socket 0.15.53 → 0.15.54

package/dist/cli.js

@@ -4316,10 +4316,7 @@ async function npmFix(pkgEnvDetails, {
   isCi && repoInfo ? await getOpenSocketPrs(repoInfo.owner, repoInfo.repo, {
     author: gitUser
   }) : [];
-  if (openPrs.length) {
-    debug.debugFn(`found: ${openPrs.length} open PRs`);
-  }
-  let count = isCi ? openPrs.length : 0;
+  let count = 0;
   const arb = new shadowInject.Arborist({
     path: rootPath,
     ...shadowInject.SAFE_ARBORIST_REIFY_OPTIONS_OVERRIDES
@@ -4330,9 +4327,9 @@ async function npmFix(pkgEnvDetails, {
   let alertsMap;
   try {
     alertsMap = purls.length ? await utils.getAlertsMapFromPurls(purls, getAlertsMapOptions({
-      limit: limit + openPrs.length
+      limit: Math.max(limit, openPrs.length)
     })) : await shadowInject.getAlertsMapFromArborist(arb, getAlertsMapOptions({
-      limit: limit + openPrs.length
+      limit: Math.max(limit, openPrs.length)
     }));
   } catch (e) {
     spinner?.stop();
@@ -4344,7 +4341,7 @@ async function npmFix(pkgEnvDetails, {
     };
   }
   const infoByPartialPurl = utils.getCveInfoFromAlertsMap(alertsMap, {
-    limit: limit + openPrs.length
+    limit: Math.max(limit, openPrs.length)
   });
   if (!infoByPartialPurl) {
     spinner?.stop();
@@ -4381,11 +4378,14 @@ async function npmFix(pkgEnvDetails, {
     const infoEntry = sortedInfoEntries[i];
     const partialPurlObj = utils.getPurlObject(infoEntry[0]);
     const name = packages.resolvePackageName(partialPurlObj);
-    let infos = [...infoEntry[1].values()];
+    const infos = [...infoEntry[1].values()];
+    if (!infos.length) {
+      continue infoEntriesLoop;
+    }
+    const activeBranches = [];
     if (isCi) {
       const branchFullName = getSocketBranchFullNameComponent(partialPurlObj);
       const branchPurlType = getSocketBranchPurlTypeComponent(partialPurlObj);
-      const activeBranches = [];
       for (const pr of openPrs) {
         const parsedBranch = branchParser(pr.headRefName);
         if (branchPurlType === parsedBranch?.type && branchFullName === parsedBranch?.fullName) {
@@ -4397,10 +4397,6 @@ async function npmFix(pkgEnvDetails, {
       } else if (openPrs.length) {
         debug.debugFn('miss: 0 active branches found');
       }
-      infos = infos.filter(info => !activeBranches.find(b => b.newVersion === info.firstPatchedVersionIdentifier));
-    }
-    if (!infos.length) {
-      continue infoEntriesLoop;
     }
     logger.logger.log(`Processing vulns for ${name}:`);
     logger.logger.indent();
@@ -4428,6 +4424,7 @@ async function npmFix(pkgEnvDetails, {
       const pkgPath = path.dirname(pkgJsonPath);
       const isWorkspaceRoot = pkgJsonPath === pkgEnvDetails.editablePkgJson.filename;
       const workspace = isWorkspaceRoot ? 'root' : path.relative(rootPath, pkgPath);
+      const branchWorkspace = isCi ? getSocketBranchWorkspaceComponent(workspace) : '';
       const oldVersions = arrays.arrayUnique(shadowInject.findPackageNodes(actualTree, name).map(n => n.target?.version ?? n.version).filter(Boolean));
       if (!oldVersions.length) {
         debug.debugFn(`skip: ${name} not found\n`);
@@ -4467,6 +4464,15 @@ async function npmFix(pkgEnvDetails, {
             continue infosLoop;
           }
           const newVersion = shadowInject.findBestPatchVersion(node, availableVersions, vulnerableVersionRange);
+          if (activeBranches.find(b => b.workspace === branchWorkspace && b.newVersion === newVersion)) {
+            debug.debugFn(`skip: open PR found for ${name}@${newVersion}`);
+            if (++count >= limit) {
+              logger.logger.dedent();
+              spinner?.dedent();
+              break infoEntriesLoop;
+            }
+            continue infosLoop;
+          }
           const newVersionPackument = newVersion ? packument.versions[newVersion] : undefined;
           if (!(newVersion && newVersionPackument)) {
             warningsForAfter.add(`${oldId} not updated: requires >=${firstPatchedVersionIdentifier}`);
@@ -7676,12 +7682,14 @@ function includesBun(lockSrc, name, lockName) {
 function includesPnpm(lockSrc, name) {
   const escapedName = regexps.escapeRegExp(name);
   return new RegExp(
-  // Detects the package name in the following cases:
-  //   /name/
+  // Detects the package name.
+  // v9.0 and v6.0 lockfile patterns:
   //   'name'
   //   name:
   //   name@
-  `(?<=^\\s*)(?:(['/])${escapedName}\\1|${escapedName}(?=[:@]))`, 'm').test(lockSrc);
+  // v6.0 lockfile patterns:
+  //   /name@
+  `(?<=^\\s*)(?:'${escapedName}'|/?${escapedName}(?=[:@]))`, 'm').test(lockSrc);
 }
 function includesVlt(lockSrc, name) {
   // Detects the package name in the following cases:
@@ -14372,5 +14380,5 @@ void (async () => {
     await utils.captureException(e);
   }
 })();
-//# debugId=fc631456-d58c-4127-856d-214963966236
+//# debugId=c367b9c2-15d4-4650-9e2f-c8866daf46cd
 //# sourceMappingURL=cli.js.map