push(getOverridesDataByAgent['npm'](pkgJson), getOverridesDataByAgent['yarn/classic'](pkgJson));
+  }
+  if (spinner) {
+    spinner.text = `Adding overrides${isRoot ? '' : ` to ${_nodePath$2.relative(rootPath, pkgPath)}`}...`;
   }
-  const spinner = isRoot ? (0, _ora$i.default)('Fetching override manifests...').start() : undefined;
   const depAliasMap = new Map();
   // Chunk package names to process them in parallel 3 at a time.
   await (0, _promises2.pEach)(manifestEntries, 3, async ({
@@ -1379,12 +1509,12 @@ async function addOverrides({
         let thisVersion = version;
         // Add package aliases for direct dependencies to avoid npm EOVERRIDE errors.
         // https://docs.npmjs.com/cli/v8/using-npm/package-spec#aliases
-        const specStartsWith = `npm:${regPkgName}@`;
-        const existingVersion = pkgSpec.startsWith(specStartsWith) ? _semver.coerce(_npmPackageArg(pkgSpec).rawSpec)?.version ?? '' : '';
+        const regSpecStartsLike = `npm:${regPkgName}@`;
+        const existingVersion = pkgSpec.startsWith(regSpecStartsLike) ? _semver.coerce(_npmPackageArg(pkgSpec).rawSpec)?.version ?? '' : '';
         if (existingVersion) {
           thisVersion = existingVersion;
         } else {
-          pkgSpec = `${specStartsWith}^${version}`;
+          pkgSpec = `${regSpecStartsLike}^${version}`;
           depObj[origPkgName] = pkgSpec;
           state.added.add(regPkgName);
         }
@@ -1394,19 +1524,17 @@ async function addOverrides({
         });
       }
     }
-    if (!isRoot) {
-      return;
-    }
     // Chunk package names to process them in parallel 3 at a time.
     await (0, _promises2.pEach)(overridesDataObjects, 3, async ({
       overrides,
       type
     }) => {
       const overrideExists = (0, _objects.hasOwn)(overrides, origPkgName);
-      if (overrideExists || lockIncludes(lockSrc, origPkgName)) {
+      if (overrideExists || thingScanner(thingToScan, origPkgName)) {
         const oldSpec = overrideExists ? overrides[origPkgName] : undefined;
         const depAlias = depAliasMap.get(origPkgName);
-        let newSpec = `npm:${regPkgName}@^${pin ? version : major}`;
+        const regSpecStartsLike = `npm:${regPkgName}@`;
+        let newSpec = `${regSpecStartsLike}^${pin ? version : major}`;
         let thisVersion = version;
         if (depAlias && type === 'npm') {
           // With npm one may not set an override for a package that one directly
@@ -1417,13 +1545,16 @@ async function addOverrides({
           // of with a $.
           // https://docs.npmjs.com/cli/v8/configuring-npm/package-json#overrides
           newSpec = `$${origPkgName}`;
-        } else if (overrideExists && pin) {
+        } else if (overrideExists) {
           const thisSpec = oldSpec.startsWith('$') ? depAlias?.id ?? newSpec : oldSpec ?? newSpec;
-          thisVersion = _semver.coerce(_npmPackageArg(thisSpec).rawSpec)?.version ?? version;
-          if (_semver.major(thisVersion) !== major) {
-            thisVersion = (await fetchPackageManifest(thisSpec))?.version ?? version;
+          if (thisSpec.startsWith(regSpecStartsLike)) {
+            if (pin) {
+              thisVersion = _semver.major(_semver.coerce(_npmPackageArg(thisSpec).rawSpec)?.version ?? version) === major ? version : (await fetchPackageManifest(thisSpec))?.version ?? version;
+            }
+            newSpec = `${regSpecStartsLike}^${pin ? thisVersion : _semver.major(thisVersion)}`;
+          } else {
+            newSpec = oldSpec;
           }
-          newSpec = `npm:${regPkgName}@^${pin ? thisVersion : _semver.major(thisVersion)}`;
         }
         if (newSpec !== oldSpec) {
           if (overrideExists) {
@@ -1439,7 +1570,8 @@ async function addOverrides({
   if (workspaces) {
     const wsPkgJsonPaths = await (0, _tinyglobby.glob)(workspaces.map(workspaceToGlobPattern), {
       absolute: true,
-      cwd: pkgPath
+      cwd: pkgPath,
+      ignore: ['**/node_modules/**', '**/bower_components/**']
     });
     // Chunk package names to process them in parallel 3 at a time.
     await (0, _promises2.pEach)(wsPkgJsonPaths, 3, async wsPkgJsonPath => {
@@ -1448,12 +1580,17 @@ async function addOverrides({
         updated
       } = await addOverrides({
         agent,
+        agentExecPath,
         lockSrc,
-        lockIncludes,
         manifestEntries,
         pin,
         pkgPath: _nodePath$2.dirname(wsPkgJsonPath),
+        prod,
         rootPath
+      }, {
+        added: new Set(),
+        spinner,
+        updated: new Set()
       });
       for (const regPkgName of added) {
         state.added.add(regPkgName);
@@ -1463,8 +1600,7 @@ async function addOverrides({
       }
     });
   }
-  spinner?.stop();
-  if (state.added.size || state.updated.size) {
+  if (state.added.size > 0 || state.updated.size > 0) {
     editablePkgJson.update(Object.fromEntries(depEntries));
     for (const {
       overrides,
@@ -1476,10 +1612,39 @@ async function addOverrides({
   }
   return state;
 }
+
+// type ExtractOptions = pacote.Options & {
+//   tmpPrefix?: string
+//   [key: string]: any
+// }
+
+// async function extractPackage(pkgNameOrId: string, options: ExtractOptions | undefined, callback: (tmpDirPath: string) => any) {
+//   if (arguments.length === 2 && typeof options === 'function') {
+//     callback = options
+//     options = undefined
+//   }
+//   const { tmpPrefix, ...extractOptions } = { __proto__: null, ...options }
+//   // cacache.tmp.withTmp DOES return a promise.
+//   await cacache.tmp.withTmp(
+//     pacoteCachePath,
+//     { tmpPrefix },
+//     // eslint-disable-next-line @typescript-eslint/no-misused-promises
+//     async tmpDirPath => {
+//       await pacote.extract(pkgNameOrId, tmpDirPath, {
+//         __proto__: null,
+//         packumentCache,
+//         preferOffline: true,
+//         ...<Omit<typeof extractOptions, '__proto__'>>extractOptions
+//       })
+//       await callback(tmpDirPath)
+//     }
+//   )
+// }
+
 async function fetchPackageManifest(pkgNameOrId, options) {
   const pacoteOptions = {
     ...options,
-    packumentCache,
+    packumentCache: _constants.packumentCache,
     preferOffline: true
   };
   const {
@@ -1507,12 +1672,14 @@ const optimize = optimize$1.optimize = {
       return;
     }
     const {
-      pin
+      pin,
+      prod
     } = commandContext;
     const cwd = process.cwd();
     const {
       agent,
       agentExecPath,
+      agentVersion,
       lockSrc,
       lockPath,
       minimumNodeVersion,
@@ -1534,53 +1701,64 @@ const optimize = optimize$1.optimize = {
       console.log(`✘ ${COMMAND_TITLE}: No ${lockName} found`);
       return;
     }
+    if (lockSrc.trim() === '') {
+      console.log(`✘ ${COMMAND_TITLE}: ${lockName} is empty`);
+      return;
+    }
     if (pkgPath === undefined) {
       console.log(`✘ ${COMMAND_TITLE}: No package.json found`);
       return;
     }
+    if (prod && (agent === 'bun' || agent === 'yarn/berry')) {
+      console.log(`✘ ${COMMAND_TITLE}: --prod not supported for ${agent}${agentVersion ? `@${agentVersion.toString()}` : ''}`);
+      return;
+    }
     if (lockPath && _nodePath$2.relative(cwd, lockPath).startsWith('.')) {
       console.log(`⚠️ ${COMMAND_TITLE}: Package ${lockName} found at ${lockPath}`);
     }
+    const spinner = (0, _ora$i.default)('Socket optimizing...');
     const state = {
       added: new Set(),
+      spinner,
       updated: new Set()
     };
-    if (lockSrc) {
-      const lockIncludes = agent === 'bun' ? lockIncludesByAgent.yarn : lockIncludesByAgent[agent];
-      const nodeRange = `>=${minimumNodeVersion}`;
-      const manifestEntries = manifestNpmOverrides.filter(({
-        1: data
-      }) => _semver.satisfies(_semver.coerce(data.engines.node), nodeRange));
-      await addOverrides({
-        agent: agent === 'bun' ? 'yarn' : agent,
-        lockIncludes,
-        lockSrc,
-        manifestEntries,
-        pin,
-        pkgJson,
-        pkgPath,
-        rootPath: pkgPath
-      }, state);
-    }
+    spinner.start();
+    const nodeRange = `>=${minimumNodeVersion}`;
+    const manifestEntries = manifestNpmOverrides.filter(({
+      1: data
+    }) => _semver.satisfies(_semver.coerce(data.engines.node), nodeRange));
+    await addOverrides({
+      agent,
+      agentExecPath,
+      lockSrc,
+      manifestEntries,
+      pin,
+      pkgJson,
+      pkgPath,
+      prod,
+      rootPath: pkgPath
+    }, state);
+    spinner.stop();
     const pkgJsonChanged = state.added.size > 0 || state.updated.size > 0;
-    if (state.updated.size > 0) {
-      console.log(`Updated ${state.updated.size} Socket.dev optimized overrides ${state.added.size ? '.' : '🚀'}`);
-    }
-    if (state.added.size > 0) {
-      console.log(`Added ${state.added.size} Socket.dev optimized overrides 🚀`);
-    }
-    if (!pkgJsonChanged) {
+    if (pkgJsonChanged) {
+      if (state.updated.size > 0) {
+        console.log(`Updated ${state.updated.size} Socket.dev optimized overrides ${state.added.size ? '.' : '🚀'}`);
+      }
+      if (state.added.size > 0) {
+        console.log(`Added ${state.added.size} Socket.dev optimized overrides 🚀`);
+      }
+    } else {
       console.log('Congratulations! Already Socket.dev optimized 🎉');
     }
     const isNpm = agent === 'npm';
     if (isNpm || pkgJsonChanged) {
       // Always update package-lock.json until the npm overrides PR lands:
       // https://github.com/npm/cli/pull/7025
-      const spinner = (0, _ora$i.default)(`Updating ${lockName}...`).start();
+      spinner.start(`Updating ${lockName}...`);
       try {
         if (isNpm) {
           const wrapperPath = _nodePath$2.join(distPath$1, 'npm-cli.js');
-          await _promiseSpawn$2(process.execPath, [wrapperPath, 'install'], {
+          await _promiseSpawn$2(process.execPath, [wrapperPath, 'install', '--no-audit', '--no-fund'], {
             stdio: 'pipe',
             env: {
               ...process.env,
@@ -1588,6 +1766,7 @@ const optimize = optimize$1.optimize = {
             }
           });
         } else {
+          // All package managers support the "install" command.
           await _promiseSpawn$2(agentExecPath, ['install'], {
             stdio: 'pipe'
           });
@@ -1613,6 +1792,11 @@ function setupCommand$l(name, description, argv, importMeta) {
       type: 'boolean',
       default: false,
       description: 'Pin overrides to their latest version'
+    },
+    prod: {
+      type: 'boolean',
+      default: false,
+      description: 'Only add overrides for production dependencies'
     }
   };
   const cli = (0, _meow$m.default)(`
@@ -1632,14 +1816,16 @@ function setupCommand$l(name, description, argv, importMeta) {
   });
   const {
     help,
-    pin
+    pin,
+    prod
   } = cli.flags;
   if (help) {
     cli.showHelp();
     return;
   }
   return {
-    pin
+    pin,
+    prod
   };
 }
 
@@ -2455,7 +2641,7 @@ Object.defineProperty(create$3, "__esModule", {
   value: true
 });
 create$3.create = void 0;
-var _nodeProcess = require$$0$1;
+var _nodeProcess = require$$0$2;
 var _promises$1 = require$$2$3;
 var _chalk$e = _interopRequireDefault$f(vendor.source);
 var _meow$e = _interopRequireDefault$f(vendor.build);
@@ -4324,7 +4510,7 @@ Object.defineProperty(get$1, "__esModule", {
 });
 get$1.get = void 0;
 var _nodeFs$1 = require$$0;
-var _nodeUtil = require$$0$2;
+var _nodeUtil = require$$0$3;
 var _chalk$1 = _interopRequireDefault$2(vendor.source);
 var _meow$1 = _interopRequireDefault$2(vendor.build);
 var _ora$1 = _interopRequireDefault$2(vendor.ora);

package/dist/npm-injection.js

@@ -17,7 +17,7 @@ var require$$1$1 = require('node:net');
 var require$$2 = require('node:os');
 var require$$6 = require('../package.json');
 var pathResolve = require('./path-resolve.js');
-var require$$9 = require('pacote');
+var require$$0$1 = require('pacote');
 
 var npmInjection$1 = {};
 
@@ -444,7 +444,7 @@ let tarball;
 try {
   tarball = require(_nodePath$1.join(npmNmPath, 'pacote')).tarball;
 } catch {
-  tarball = require$$9.tarball;
+  tarball = require$$0$1.tarball;
 }
 const Arborist = require(arboristClassPath);
 const Edge = require(arboristEdgeClassPath);

package/dist/sdk.d.ts

@@ -14,7 +14,9 @@ declare const API_V0_URL = "https://api.socket.dev/v0";
 declare const ENV: Readonly<{
     UPDATE_SOCKET_OVERRIDES_IN_PACKAGE_LOCK_FILE: boolean;
 }>;
+declare const packumentCache: Map<any, any>;
+declare const pacoteCachePath: any;
 declare const FREE_API_KEY = "sktsec_t_--RAN5U4ivauy4w37-6aoKyYPDt5ZbaT5JBVMqiwKo_api";
 declare function getDefaultKey(): string | undefined;
 declare function setupSdk(apiKey?: string | undefined, apiBaseUrl?: string | undefined, proxy?: string | undefined): Promise<SocketSdk>;
-export { hasOwn, isObject, isObjectObject, objectSome, pick, createDebugLogger, isErrnoException, stringJoinWithSeparateFinalSeparator, API_V0_URL, ENV, FREE_API_KEY, getDefaultKey, setupSdk };
+export { hasOwn, isObject, isObjectObject, objectSome, pick, createDebugLogger, isErrnoException, stringJoinWithSeparateFinalSeparator, API_V0_URL, ENV, packumentCache, pacoteCachePath, FREE_API_KEY, getDefaultKey, setupSdk };

package/dist/sdk.js

@@ -1,12 +1,13 @@
 'use strict';
 
+var require$$0 = require('pacote');
 var vendor = require('./vendor.js');
 var require$$1$1 = require('node:fs/promises');
 var require$$1 = require('node:path');
 var require$$1$2 = require('@inquirer/prompts');
 var require$$4 = require('@socketsecurity/sdk');
 var require$$5 = require('hpagent');
-var require$$0 = require('node:fs');
+var require$$0$1 = require('node:fs');
 var require$$2 = require('node:os');
 
 var errors = {};
@@ -30,7 +31,8 @@ var constants = {};
 Object.defineProperty(constants, "__esModule", {
   value: true
 });
-constants.ENV = constants.API_V0_URL = void 0;
+constants.pacoteCachePath = constants.packumentCache = constants.ENV = constants.API_V0_URL = void 0;
+var _pacote = require$$0;
 function envAsBoolean(value) {
   return typeof value === 'string' && (value === '1' || value.toLowerCase() === 'true');
 }
@@ -39,6 +41,11 @@ constants.ENV = Object.freeze({
   // Flag set by the optimize command to bypass the packagesHaveRiskyIssues check.
   UPDATE_SOCKET_OVERRIDES_IN_PACKAGE_LOCK_FILE: envAsBoolean(process.env['UPDATE_SOCKET_OVERRIDES_IN_PACKAGE_LOCK_FILE'])
 });
+constants.packumentCache = new Map();
+const {
+  constructor: PacoteFetcherBase
+} = Reflect.getPrototypeOf(_pacote.RegistryFetcher.prototype);
+constants.pacoteCachePath = new PacoteFetcherBase(/*dummy package spec*/'x', {}).cache;
 
 var chalkMarkdown = {};
 
@@ -189,7 +196,7 @@ Object.defineProperty(settings$1, "__esModule", {
 });
 settings$1.getSetting = getSetting;
 settings$1.updateSetting = updateSetting;
-var _nodeFs = require$$0;
+var _nodeFs = require$$0$1;
 var _nodeOs = require$$2;
 var _nodePath$1 = require$$1;
 var _ora = _interopRequireDefault$1(vendor.ora);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "socket",
-  "version": "0.14.18",
+  "version": "0.14.20",
   "description": "CLI tool for Socket.dev",
   "homepage": "http://github.com/SocketDev/socket-cli",
   "license": "MIT",