socket 1.0.96 → 1.0.98

package/dist/cli.js

@@ -3,7 +3,7 @@
 
 var require$$0 = require('node:url');
 var vendor = require('./vendor.js');
-var require$$6 = require('../external/@socketsecurity/registry/lib/debug');
+var require$$8 = require('../external/@socketsecurity/registry/lib/debug');
 var logger = require('../external/@socketsecurity/registry/lib/logger');
 var utils = require('./utils.js');
 var fs = require('node:fs/promises');
@@ -18,16 +18,16 @@ var spawn = require('../external/@socketsecurity/registry/lib/spawn');
 var fs$2 = require('../external/@socketsecurity/registry/lib/fs');
 var strings = require('../external/@socketsecurity/registry/lib/strings');
 var arrays = require('../external/@socketsecurity/registry/lib/arrays');
+var regexps = require('../external/@socketsecurity/registry/lib/regexps');
 var registry = require('../external/@socketsecurity/registry');
 var npm = require('../external/@socketsecurity/registry/lib/npm');
 var packages = require('../external/@socketsecurity/registry/lib/packages');
 var sorts = require('../external/@socketsecurity/registry/lib/sorts');
-var regexps = require('../external/@socketsecurity/registry/lib/regexps');
 var shadowNpmInject = require('./shadow-npm-inject.js');
-var require$$7 = require('../external/@socketsecurity/registry/lib/objects');
+var require$$9 = require('../external/@socketsecurity/registry/lib/objects');
 var path$1 = require('../external/@socketsecurity/registry/lib/path');
 var shadowNpmBin = require('./shadow-npm-bin.js');
-var require$$8 = require('../external/@socketsecurity/registry/lib/promises');
+var require$$10 = require('../external/@socketsecurity/registry/lib/promises');
 var require$$1 = require('node:util');
 var os = require('node:os');
 var promises = require('node:stream/promises');
@@ -322,21 +322,21 @@ async function handleAnalytics({
 const {
   DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$M
 } = constants;
-const CMD_NAME$w = 'analytics';
-const description$C = 'Look up analytics data';
-const hidden$u = false;
+const CMD_NAME$x = 'analytics';
+const description$D = 'Look up analytics data';
+const hidden$v = false;
 const cmdAnalytics = {
-  description: description$C,
-  hidden: hidden$u,
-  run: run$P
+  description: description$D,
+  hidden: hidden$v,
+  run: run$Q
 };
-async function run$P(argv, importMeta, {
+async function run$Q(argv, importMeta, {
   parentName
 }) {
   const config = {
-    commandName: CMD_NAME$w,
-    description: description$C,
-    hidden: hidden$u,
+    commandName: CMD_NAME$x,
+    description: description$D,
+    hidden: hidden$v,
     flags: {
       ...flags.commonFlags,
       ...flags.outputFlags,
@@ -352,7 +352,7 @@ async function run$P(argv, importMeta, {
       $ ${command} [options] [ "org" | "repo" <reponame>] [TIME]
 
     API Token Requirements
-      ${utils.getFlagApiRequirementsOutput(`${parentName}:${CMD_NAME$w}`)}
+      ${utils.getFlagApiRequirementsOutput(`${parentName}:${CMD_NAME$x}`)}
 
     The scope is either org or repo level, defaults to org.
 
@@ -409,7 +409,7 @@ async function run$P(argv, importMeta, {
   } = cli.flags;
   const dryRun = !!cli.flags['dryRun'];
   const noLegacy = !cli.flags['scope'] && !cli.flags['repo'] && !cli.flags['time'];
-  const hasApiToken = utils.hasDefaultToken();
+  const hasApiToken = utils.hasDefaultApiToken();
   const outputKind = utils.getOutputKind(json, markdown);
   const wasValidInput = utils.checkCommandInput(outputKind, {
     nook: true,
@@ -617,8 +617,8 @@ ${table}
   } catch (e) {
     process.exitCode = 1;
     logger.logger.fail('There was a problem converting the logs to Markdown, please try the `--json` flag');
-    require$$6.debugFn('error', 'caught: markdown conversion error');
-    require$$6.debugDir('inspect', {
+    require$$8.debugFn('error', 'caught: markdown conversion error');
+    require$$8.debugDir('inspect', {
       error: e
     });
     return 'Failed to generate the markdown report';
@@ -755,21 +755,21 @@ const {
   DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$L,
   SOCKET_WEBSITE_URL: SOCKET_WEBSITE_URL$3
 } = constants;
-const CMD_NAME$v = 'audit-log';
-const description$B = 'Look up the audit log for an organization';
-const hidden$t = false;
+const CMD_NAME$w = 'audit-log';
+const description$C = 'Look up the audit log for an organization';
+const hidden$u = false;
 const cmdAuditLog = {
-  description: description$B,
-  hidden: hidden$t,
-  run: run$O
+  description: description$C,
+  hidden: hidden$u,
+  run: run$P
 };
-async function run$O(argv, importMeta, {
+async function run$P(argv, importMeta, {
   parentName
 }) {
   const config = {
-    commandName: CMD_NAME$v,
-    description: description$B,
-    hidden: hidden$t,
+    commandName: CMD_NAME$w,
+    description: description$C,
+    hidden: hidden$u,
     flags: {
       ...flags.commonFlags,
       ...flags.outputFlags,
@@ -797,7 +797,7 @@ async function run$O(argv, importMeta, {
       $ ${command} [options] [FILTER]
 
     API Token Requirements
-      ${utils.getFlagApiRequirementsOutput(`${parentName}:${CMD_NAME$v}`)}
+      ${utils.getFlagApiRequirementsOutput(`${parentName}:${CMD_NAME$w}`)}
 
     This feature requires an Enterprise Plan. To learn more about getting access
     to this feature and many more, please visit ${SOCKET_WEBSITE_URL$3}/pricing
@@ -840,7 +840,7 @@ async function run$O(argv, importMeta, {
   const noLegacy = !cli.flags['type'];
   let [typeFilter = ''] = cli.input;
   typeFilter = String(typeFilter);
-  const hasApiToken = utils.hasDefaultToken();
+  const hasApiToken = utils.hasDefaultApiToken();
   const [orgSlug] = await utils.determineOrgSlug(String(orgFlag || ''), interactive, dryRun);
   const outputKind = utils.getOutputKind(json, markdown);
   const wasValidInput = utils.checkCommandInput(outputKind, {
@@ -1028,8 +1028,8 @@ async function fetchScanData(orgSlug, scanId, options) {
         return JSON.parse(line);
       } catch (e) {
         ok = false;
-        require$$6.debugFn('error', 'caught: JSON.parse error');
-        require$$6.debugDir('inspect', {
+        require$$8.debugFn('error', 'caught: JSON.parse error');
+        require$$8.debugDir('inspect', {
           error: e,
           line
         });
@@ -1676,28 +1676,28 @@ sockJson, cwd = process.cwd()) {
     sbt: false
   };
   if (sockJson?.defaults?.manifest?.sbt?.disabled) {
-    require$$6.debugLog('notice', '[DEBUG] - sbt auto-detection is disabled in socket.json');
+    require$$8.debugLog('notice', '[DEBUG] - sbt auto-detection is disabled in socket.json');
   } else if (fs$1.existsSync(path.join(cwd, 'build.sbt'))) {
-    require$$6.debugLog('notice', '[DEBUG] - Detected a Scala sbt build file');
+    require$$8.debugLog('notice', '[DEBUG] - Detected a Scala sbt build file');
     output.sbt = true;
     output.count += 1;
   }
   if (sockJson?.defaults?.manifest?.gradle?.disabled) {
-    require$$6.debugLog('notice', '[DEBUG] - gradle auto-detection is disabled in socket.json');
+    require$$8.debugLog('notice', '[DEBUG] - gradle auto-detection is disabled in socket.json');
   } else if (fs$1.existsSync(path.join(cwd, 'gradlew'))) {
-    require$$6.debugLog('notice', '[DEBUG] - Detected a gradle build file');
+    require$$8.debugLog('notice', '[DEBUG] - Detected a gradle build file');
     output.gradle = true;
     output.count += 1;
   }
   if (sockJson?.defaults?.manifest?.conda?.disabled) {
-    require$$6.debugLog('notice', '[DEBUG] - conda auto-detection is disabled in socket.json');
+    require$$8.debugLog('notice', '[DEBUG] - conda auto-detection is disabled in socket.json');
   } else {
     const envyml = path.join(cwd, 'environment.yml');
     const hasEnvyml = fs$1.existsSync(envyml);
     const envyaml = path.join(cwd, 'environment.yaml');
     const hasEnvyaml = !hasEnvyml && fs$1.existsSync(envyaml);
     if (hasEnvyml || hasEnvyaml) {
-      require$$6.debugLog('notice', '[DEBUG] - Detected an environment.yml Conda file');
+      require$$8.debugLog('notice', '[DEBUG] - Detected an environment.yml Conda file');
       output.conda = true;
       output.count += 1;
     }
@@ -2203,7 +2203,7 @@ async function handleCreateNewScan({
     return;
   }
   logger.logger.success(`Found ${packagePaths.length} local ${words.pluralize('file', packagePaths.length)}`);
-  require$$6.debugDir('inspect', {
+  require$$8.debugDir('inspect', {
     packagePaths
   });
   if (readOnly) {
@@ -2376,9 +2376,9 @@ const config$k = {
 const cmdCI = {
   description: config$k.description,
   hidden: config$k.hidden,
-  run: run$N
+  run: run$O
 };
-async function run$N(argv, importMeta, {
+async function run$O(argv, importMeta, {
   parentName
 }) {
   const cli = utils.meowOrExit({
@@ -2431,7 +2431,7 @@ async function discoverConfigValue(key) {
     };
   }
   if (key === 'defaultOrg') {
-    const hasApiToken = utils.hasDefaultToken();
+    const hasApiToken = utils.hasDefaultApiToken();
     if (!hasApiToken) {
       return {
         ok: false,
@@ -2461,7 +2461,7 @@ async function discoverConfigValue(key) {
     };
   }
   if (key === 'enforcedOrgs') {
-    const hasApiToken = utils.hasDefaultToken();
+    const hasApiToken = utils.hasDefaultApiToken();
     if (!hasApiToken) {
       return {
         ok: false,
@@ -2623,21 +2623,21 @@ async function handleConfigAuto({
 const {
   DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$J
 } = constants;
-const CMD_NAME$u = 'auto';
-const description$A = 'Automatically discover and set the correct value config item';
-const hidden$s = false;
+const CMD_NAME$v = 'auto';
+const description$B = 'Automatically discover and set the correct value config item';
+const hidden$t = false;
 const cmdConfigAuto = {
-  description: description$A,
-  hidden: hidden$s,
-  run: run$M
+  description: description$B,
+  hidden: hidden$t,
+  run: run$N
 };
-async function run$M(argv, importMeta, {
+async function run$N(argv, importMeta, {
   parentName
 }) {
   const config = {
-    commandName: CMD_NAME$u,
-    description: description$A,
-    hidden: hidden$s,
+    commandName: CMD_NAME$v,
+    description: description$B,
+    hidden: hidden$t,
     flags: {
       ...flags.commonFlags,
       ...flags.outputFlags
@@ -2764,9 +2764,9 @@ ${utils.getSupportedConfigEntries().map(([key, desc]) => `     - ${key} -- ${des
 const cmdConfigGet = {
   description: config$j.description,
   hidden: config$j.hidden,
-  run: run$L
+  run: run$M
 };
-async function run$L(argv, importMeta, {
+async function run$M(argv, importMeta, {
   parentName
 }) {
   const cli = utils.meowOrExit({
@@ -2903,9 +2903,9 @@ const config$i = {
 const cmdConfigList = {
   description: config$i.description,
   hidden: config$i.hidden,
-  run: run$K
+  run: run$L
 };
-async function run$K(argv, importMeta, {
+async function run$L(argv, importMeta, {
   parentName
 }) {
   const cli = utils.meowOrExit({
@@ -2982,21 +2982,21 @@ async function handleConfigSet({
 const {
   DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$G
 } = constants;
-const CMD_NAME$t = 'set';
-const description$z = 'Update the value of a local CLI config item';
-const hidden$r = false;
+const CMD_NAME$u = 'set';
+const description$A = 'Update the value of a local CLI config item';
+const hidden$s = false;
 const cmdConfigSet = {
-  description: description$z,
-  hidden: hidden$r,
-  run: run$J
+  description: description$A,
+  hidden: hidden$s,
+  run: run$K
 };
-async function run$J(argv, importMeta, {
+async function run$K(argv, importMeta, {
   parentName
 }) {
   const config = {
-    commandName: CMD_NAME$t,
-    description: description$z,
-    hidden: hidden$r,
+    commandName: CMD_NAME$u,
+    description: description$A,
+    hidden: hidden$s,
     flags: {
       ...flags.commonFlags,
       ...flags.outputFlags
@@ -3109,21 +3109,21 @@ async function handleConfigUnset({
 const {
   DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$F
 } = constants;
-const CMD_NAME$s = 'unset';
-const description$y = 'Clear the value of a local CLI config item';
-const hidden$q = false;
+const CMD_NAME$t = 'unset';
+const description$z = 'Clear the value of a local CLI config item';
+const hidden$r = false;
 const cmdConfigUnset = {
-  description: description$y,
-  hidden: hidden$q,
-  run: run$I
+  description: description$z,
+  hidden: hidden$r,
+  run: run$J
 };
-async function run$I(argv, importMeta, {
+async function run$J(argv, importMeta, {
   parentName
 }) {
   const config = {
-    commandName: CMD_NAME$s,
-    description: description$y,
-    hidden: hidden$q,
+    commandName: CMD_NAME$t,
+    description: description$z,
+    hidden: hidden$r,
     flags: {
       ...flags.commonFlags,
       ...flags.outputFlags
@@ -3182,9 +3182,9 @@ ${utils.getSupportedConfigEntries().map(([key, desc]) => `     - ${key} -- ${des
   });
 }
 
-const description$x = 'Manage Socket CLI configuration';
+const description$y = 'Manage Socket CLI configuration';
 const cmdConfig = {
-  description: description$x,
+  description: description$y,
   hidden: false,
   async run(argv, importMeta, {
     parentName
@@ -3197,74 +3197,13 @@ const cmdConfig = {
       unset: cmdConfigUnset
     }, {
       argv,
-      description: description$x,
+      description: description$y,
       importMeta,
       name: `${parentName} config`
     });
   }
 };
 
-async function coanaFix(fixConfig) {
-  const {
-    ghsas
-  } = fixConfig;
-  if (!ghsas.length) {
-    return {
-      ok: true,
-      data: {
-        fixed: false
-      }
-    };
-  }
-  const {
-    cwd,
-    orgSlug,
-    spinner
-  } = fixConfig;
-  spinner?.start();
-  const sockSdkCResult = await utils.setupSdk();
-  let lastCResult = sockSdkCResult;
-  const sockSdk = sockSdkCResult.ok ? sockSdkCResult.data : undefined;
-  const supportedFilesCResult = sockSdk ? await fetchSupportedScanFileNames() : undefined;
-  if (supportedFilesCResult) {
-    lastCResult = supportedFilesCResult;
-  }
-  const supportedFiles = supportedFilesCResult?.ok ? supportedFilesCResult.data : undefined;
-  const packagePaths = supportedFiles ? await utils.getPackageFilesForScan(['.'], supportedFiles, {
-    cwd
-  }) : [];
-  const uploadCResult = sockSdk ? await utils.handleApiCall(sockSdk?.uploadManifestFiles(orgSlug, packagePaths), {
-    desc: 'upload manifests'
-  }) : undefined;
-  if (uploadCResult) {
-    lastCResult = uploadCResult;
-  }
-  const tarHash = uploadCResult?.ok ? uploadCResult.data.tarHash : '';
-  if (!tarHash) {
-    spinner?.stop();
-    return lastCResult;
-  }
-  const isAllOrAuto = ghsas.length === 1 && (ghsas[0] === 'all' || ghsas[0] === 'auto');
-  const ids = isAllOrAuto ? ['all'] : ghsas;
-  const fixCResult = ids.length ? await utils.spawnCoana(['compute-fixes-and-upgrade-purls', cwd, '--manifests-tar-hash', tarHash, '--apply-fixes-to', ...ids, ...fixConfig.unknownFlags], fixConfig.orgSlug, {
-    cwd,
-    spinner
-  }) : undefined;
-  if (fixCResult) {
-    lastCResult = fixCResult;
-  }
-  spinner?.stop();
-  require$$6.debugDir('inspect', {
-    lastCResult
-  });
-  return lastCResult.ok ? {
-    ok: true,
-    data: {
-      fixed: true
-    }
-  } : lastCResult;
-}
-
 function formatBranchName(name) {
   return name.replace(/[^-a-zA-Z0-9/._-]+/g, '+');
 }
@@ -3352,34 +3291,6 @@ function getSocketPullRequestTitle(purl, newVersion, workspace) {
   return `Bump ${fullName} from ${purlObj.version} to ${newVersion}${workspace ? ` in ${workspace}` : ''}`;
 }
 
-function getPrsForPurl(fixEnv, partialPurl) {
-  if (!fixEnv) {
-    return [];
-  }
-  const prs = [];
-  const partialPurlObj = utils.getPurlObject(partialPurl);
-  const branchFullName = getSocketBranchFullNameComponent(partialPurlObj);
-  const branchPurlType = getSocketBranchPurlTypeComponent(partialPurlObj);
-  for (const pr of fixEnv.prs) {
-    const parsedBranch = genericSocketBranchParser(pr.headRefName);
-    if (branchPurlType === parsedBranch?.type && branchFullName === parsedBranch?.fullName) {
-      prs.push(pr);
-    }
-  }
-  if (require$$6.isDebug('notice,silly')) {
-    const fullName = packages.resolvePackageName(partialPurlObj);
-    if (prs.length) {
-      require$$6.debugFn('notice', `found: ${prs.length} PRs for ${fullName}`);
-      require$$6.debugDir('silly', {
-        prs
-      });
-    } else if (fixEnv.prs.length) {
-      require$$6.debugFn('notice', `miss: 0 PRs found for ${fullName}`);
-    }
-  }
-  return prs;
-}
-
 let _octokit;
 function getOctokit() {
   if (_octokit === undefined) {
@@ -3388,14 +3299,14 @@ function getOctokit() {
       SOCKET_CLI_GITHUB_TOKEN
     } = constants.ENV;
     if (!SOCKET_CLI_GITHUB_TOKEN) {
-      require$$6.debugFn('notice', 'miss: SOCKET_CLI_GITHUB_TOKEN env var');
+      require$$8.debugFn('notice', 'miss: SOCKET_CLI_GITHUB_TOKEN env var');
     }
     const octokitOptions = {
       auth: SOCKET_CLI_GITHUB_TOKEN,
       // Lazily access constants.ENV.GITHUB_API_URL.
       baseUrl: constants.ENV.GITHUB_API_URL
     };
-    require$$6.debugDir('inspect', {
+    require$$8.debugDir('inspect', {
       octokitOptions
     });
     _octokit = new vendor.Octokit(octokitOptions);
@@ -3410,7 +3321,7 @@ function getOctokitGraphql() {
       SOCKET_CLI_GITHUB_TOKEN
     } = constants.ENV;
     if (!SOCKET_CLI_GITHUB_TOKEN) {
-      require$$6.debugFn('notice', 'miss: SOCKET_CLI_GITHUB_TOKEN env var');
+      require$$8.debugFn('notice', 'miss: SOCKET_CLI_GITHUB_TOKEN env var');
     }
     _octokitGraphql = vendor.graphql2.defaults({
       headers: {
@@ -3420,19 +3331,6 @@ function getOctokitGraphql() {
   }
   return _octokitGraphql;
 }
-async function cacheFetch(key, fetcher, ttlMs) {
-  // Optionally disable cache.
-  // Lazily access constants.ENV.DISABLE_GITHUB_CACHE.
-  if (constants.ENV.DISABLE_GITHUB_CACHE) {
-    return await fetcher();
-  }
-  let data = await readCache(key, ttlMs);
-  if (!data) {
-    data = await fetcher();
-    await writeCache(key, data);
-  }
-  return data;
-}
 async function readCache(key,
 // 5 minute in milliseconds time to live (TTL).
 ttlMs = 5 * 60 * 1000) {
@@ -3460,6 +3358,19 @@ async function writeCache(key, data) {
   }
   await fs$2.writeJson(cacheJsonPath, data);
 }
+async function cacheFetch(key, fetcher, ttlMs) {
+  // Optionally disable cache.
+  // Lazily access constants.ENV.DISABLE_GITHUB_CACHE.
+  if (constants.ENV.DISABLE_GITHUB_CACHE) {
+    return await fetcher();
+  }
+  let data = await readCache(key, ttlMs);
+  if (!data) {
+    data = await fetcher();
+    await writeCache(key, data);
+  }
+  return data;
+}
 async function cleanupPrs(owner, repo, options) {
   const contextualMatches = await getSocketPrsWithContext(owner, repo, options);
   if (!contextualMatches.length) {
@@ -3494,14 +3405,14 @@ async function cleanupPrs(owner, repo, options) {
           pull_number: prNum,
           state: 'closed'
         });
-        require$$6.debugFn('notice', `pr: closing ${prRef} for ${prToVersion}`);
+        require$$8.debugFn('notice', `pr: closing ${prRef} for ${prToVersion}`);
         // Remove entry from parent object.
         context.parent.splice(context.index, 1);
         // Mark cache to be saved.
         cachesToSave.set(context.cacheKey, context.data);
         return null;
       } catch (e) {
-        require$$6.debugFn('error', `pr: failed to close ${prRef} for ${prToVersion}\n`, e?.message || 'unknown error');
+        require$$8.debugFn('error', `pr: failed to close ${prRef} for ${prToVersion}\n`, e?.message || 'Unknown error');
       }
     }
     // Update stale PRs.
@@ -3514,7 +3425,7 @@ async function cleanupPrs(owner, repo, options) {
           base: match.headRefName,
           head: match.baseRefName
         });
-        require$$6.debugFn('notice', `pr: updating stale ${prRef}`);
+        require$$8.debugFn('notice', `pr: updating stale ${prRef}`);
         // Update entry entry.
         if (context.apiType === 'graphql') {
           context.entry.mergeStateStatus = 'CLEAN';
@@ -3525,7 +3436,7 @@ async function cleanupPrs(owner, repo, options) {
         cachesToSave.set(context.cacheKey, context.data);
       } catch (e) {
         const message = e?.message || 'Unknown error';
-        require$$6.debugFn('error', `pr: failed to update ${prRef} - ${message}`);
+        require$$8.debugFn('error', `pr: failed to update ${prRef} - ${message}`);
       }
     }
     return match;
@@ -3726,7 +3637,47 @@ async function openPr(owner, repo, branch, purl, newVersion, options) {
       base: baseBranch,
       body: getSocketPullRequestBody(purlObj, newVersion, workspace)
     };
-    require$$6.debugDir('inspect', {
+    require$$8.debugDir('inspect', {
+      octokitPullsCreateParams
+    });
+    return await octokit.pulls.create(octokitPullsCreateParams);
+  } catch (e) {
+    let message = `Failed to open pull request`;
+    const errors = e instanceof vendor.RequestError ? e.response?.data?.['errors'] : undefined;
+    if (Array.isArray(errors) && errors.length) {
+      const details = errors.map(d => `- ${d.message?.trim() ?? `${d.resource}.${d.field} (${d.code})`}`).join('\n');
+      message += `:\n${details}`;
+    }
+    require$$8.debugFn('error', message);
+  }
+  return null;
+}
+async function openCoanaPr(owner, repo, branch, ghsaIds, options) {
+  const {
+    baseBranch = 'main'
+  } = {
+    __proto__: null,
+    ...options
+  };
+  const octokit = getOctokit();
+  const vulnCount = ghsaIds.length;
+  const prTitle = vulnCount === 1 ? `Fix for ${ghsaIds[0]}` : `Fixes for ${vulnCount} GHSAs`;
+  let prBody = '';
+  if (vulnCount === 1) {
+    prBody = `[Socket](https://socket.dev/) fix for [${ghsaIds[0]}](https://github.com/advisories/${ghsaIds[0]}).`;
+  } else {
+    prBody = `[Socket](https://socket.dev/) fixes for ${vulnCount} GHSAs.\n\n**Fixed GHSAs:**\n${ghsaIds.map(id => `- [${id}](https://github.com/advisories/${id})`).join('\n')}`;
+  }
+  try {
+    const octokitPullsCreateParams = {
+      owner,
+      repo,
+      title: prTitle,
+      head: branch,
+      base: baseBranch,
+      body: prBody
+    };
+    require$$8.debugDir('inspect', {
       octokitPullsCreateParams
     });
     return await octokit.pulls.create(octokitPullsCreateParams);
@@ -3737,7 +3688,7 @@ async function openPr(owner, repo, branch, purl, newVersion, options) {
       const details = errors.map(d => `- ${d.message?.trim() ?? `${d.resource}.${d.field} (${d.code})`}`).join('\n');
       message += `:\n${details}`;
     }
-    require$$6.debugFn('error', message);
+    require$$8.debugFn('error', message);
   }
   return null;
 }
@@ -3748,16 +3699,16 @@ async function setGitRemoteGithubRepoUrl(owner, repo, token, cwd = process.cwd()
   const url = `https://x-access-token:${token}@${host}/${owner}/${repo}`;
   const stdioIgnoreOptions = {
     cwd,
-    stdio: require$$6.isDebug('stdio') ? 'inherit' : 'ignore'
+    stdio: require$$8.isDebug('stdio') ? 'inherit' : 'ignore'
   };
   const quotedCmd = `\`git remote set-url origin ${url}\``;
-  require$$6.debugFn('stdio', `spawn: ${quotedCmd}`);
+  require$$8.debugFn('stdio', `spawn: ${quotedCmd}`);
   try {
     await spawn.spawn('git', ['remote', 'set-url', 'origin', url], stdioIgnoreOptions);
     return true;
   } catch (e) {
-    require$$6.debugFn('error', `caught: ${quotedCmd} failed`);
-    require$$6.debugDir('inspect', {
+    require$$8.debugFn('error', `caught: ${quotedCmd} failed`);
+    require$$8.debugDir('inspect', {
       error: e
     });
   }
@@ -3770,7 +3721,7 @@ function ciRepoInfo() {
     GITHUB_REPOSITORY
   } = constants.ENV;
   if (!GITHUB_REPOSITORY) {
-    require$$6.debugFn('notice', 'miss: GITHUB_REPOSITORY env var');
+    require$$8.debugFn('notice', 'miss: GITHUB_REPOSITORY env var');
   }
   const ownerSlashRepo = GITHUB_REPOSITORY;
   const slashIndex = ownerSlashRepo.indexOf('/');
@@ -3794,9 +3745,9 @@ async function getFixEnv() {
   // but some CI checks are passing,
   constants.ENV.CI || gitEmail || gitUser || githubToken) &&
   // then log about it when in debug mode.
-  require$$6.isDebug('notice')) {
+  require$$8.isDebug('notice')) {
     const envVars = [...(constants.ENV.CI ? [] : ['process.env.CI']), ...(gitEmail ? [] : ['process.env.SOCKET_CLI_GIT_USER_EMAIL']), ...(gitUser ? [] : ['process.env.SOCKET_CLI_GIT_USER_NAME']), ...(githubToken ? [] : ['process.env.GITHUB_TOKEN'])];
-    require$$6.debugFn('notice', `miss: fixEnv.isCi is false, expected ${arrays.joinAnd(envVars)} to be set`);
+    require$$8.debugFn('notice', `miss: fixEnv.isCi is false, expected ${arrays.joinAnd(envVars)} to be set`);
   }
   let repoInfo = null;
   if (isCi) {
@@ -3804,7 +3755,7 @@ async function getFixEnv() {
   }
   if (!repoInfo) {
     if (isCi) {
-      require$$6.debugFn('notice', 'falling back to `git remote get-url origin`');
+      require$$8.debugFn('notice', 'falling back to `git remote get-url origin`');
     }
     repoInfo = await utils.getRepoInfo();
   }
@@ -3823,6 +3774,262 @@ async function getFixEnv() {
   };
 }
 
+async function coanaFix(fixConfig) {
+  const {
+    autoMerge,
+    cwd,
+    ghsas,
+    limit,
+    orgSlug,
+    spinner
+  } = fixConfig;
+  const fixEnv = await getFixEnv();
+  require$$8.debugDir('inspect', {
+    fixEnv
+  });
+  spinner?.start();
+  const sockSdkCResult = await utils.setupSdk();
+  if (!sockSdkCResult.ok) {
+    return sockSdkCResult;
+  }
+  const sockSdk = sockSdkCResult.data;
+  const supportedFilesCResult = await fetchSupportedScanFileNames();
+  if (!supportedFilesCResult.ok) {
+    return supportedFilesCResult;
+  }
+  const supportedFiles = supportedFilesCResult.data;
+  const scanFilepaths = await utils.getPackageFilesForScan(['.'], supportedFiles, {
+    cwd
+  });
+  const uploadCResult = await utils.handleApiCall(sockSdk.uploadManifestFiles(orgSlug, scanFilepaths), {
+    desc: 'upload manifests'
+  });
+  if (!uploadCResult.ok) {
+    return uploadCResult;
+  }
+  const tarHash = uploadCResult.data.tarHash;
+  if (!tarHash) {
+    spinner?.stop();
+    return {
+      ok: false,
+      message: 'No tar hash returned from Socket API upload-manifest-files endpoint',
+      data: uploadCResult.data
+    };
+  }
+  const isAll = ghsas.length === 1 && (ghsas[0] === 'all' || ghsas[0] === 'auto');
+  const shouldOpenPrs = fixEnv.isCi && fixEnv.repoInfo;
+  if (!shouldOpenPrs) {
+    const ids = isAll ? ['all'] : ghsas.slice(0, limit);
+    if (!ids.length) {
+      spinner?.stop();
+      return {
+        ok: true,
+        data: {
+          fixed: false
+        }
+      };
+    }
+    const fixCResult = await utils.spawnCoana(['compute-fixes-and-upgrade-purls', cwd, '--manifests-tar-hash', tarHash, '--apply-fixes-to', ...(isAll ? ['all'] : ghsas), ...fixConfig.unknownFlags], fixConfig.orgSlug, {
+      cwd,
+      spinner
+    });
+    spinner?.stop();
+    return fixCResult.ok ? {
+      ok: true,
+      data: {
+        fixed: true
+      }
+    } : fixCResult;
+  }
+  let ids;
+  if (isAll) {
+    const foundCResult = await utils.spawnCoana(['compute-fixes-and-upgrade-purls', cwd, '--manifests-tar-hash', tarHash, ...fixConfig.unknownFlags], fixConfig.orgSlug, {
+      cwd,
+      spinner
+    });
+    if (foundCResult.ok) {
+      const foundIds = utils.cmdFlagValueToArray(/(?<=Vulnerabilities found:).*/.exec(foundCResult.data));
+      ids = foundIds.slice(0, limit);
+    }
+  } else {
+    ids = ghsas.slice(0, limit);
+  }
+  if (!ids?.length) {
+    require$$8.debugFn('notice', 'miss: no GHSA IDs to process');
+  }
+  if (!fixEnv.repoInfo) {
+    require$$8.debugFn('notice', 'miss: no repo info detected');
+  }
+  if (!ids?.length || !fixEnv.repoInfo) {
+    spinner?.stop();
+    return {
+      ok: true,
+      data: {
+        fixed: false
+      }
+    };
+  }
+  const scanBaseNames = new Set(scanFilepaths.map(p => path.basename(p)));
+  let count = 0;
+  let overallFixed = false;
+
+  // Process each GHSA ID individually, similar to npm-fix/pnpm-fix.
+  ghsaLoop: for (let i = 0, {
+      length
+    } = ids; i < length; i += 1) {
+    const id = ids[i];
+    require$$8.debugFn('notice', `Processing GHSA ID: ${id}`);
+
+    // Apply fix for single GHSA ID.
+    // eslint-disable-next-line no-await-in-loop
+    const fixCResult = await utils.spawnCoana(['compute-fixes-and-upgrade-purls', cwd, '--manifests-tar-hash', tarHash, '--apply-fixes-to', id, ...fixConfig.unknownFlags], fixConfig.orgSlug, {
+      cwd,
+      spinner
+    });
+    if (!fixCResult.ok) {
+      logger.logger.error(`Update failed for ${id}: ${fixCResult.message || 'Unknown error'}`);
+      continue ghsaLoop;
+    }
+
+    // Check for modified files after applying the fix.
+    // eslint-disable-next-line no-await-in-loop
+    const unstagedCResult = await utils.gitUnstagedModifiedFiles(cwd);
+    const modifiedFiles = unstagedCResult.ok ? unstagedCResult.data.filter(relPath => scanBaseNames.has(path.basename(relPath))) : [];
+    if (!modifiedFiles.length) {
+      require$$8.debugFn('notice', `skip: no changes for ${id}`);
+      continue ghsaLoop;
+    }
+    overallFixed = true;
+
+    // Create PR if in CI environment
+    try {
+      const branch = `socket/coana-fix/${id}`;
+
+      // Check if branch already exists
+      // eslint-disable-next-line no-await-in-loop
+      if (await utils.gitRemoteBranchExists(branch, cwd)) {
+        require$$8.debugFn('notice', `skip: remote branch "${branch}" exists`);
+        continue ghsaLoop;
+      }
+      require$$8.debugFn('notice', `pr: creating for ${id}`);
+      const pushed =
+      // eslint-disable-next-line no-await-in-loop
+      (await utils.gitCreateBranch(branch, cwd)) && (
+      // eslint-disable-next-line no-await-in-loop
+      await utils.gitCheckoutBranch(branch, cwd)) && (
+      // eslint-disable-next-line no-await-in-loop
+      await utils.gitCommit(`fix: Apply Coana security fix for ${id}`, modifiedFiles, {
+        cwd,
+        email: fixEnv.gitEmail,
+        user: fixEnv.gitUser
+      })) && (
+      // eslint-disable-next-line no-await-in-loop
+      await utils.gitPushBranch(branch, cwd));
+      if (!pushed) {
+        logger.logger.warn(`Push failed for ${id}, skipping PR creation.`);
+        // eslint-disable-next-line no-await-in-loop
+        await utils.gitResetAndClean(fixEnv.baseBranch, cwd);
+        // eslint-disable-next-line no-await-in-loop
+        await utils.gitCheckoutBranch(fixEnv.baseBranch, cwd);
+        // eslint-disable-next-line no-await-in-loop
+        await utils.gitDeleteBranch(branch, cwd);
+        continue ghsaLoop;
+      }
+
+      // Set up git remote.
+      // eslint-disable-next-line no-await-in-loop
+      await setGitRemoteGithubRepoUrl(fixEnv.repoInfo.owner, fixEnv.repoInfo.repo, fixEnv.githubToken, cwd);
+
+      // eslint-disable-next-line no-await-in-loop
+      const prResponse = await openCoanaPr(fixEnv.repoInfo.owner, fixEnv.repoInfo.repo, branch,
+      // Single GHSA ID.
+      [id], {
+        baseBranch: fixEnv.baseBranch,
+        cwd
+      });
+      if (prResponse) {
+        const {
+          data
+        } = prResponse;
+        const prRef = `PR #${data.number}`;
+        logger.logger.success(`Opened ${prRef} for ${id}.`);
+        if (autoMerge) {
+          logger.logger.indent();
+          spinner?.indent();
+          // eslint-disable-next-line no-await-in-loop
+          const {
+            details,
+            enabled
+          } = await enablePrAutoMerge(data);
+          if (enabled) {
+            logger.logger.info(`Auto-merge enabled for ${prRef}.`);
+          } else {
+            const message = `Failed to enable auto-merge for ${prRef}${details ? `:\n${details.map(d => ` - ${d}`).join('\n')}` : '.'}`;
+            logger.logger.error(message);
+          }
+          logger.logger.dedent();
+          spinner?.dedent();
+        }
+      }
+
+      // Reset back to base branch for next iteration.
+      // eslint-disable-next-line no-await-in-loop
+      await utils.gitResetAndClean(branch, cwd);
+      // eslint-disable-next-line no-await-in-loop
+      await utils.gitCheckoutBranch(fixEnv.baseBranch, cwd);
+    } catch (e) {
+      logger.logger.warn(`Unexpected condition: Push failed for ${id}, skipping PR creation.`);
+      require$$8.debugDir('inspect', {
+        error: e
+      });
+      // eslint-disable-next-line no-await-in-loop
+      await utils.gitResetAndClean(fixEnv.baseBranch, cwd);
+      // eslint-disable-next-line no-await-in-loop
+      await utils.gitCheckoutBranch(fixEnv.baseBranch, cwd);
+    }
+    count += 1;
+    require$$8.debugFn('notice', `Processed ${count}/${Math.min(limit, ids.length)} fixes`);
+    if (count >= limit) {
+      break ghsaLoop;
+    }
+  }
+  spinner?.stop();
+  return {
+    ok: true,
+    data: {
+      fixed: overallFixed
+    }
+  };
+}
+
+function getPrsForPurl(fixEnv, partialPurl) {
+  if (!fixEnv) {
+    return [];
+  }
+  const prs = [];
+  const partialPurlObj = utils.getPurlObject(partialPurl);
+  const branchFullName = getSocketBranchFullNameComponent(partialPurlObj);
+  const branchPurlType = getSocketBranchPurlTypeComponent(partialPurlObj);
+  for (const pr of fixEnv.prs) {
+    const parsedBranch = genericSocketBranchParser(pr.headRefName);
+    if (branchPurlType === parsedBranch?.type && branchFullName === parsedBranch?.fullName) {
+      prs.push(pr);
+    }
+  }
+  if (require$$8.isDebug('notice,silly')) {
+    const fullName = packages.resolvePackageName(partialPurlObj);
+    if (prs.length) {
+      require$$8.debugFn('notice', `found: ${prs.length} PRs for ${fullName}`);
+      require$$8.debugDir('silly', {
+        prs
+      });
+    } else if (fixEnv.prs.length) {
+      require$$8.debugFn('notice', `miss: 0 PRs found for ${fullName}`);
+    }
+  }
+  return prs;
+}
+
 async function getActualTree(cwd = process.cwd()) {
   try {
     // @npmcli/arborist DOES have partial support for pnpm structured node_modules
@@ -3936,7 +4143,7 @@ async function agentFix(pkgEnvDetails, actualTree, alertsMap, installer, {
     pkgPath: rootPath
   } = pkgEnvDetails;
   const fixEnv = await getFixEnv();
-  require$$6.debugDir('inspect', {
+  require$$8.debugDir('inspect', {
     fixEnv
   });
   const {
@@ -3952,19 +4159,19 @@ async function agentFix(pkgEnvDetails, actualTree, alertsMap, installer, {
   } = fixConfig;
   let count = 0;
   const infoByPartialPurl = utils.getCveInfoFromAlertsMap(alertsMap, {
-    exclude: {
-      upgradable: true
+    filter: {
+      upgradable: false
     }
   });
   if (!infoByPartialPurl) {
     spinner?.stop();
     logger.logger.info('No fixable vulns found.');
     if (alertsMap.size) {
-      require$$6.debugDir('inspect', {
+      require$$8.debugDir('inspect', {
         alertsMap
       });
     } else {
-      require$$6.debugFn('inspect', '{ alertsMap: Map(0) {} }');
+      require$$8.debugFn('inspect', '{ alertsMap: Map(0) {} }');
     }
     return {
       ok: true,
@@ -3973,14 +4180,14 @@ async function agentFix(pkgEnvDetails, actualTree, alertsMap, installer, {
       }
     };
   }
-  if (require$$6.isDebug('notice,inspect')) {
+  if (require$$8.isDebug('notice,inspect')) {
     spinner?.stop();
     const partialPurls = Array.from(infoByPartialPurl.keys());
     const {
       length: purlsCount
     } = partialPurls;
-    require$$6.debugFn('notice', `found: ${purlsCount} ${words.pluralize('PURL', purlsCount)} with CVEs`);
-    require$$6.debugDir('inspect', {
+    require$$8.debugFn('notice', `found: ${purlsCount} ${words.pluralize('PURL', purlsCount)} with CVEs`);
+    require$$8.debugDir('inspect', {
       partialPurls
     });
     spinner?.start();
@@ -4029,14 +4236,14 @@ async function agentFix(pkgEnvDetails, actualTree, alertsMap, installer, {
     const name = packages.resolvePackageName(partialPurlObj);
     const infos = Array.from(infoEntry[1].values());
     if (!infos.length) {
-      require$$6.debugFn('notice', `miss: CVEs expected, but not found, for ${name}`);
+      require$$8.debugFn('notice', `miss: CVEs expected, but not found, for ${name}`);
       continue infoEntriesLoop;
     }
     logger.logger.log(`Processing '${name}'`);
     logger.logger.indent();
     spinner?.indent();
     if (registry.getManifestData(partialPurlObj.type, name)) {
-      require$$6.debugFn('notice', `found: Socket Optimize variant for ${name}`);
+      require$$8.debugFn('notice', `found: Socket Optimize variant for ${name}`);
     }
     // eslint-disable-next-line no-await-in-loop
     const packument = await packages.fetchPackagePackument(name);
@@ -4046,7 +4253,7 @@ async function agentFix(pkgEnvDetails, actualTree, alertsMap, installer, {
       // Skip to next package.
       continue infoEntriesLoop;
     }
-    require$$6.debugDir('inspect', {
+    require$$8.debugDir('inspect', {
       infos
     });
     const availableVersions = Object.keys(packument.versions);
@@ -4097,7 +4304,7 @@ async function agentFix(pkgEnvDetails, actualTree, alertsMap, installer, {
       }
       const oldVersions = arrays.arrayUnique(shadowNpmInject.findPackageNodes(actualTree, name).map(n => n.version).filter(Boolean));
       if (!oldVersions.length) {
-        require$$6.debugFn('notice', `skip: ${name} not found`);
+        require$$8.debugFn('notice', `skip: ${name} not found`);
         cleanupInfoEntriesLoop();
         // Skip to next package.
         continue infoEntriesLoop;
@@ -4113,8 +4320,8 @@ async function agentFix(pkgEnvDetails, actualTree, alertsMap, installer, {
       const seenVersions = new Set();
       let hasAnnouncedWorkspace = false;
       let workspaceLogCallCount = logger.logger.logCallCount;
-      if (require$$6.isDebug('notice')) {
-        require$$6.debugFn('notice', `check: workspace ${workspace}`);
+      if (require$$8.isDebug('notice')) {
+        require$$8.debugFn('notice', `check: workspace ${workspace}`);
         hasAnnouncedWorkspace = true;
         workspaceLogCallCount = logger.logger.logCallCount;
       }
@@ -4123,7 +4330,7 @@ async function agentFix(pkgEnvDetails, actualTree, alertsMap, installer, {
         const oldPurl = utils.idToPurl(oldId, partialPurlObj.type);
         const node = shadowNpmInject.findPackageNode(actualTree, name, oldVersion);
         if (!node) {
-          require$$6.debugFn('notice', `skip: ${oldId} not found`);
+          require$$8.debugFn('notice', `skip: ${oldId} not found`);
           continue oldVersionsLoop;
         }
         infosLoop: for (const {
@@ -4143,7 +4350,7 @@ async function agentFix(pkgEnvDetails, actualTree, alertsMap, installer, {
             continue infosLoop;
           }
           if (vendor.semverExports.gte(oldVersion, newVersion)) {
-            require$$6.debugFn('silly', `skip: ${oldId} is >= ${newVersion}`);
+            require$$8.debugFn('silly', `skip: ${oldId} is >= ${newVersion}`);
             continue infosLoop;
           }
           const branch = getSocketBranchName(oldPurl, newVersion, workspace);
@@ -4152,14 +4359,14 @@ async function agentFix(pkgEnvDetails, actualTree, alertsMap, installer, {
           }
           const pr = prCheck ? prs.find(p => p.headRefName === branch) : undefined;
           if (pr) {
-            require$$6.debugFn('notice', `skip: PR #${pr.number} for ${name}@${newVersion} exists`);
+            require$$8.debugFn('notice', `skip: PR #${pr.number} for ${name}@${newVersion} exists`);
             seenBranches.add(branch);
             continue infosLoop;
           }
           if (fixEnv.isCi && (
           // eslint-disable-next-line no-await-in-loop
           await utils.gitRemoteBranchExists(branch, cwd))) {
-            require$$6.debugFn('notice', `skip: remote branch "${branch}" for ${name}@${newVersion} exists`);
+            require$$8.debugFn('notice', `skip: remote branch "${branch}" for ${name}@${newVersion} exists`);
             seenBranches.add(branch);
             continue infosLoop;
           }
@@ -4188,7 +4395,7 @@ async function agentFix(pkgEnvDetails, actualTree, alertsMap, installer, {
 
           // eslint-disable-next-line no-await-in-loop
           if (!(await hasModifiedFiles(cwd))) {
-            require$$6.debugFn('notice', `skip: no changes for ${name}@${newVersion}`);
+            require$$8.debugFn('notice', `skip: no changes for ${name}@${newVersion}`);
             seenVersions.add(newVersion);
             // Reset things just in case.
             if (fixEnv.isCi) {
@@ -4244,7 +4451,7 @@ async function agentFix(pkgEnvDetails, actualTree, alertsMap, installer, {
 
           // Check repoInfo to make TypeScript happy.
           if (!errored && fixEnv.isCi && fixEnv.repoInfo) {
-            require$$6.debugFn('notice', 'pr: creating');
+            require$$8.debugFn('notice', 'pr: creating');
             try {
               const pushed =
               // eslint-disable-next-line no-await-in-loop
@@ -4329,7 +4536,7 @@ async function agentFix(pkgEnvDetails, actualTree, alertsMap, installer, {
               errored = true;
             }
           } else if (fixEnv.isCi) {
-            require$$6.debugFn('notice', 'skip: PR creation');
+            require$$8.debugFn('notice', 'skip: PR creation');
           }
           if (fixEnv.isCi) {
             spinner?.start();
@@ -4381,7 +4588,7 @@ async function agentFix(pkgEnvDetails, actualTree, alertsMap, installer, {
           } else {
             changed = true;
           }
-          require$$6.debugFn('notice', 'increment: count', count + 1);
+          require$$8.debugFn('notice', 'increment: count', count + 1);
           if (++count >= limit) {
             cleanupInfoEntriesLoop();
             // Exit main loop.
@@ -4415,20 +4622,18 @@ async function agentFix(pkgEnvDetails, actualTree, alertsMap, installer, {
   };
 }
 
-const CMD_NAME$r = 'socket fix';
+const CMD_NAME$s = 'socket fix';
 function getFixAlertsMapOptions(options = {}) {
   return {
     __proto__: null,
     consolidate: true,
     nothrow: true,
+    onlyFixable: true,
     ...options,
-    include: {
-      __proto__: null,
+    filter: utils.toFilterConfig({
       existing: true,
-      unfixable: false,
-      upgradable: false,
-      ...options?.include
-    }
+      ...require$$9.getOwn(options, 'filter')
+    })
   };
 }
 
@@ -4441,7 +4646,7 @@ async function install$1(pkgEnvDetails, options) {
     __proto__: null,
     ...options
   };
-  const useDebug = require$$6.isDebug('stdio');
+  const useDebug = require$$8.isDebug('stdio');
   const args = [
   // If "true", npm does not run scripts specified in package.json files.
   // Note that commands explicitly intended to run a particular script, such
@@ -4472,7 +4677,7 @@ async function install$1(pkgEnvDetails, options) {
   const wasSpinning = !!spinner?.isSpinning;
   spinner?.stop();
   const quotedCmd = `\`${pkgEnvDetails.agent} install ${args.join(' ')}\``;
-  require$$6.debugFn('stdio', `spawn: ${quotedCmd}`);
+  require$$8.debugFn('stdio', `spawn: ${quotedCmd}`);
   try {
     await utils.runAgentInstall(pkgEnvDetails, {
       args,
@@ -4483,8 +4688,8 @@ async function install$1(pkgEnvDetails, options) {
     const result = {
       error
     };
-    require$$6.debugFn('error', `caught: ${quotedCmd} failed`);
-    require$$6.debugDir('inspect', result);
+    require$$8.debugFn('error', `caught: ${quotedCmd} failed`);
+    require$$8.debugDir('inspect', result);
     return result;
   }
   const treeResult = await getActualTree(cwd);
@@ -4494,8 +4699,8 @@ async function install$1(pkgEnvDetails, options) {
     }
     return treeResult;
   }
-  require$$6.debugFn('error', 'caught: await arb.loadActual() error');
-  require$$6.debugDir('inspect', treeResult);
+  require$$8.debugFn('error', 'caught: await arb.loadActual() error');
+  require$$8.debugDir('inspect', treeResult);
   if (wasSpinning) {
     spinner.start();
   }
@@ -4528,8 +4733,8 @@ async function npmFix(pkgEnvDetails, fixConfig) {
         actualTree = await arb.reify();
       } catch (e) {
         spinner?.stop();
-        require$$6.debugFn('error', 'caught: await arb.reify() error');
-        require$$6.debugDir('inspect', {
+        require$$8.debugFn('error', 'caught: await arb.reify() error');
+        require$$8.debugDir('inspect', {
           error: e
         });
         return {
@@ -4542,8 +4747,8 @@ async function npmFix(pkgEnvDetails, fixConfig) {
     }
   } catch (e) {
     spinner?.stop();
-    require$$6.debugFn('error', 'caught: Socket batch PURL API error');
-    require$$6.debugDir('inspect', {
+    require$$8.debugFn('error', 'caught: Socket batch PURL API error');
+    require$$8.debugDir('inspect', {
       error: e
     });
     return {
@@ -4650,19 +4855,19 @@ async function install(pkgEnvDetails, options) {
   const wasSpinning = !!spinner?.isSpinning;
   spinner?.stop();
   const quotedCmd = `\`${pkgEnvDetails.agent} install ${args.join(' ')}\``;
-  require$$6.debugFn('stdio', `spawn: ${quotedCmd}`);
+  require$$8.debugFn('stdio', `spawn: ${quotedCmd}`);
   try {
     await utils.runAgentInstall(pkgEnvDetails, {
       args,
       spinner,
-      stdio: require$$6.isDebug('stdio') ? 'inherit' : 'ignore'
+      stdio: require$$8.isDebug('stdio') ? 'inherit' : 'ignore'
     });
   } catch (error) {
     const result = {
       error
     };
-    require$$6.debugFn('error', `caught: ${quotedCmd} failed`);
-    require$$6.debugDir('inspect', result);
+    require$$8.debugFn('error', `caught: ${quotedCmd} failed`);
+    require$$8.debugDir('inspect', result);
     return result;
   }
   const treeResult = await getActualTree(cwd);
@@ -4672,8 +4877,8 @@ async function install(pkgEnvDetails, options) {
     }
     return treeResult;
   }
-  require$$6.debugFn('error', 'caught: await arb.loadActual() error');
-  require$$6.debugDir('inspect', treeResult);
+  require$$8.debugFn('error', 'caught: await arb.loadActual() error');
+  require$$8.debugDir('inspect', treeResult);
   if (wasSpinning) {
     spinner.start();
   }
@@ -4726,8 +4931,8 @@ async function pnpmFix(pkgEnvDetails, fixConfig) {
     alertsMap = purls.length ? await utils.getAlertsMapFromPurls(purls, getFixAlertsMapOptions()) : await utils.getAlertsMapFromPnpmLockfile(lockfile, getFixAlertsMapOptions());
   } catch (e) {
     spinner?.stop();
-    require$$6.debugFn('error', 'caught: Socket batch PURL API error');
-    require$$6.debugDir('inspect', {
+    require$$8.debugFn('error', 'caught: Socket batch PURL API error');
+    require$$8.debugDir('inspect', {
       error: e
     });
     return {
@@ -4755,7 +4960,7 @@ async function pnpmFix(pkgEnvDetails, fixConfig) {
         revertOverrides = {
           [PNPM$6]: oldPnpmSection ? {
             ...oldPnpmSection,
-            [OVERRIDES$1]: require$$7.hasKeys(oldOverrides) ? {
+            [OVERRIDES$1]: require$$9.hasKeys(oldOverrides) ? {
               ...oldOverrides,
               [overrideKey]: undefined
             } :
@@ -4856,8 +5061,10 @@ async function handleFix({
 }) {
   if (ghsas.length) {
     await outputFixResult(await coanaFix({
+      autoMerge,
       cwd,
       ghsas,
+      limit,
       orgSlug,
       spinner,
       unknownFlags
@@ -4865,7 +5072,7 @@ async function handleFix({
     return;
   }
   const pkgEnvCResult = await utils.detectAndValidatePackageEnvironment(cwd, {
-    cmdName: CMD_NAME$r,
+    cmdName: CMD_NAME$s,
     logger: logger.logger
   });
   if (!pkgEnvCResult.ok) {
@@ -4883,7 +5090,7 @@ async function handleFix({
     }, outputKind);
     return;
   }
-  require$$6.debugDir('inspect', {
+  require$$8.debugDir('inspect', {
     pkgEnvDetails
   });
 
@@ -4924,24 +5131,24 @@ async function handleFix({
 }
 
 const {
-  DRY_RUN_NOT_SAVING
+  DRY_RUN_NOT_SAVING: DRY_RUN_NOT_SAVING$1
 } = constants;
-const CMD_NAME$q = 'fix';
+const CMD_NAME$r = 'fix';
 const DEFAULT_LIMIT = 10;
-const description$w = 'Update dependencies with "fixable" Socket alerts';
-const hidden$p = false;
+const description$x = 'Update dependencies with "fixable" Socket alerts';
+const hidden$q = false;
 const cmdFix = {
-  description: description$w,
-  hidden: hidden$p,
-  run: run$H
+  description: description$x,
+  hidden: hidden$q,
+  run: run$I
 };
-async function run$H(argv, importMeta, {
+async function run$I(argv, importMeta, {
   parentName
 }) {
   const config = {
-    commandName: CMD_NAME$q,
-    description: description$w,
-    hidden: hidden$p,
+    commandName: CMD_NAME$r,
+    description: description$x,
+    hidden: hidden$q,
     flags: {
       ...flags.commonFlags,
       ...flags.outputFlags,
@@ -5023,7 +5230,7 @@ Available styles:
       $ ${command} [options] [CWD=.]
 
     API Token Requirements
-      ${utils.getFlagApiRequirementsOutput(`${parentName}:${CMD_NAME$q}`)}
+      ${utils.getFlagApiRequirementsOutput(`${parentName}:${CMD_NAME$r}`)}
 
     Options
       ${utils.getFlagListOutput(config.flags)}
@@ -5078,7 +5285,7 @@ Available styles:
     return;
   }
   if (dryRun) {
-    logger.logger.log(DRY_RUN_NOT_SAVING);
+    logger.logger.log(DRY_RUN_NOT_SAVING$1);
     return;
   }
   const orgSlugCResult = await utils.getDefaultOrgSlug();
@@ -5175,9 +5382,9 @@ async function setupTabCompletion(targetName) {
 
   // Target dir is something like ~/.local/share/socket/settings/completion (linux)
   const targetDir = path.dirname(targetPath);
-  require$$6.debugFn('notice', 'target: path + dir', targetPath, targetDir);
+  require$$8.debugFn('notice', 'target: path + dir', targetPath, targetDir);
   if (!fs$1.existsSync(targetDir)) {
-    require$$6.debugFn('notice', 'create: target dir');
+    require$$8.debugFn('notice', 'create: target dir');
     fs$1.mkdirSync(targetDir, {
       recursive: true
     });
@@ -5289,9 +5496,9 @@ const config$h = {
 const cmdInstallCompletion = {
   description: config$h.description,
   hidden: config$h.hidden,
-  run: run$G
+  run: run$H
 };
-async function run$G(argv, importMeta, {
+async function run$H(argv, importMeta, {
   parentName
 }) {
   const cli = utils.meowOrExit({
@@ -5309,9 +5516,9 @@ async function run$G(argv, importMeta, {
   await handleInstallCompletion(String(targetName));
 }
 
-const description$v = 'Install Socket CLI tab completion';
+const description$w = 'Install Socket CLI tab completion';
 const cmdInstall = {
-  description: description$v,
+  description: description$w,
   hidden: false,
   async run(argv, importMeta, {
     parentName
@@ -5320,7 +5527,7 @@ const cmdInstall = {
       completion: cmdInstallCompletion
     }, {
       argv,
-      description: description$v,
+      description: description$w,
       importMeta,
       name: `${parentName} install`
     });
@@ -5372,9 +5579,9 @@ const config$g = {
 const cmdJson = {
   description: config$g.description,
   hidden: config$g.hidden,
-  run: run$F
+  run: run$G
 };
-async function run$F(argv, importMeta, {
+async function run$G(argv, importMeta, {
   parentName
 }) {
   const cli = utils.meowOrExit({
@@ -5534,21 +5741,21 @@ async function attemptLogin(apiBaseUrl, apiProxy) {
 const {
   DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$D
 } = constants;
-const CMD_NAME$p = 'login';
-const description$u = 'Setup Socket CLI with an API token and defaults';
-const hidden$o = false;
+const CMD_NAME$q = 'login';
+const description$v = 'Setup Socket CLI with an API token and defaults';
+const hidden$p = false;
 const cmdLogin = {
-  description: description$u,
-  hidden: hidden$o,
-  run: run$E
+  description: description$v,
+  hidden: hidden$p,
+  run: run$F
 };
-async function run$E(argv, importMeta, {
+async function run$F(argv, importMeta, {
   parentName
 }) {
   const config = {
-    commandName: CMD_NAME$p,
-    description: description$u,
-    hidden: hidden$o,
+    commandName: CMD_NAME$q,
+    description: description$v,
+    hidden: hidden$p,
     flags: {
       ...flags.commonFlags,
       apiBaseUrl: {
@@ -5565,7 +5772,7 @@ async function run$E(argv, importMeta, {
       $ ${command} [options]
 
     API Token Requirements
-      ${utils.getFlagApiRequirementsOutput(`${parentName}:${CMD_NAME$p}`)}
+      ${utils.getFlagApiRequirementsOutput(`${parentName}:${CMD_NAME$q}`)}
 
     Logs into the Socket API by prompting for an API token
 
@@ -5639,9 +5846,9 @@ const config$f = {
 const cmdLogout = {
   description: config$f.description,
   hidden: config$f.hidden,
-  run: run$D
+  run: run$E
 };
-async function run$D(argv, importMeta, {
+async function run$E(argv, importMeta, {
   parentName
 }) {
   const cli = utils.meowOrExit({
@@ -5953,9 +6160,9 @@ const config$e = {
 const cmdManifestCdxgen = {
   description: config$e.description,
   hidden: config$e.hidden,
-  run: run$C
+  run: run$D
 };
-async function run$C(argv, importMeta, {
+async function run$D(argv, importMeta, {
   parentName
 }) {
   const cli = utils.meowOrExit({
@@ -6052,9 +6259,9 @@ const config$d = {
 const cmdManifestAuto = {
   description: config$d.description,
   hidden: config$d.hidden,
-  run: run$B
+  run: run$C
 };
-async function run$B(argv, importMeta, {
+async function run$C(argv, importMeta, {
   parentName
 }) {
   const cli = utils.meowOrExit({
@@ -6086,7 +6293,7 @@ async function run$B(argv, importMeta, {
   }
   const sockJson = utils.readOrDefaultSocketJson(cwd);
   const detected = await detectManifestActions(sockJson, cwd);
-  require$$6.debugDir('inspect', {
+  require$$8.debugDir('inspect', {
     detected
   });
   if (dryRun) {
@@ -6167,9 +6374,9 @@ const config$c = {
 const cmdManifestConda = {
   description: config$c.description,
   hidden: config$c.hidden,
-  run: run$A
+  run: run$B
 };
-async function run$A(argv, importMeta, {
+async function run$B(argv, importMeta, {
   parentName
 }) {
   const cli = utils.meowOrExit({
@@ -6326,9 +6533,9 @@ const config$b = {
 const cmdManifestGradle = {
   description: config$b.description,
   hidden: config$b.hidden,
-  run: run$z
+  run: run$A
 };
-async function run$z(argv, importMeta, {
+async function run$A(argv, importMeta, {
   parentName
 }) {
   const cli = utils.meowOrExit({
@@ -6350,7 +6557,7 @@ async function run$z(argv, importMeta, {
   // If given path is absolute then cwd should not affect it.
   cwd = path.resolve(process.cwd(), cwd);
   const sockJson = utils.readOrDefaultSocketJson(cwd);
-  require$$6.debugFn('inspect', 'override: socket.json gradle', sockJson?.defaults?.manifest?.gradle);
+  require$$8.debugFn('inspect', 'override: socket.json gradle', sockJson?.defaults?.manifest?.gradle);
   let {
     bin,
     gradleOpts,
@@ -6485,9 +6692,9 @@ const config$a = {
 const cmdManifestKotlin = {
   description: config$a.description,
   hidden: config$a.hidden,
-  run: run$y
+  run: run$z
 };
-async function run$y(argv, importMeta, {
+async function run$z(argv, importMeta, {
   parentName
 }) {
   const cli = utils.meowOrExit({
@@ -6509,7 +6716,7 @@ async function run$y(argv, importMeta, {
   // If given path is absolute then cwd should not affect it.
   cwd = path.resolve(process.cwd(), cwd);
   const sockJson = utils.readOrDefaultSocketJson(cwd);
-  require$$6.debugFn('inspect', 'override: socket.json gradle', sockJson?.defaults?.manifest?.gradle);
+  require$$8.debugFn('inspect', 'override: socket.json gradle', sockJson?.defaults?.manifest?.gradle);
   let {
     bin,
     gradleOpts,
@@ -6651,9 +6858,9 @@ const config$9 = {
 const cmdManifestScala = {
   description: config$9.description,
   hidden: config$9.hidden,
-  run: run$x
+  run: run$y
 };
-async function run$x(argv, importMeta, {
+async function run$y(argv, importMeta, {
   parentName
 }) {
   const cli = utils.meowOrExit({
@@ -6675,7 +6882,7 @@ async function run$x(argv, importMeta, {
   // TODO: Implement json/md further.
   const outputKind = utils.getOutputKind(json, markdown);
   const sockJson = utils.readOrDefaultSocketJson(cwd);
-  require$$6.debugFn('inspect', 'override: socket.json sbt', sockJson?.defaults?.manifest?.sbt);
+  require$$8.debugFn('inspect', 'override: socket.json sbt', sockJson?.defaults?.manifest?.sbt);
   let {
     bin,
     out,
@@ -6775,7 +6982,7 @@ async function outputManifestSetup(result) {
 
 async function setupManifestConfig(cwd, defaultOnReadError = false) {
   const detected = await detectManifestActions(null, cwd);
-  require$$6.debugDir('inspect', {
+  require$$8.debugDir('inspect', {
     detected
   });
 
@@ -7215,9 +7422,9 @@ const config$8 = {
 const cmdManifestSetup = {
   description: config$8.description,
   hidden: config$8.hidden,
-  run: run$w
+  run: run$x
 };
-async function run$w(argv, importMeta, {
+async function run$x(argv, importMeta, {
   parentName
 }) {
   const cli = utils.meowOrExit({
@@ -7251,9 +7458,9 @@ const config$7 = {
 const cmdManifest = {
   description: config$7.description,
   hidden: config$7.hidden,
-  run: run$v
+  run: run$w
 };
-async function run$v(argv, importMeta, {
+async function run$w(argv, importMeta, {
   parentName
 }) {
   await utils.meowWithSubcommands({
@@ -7284,21 +7491,21 @@ const require$3 = require$$5.createRequire(require('node:url').pathToFileURL(__f
 const {
   DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$u
 } = constants;
-const CMD_NAME$o = 'npm';
-const description$t = 'Run npm with the Socket wrapper';
-const hidden$n = false;
+const CMD_NAME$p = 'npm';
+const description$u = 'Run npm with the Socket wrapper';
+const hidden$o = false;
 const cmdNpm = {
-  description: description$t,
-  hidden: hidden$n,
-  run: run$u
+  description: description$u,
+  hidden: hidden$o,
+  run: run$v
 };
-async function run$u(argv, importMeta, {
+async function run$v(argv, importMeta, {
   parentName
 }) {
   const config = {
-    commandName: CMD_NAME$o,
-    description: description$t,
-    hidden: hidden$n,
+    commandName: CMD_NAME$p,
+    description: description$u,
+    hidden: hidden$o,
     flags: {
       ...flags.commonFlags
     },
@@ -7307,7 +7514,7 @@ async function run$u(argv, importMeta, {
       $ ${command} ...
 
     API Token Requirements
-      ${utils.getFlagApiRequirementsOutput(`${parentName}:${CMD_NAME$o}`)}
+      ${utils.getFlagApiRequirementsOutput(`${parentName}:${CMD_NAME$p}`)}
 
     Note: Everything after "npm" is passed to the npm command.
           Only the \`--dry-run\` and \`--help\` flags are caught here.
@@ -7340,21 +7547,21 @@ const require$2 = require$$5.createRequire(require('node:url').pathToFileURL(__f
 const {
   DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$t
 } = constants;
-const CMD_NAME$n = 'npx';
-const description$s = 'Run npx with the Socket wrapper';
-const hidden$m = false;
+const CMD_NAME$o = 'npx';
+const description$t = 'Run npx with the Socket wrapper';
+const hidden$n = false;
 const cmdNpx = {
-  description: description$s,
-  hidden: hidden$m,
-  run: run$t
+  description: description$t,
+  hidden: hidden$n,
+  run: run$u
 };
-async function run$t(argv, importMeta, {
+async function run$u(argv, importMeta, {
   parentName
 }) {
   const config = {
-    commandName: CMD_NAME$n,
-    description: description$s,
-    hidden: hidden$m,
+    commandName: CMD_NAME$o,
+    description: description$t,
+    hidden: hidden$n,
     flags: {
       ...flags.commonFlags
     },
@@ -7363,7 +7570,7 @@ async function run$t(argv, importMeta, {
       $ ${command} ...
 
     API Token Requirements
-      ${utils.getFlagApiRequirementsOutput(`${parentName}:${CMD_NAME$n}`)}
+      ${utils.getFlagApiRequirementsOutput(`${parentName}:${CMD_NAME$o}`)}
 
     Note: Everything after "npx" is passed to the npx command.
           Only the \`--dry-run\` and \`--help\` flags are caught here.
@@ -7417,9 +7624,9 @@ const config$6 = {
 const cmdOops = {
   description: config$6.description,
   hidden: config$6.hidden,
-  run: run$s
+  run: run$t
 };
-async function run$s(argv, importMeta, {
+async function run$t(argv, importMeta, {
   parentName
 }) {
   const cli = utils.meowOrExit({
@@ -7760,7 +7967,7 @@ async function listPackages(pkgEnvDetails, options) {
   }
 }
 
-const CMD_NAME$m = 'socket optimize';
+const CMD_NAME$n = 'socket optimize';
 
 const {
   BUN,
@@ -7787,8 +7994,8 @@ function updatePkgJsonField(editablePkgJson, field, value) {
   if (oldValue) {
     // The field already exists so we simply update the field value.
     if (field === PNPM$1) {
-      const isPnpmObj = require$$7.isObject(oldValue);
-      if (require$$7.hasKeys(value)) {
+      const isPnpmObj = require$$9.isObject(oldValue);
+      if (require$$9.hasKeys(value)) {
         editablePkgJson.update({
           [field]: {
             ...(isPnpmObj ? oldValue : {}),
@@ -7800,7 +8007,7 @@ function updatePkgJsonField(editablePkgJson, field, value) {
         });
       } else {
         // Properties with undefined values are deleted when saved as JSON.
-        editablePkgJson.update(require$$7.hasKeys(oldValue) ? {
+        editablePkgJson.update(require$$9.hasKeys(oldValue) ? {
           [field]: {
             ...(isPnpmObj ? oldValue : {}),
             overrides: undefined
@@ -7812,7 +8019,7 @@ function updatePkgJsonField(editablePkgJson, field, value) {
     } else if (field === OVERRIDES || field === RESOLUTIONS) {
       // Properties with undefined values are deleted when saved as JSON.
       editablePkgJson.update({
-        [field]: require$$7.hasKeys(value) ? value : undefined
+        [field]: require$$9.hasKeys(value) ? value : undefined
       });
     } else {
       editablePkgJson.update({
@@ -7821,7 +8028,7 @@ function updatePkgJsonField(editablePkgJson, field, value) {
     }
     return;
   }
-  if ((field === OVERRIDES || field === PNPM$1 || field === RESOLUTIONS) && !require$$7.hasKeys(value)) {
+  if ((field === OVERRIDES || field === PNPM$1 || field === RESOLUTIONS) && !require$$9.hasKeys(value)) {
     return;
   }
   // Since the field doesn't exist we want to insert it into the package.json
@@ -7935,7 +8142,7 @@ async function addOverrides(pkgEnvDetails, pkgPath, options) {
   npmExecPath === NPM && !state.warnedPnpmWorkspaceRequiresNpm) {
     state.warnedPnpmWorkspaceRequiresNpm = true;
     spinner?.stop();
-    logger?.warn(utils.cmdPrefixMessage(CMD_NAME$m, `${agent} workspace support requires \`npm ls\`, falling back to \`${agent} list\``));
+    logger?.warn(utils.cmdPrefixMessage(CMD_NAME$n, `${agent} workspace support requires \`npm ls\`, falling back to \`${agent} list\``));
     spinner?.start();
   }
   const overridesDataObjects = [];
@@ -7956,7 +8163,7 @@ async function addOverrides(pkgEnvDetails, pkgPath, options) {
   let loggedAddingText = false;
 
   // Chunk package names to process them in parallel 3 at a time.
-  await require$$8.pEach(manifestEntries, async ({
+  await require$$10.pEach(manifestEntries, async ({
     1: data
   }) => {
     const {
@@ -7970,11 +8177,11 @@ async function addOverrides(pkgEnvDetails, pkgPath, options) {
     for (const {
       1: depObj
     } of depEntries) {
-      const sockSpec = require$$7.hasOwn(depObj, sockRegPkgName) ? depObj[sockRegPkgName] : undefined;
+      const sockSpec = require$$9.hasOwn(depObj, sockRegPkgName) ? depObj[sockRegPkgName] : undefined;
       if (sockSpec) {
         depAliasMap.set(sockRegPkgName, sockSpec);
       }
-      const origSpec = require$$7.hasOwn(depObj, origPkgName) ? depObj[origPkgName] : undefined;
+      const origSpec = require$$9.hasOwn(depObj, origPkgName) ? depObj[origPkgName] : undefined;
       if (origSpec) {
         let thisSpec = origSpec;
         // Add package aliases for direct dependencies to avoid npm EOVERRIDE
@@ -8010,11 +8217,11 @@ async function addOverrides(pkgEnvDetails, pkgPath, options) {
         npmExecPath
       });
       // Chunk package names to process them in parallel 3 at a time.
-      await require$$8.pEach(overridesDataObjects, async ({
+      await require$$10.pEach(overridesDataObjects, async ({
         overrides,
         type
       }) => {
-        const overrideExists = require$$7.hasOwn(overrides, origPkgName);
+        const overrideExists = require$$9.hasOwn(overrides, origPkgName);
         if (overrideExists || thingScanner(pkgEnvDetails, thingToScan, origPkgName, lockName)) {
           const oldSpec = overrideExists ? overrides[origPkgName] : undefined;
           const origDepAlias = depAliasMap.get(origPkgName);
@@ -8068,7 +8275,7 @@ async function addOverrides(pkgEnvDetails, pkgPath, options) {
   });
   if (isWorkspace) {
     // Chunk package names to process them in parallel 3 at a time.
-    await require$$8.pEach(workspacePkgJsonPaths, async workspacePkgJsonPath => {
+    await require$$10.pEach(workspacePkgJsonPaths, async workspacePkgJsonPath => {
       const otherState = await addOverrides(pkgEnvDetails, path.dirname(workspacePkgJsonPath), {
         logger,
         pin,
@@ -8091,7 +8298,7 @@ async function addOverrides(pkgEnvDetails, pkgPath, options) {
         overrides,
         type
       } of overridesDataObjects) {
-        updateManifest(type, pkgEnvDetails.editablePkgJson, require$$7.toSortedObject(overrides));
+        updateManifest(type, pkgEnvDetails.editablePkgJson, require$$9.toSortedObject(overrides));
       }
     }
     await pkgEnvDetails.editablePkgJson.save();
@@ -8123,8 +8330,8 @@ async function updateLockfile(pkgEnvDetails, options) {
     }
   } catch (e) {
     spinner?.stop();
-    require$$6.debugFn('error', 'fail: update');
-    require$$6.debugDir('inspect', {
+    require$$8.debugFn('error', 'fail: update');
+    require$$8.debugDir('inspect', {
       error: e
     });
     if (wasSpinning) {
@@ -8166,7 +8373,7 @@ async function applyOptimization(pkgEnvDetails, {
   const pkgJsonChanged = addedCount > 0 || updatedCount > 0;
   if (pkgJsonChanged || pkgEnvDetails.features.npmBuggyOverrides) {
     const result = await updateLockfile(pkgEnvDetails, {
-      cmdName: CMD_NAME$m,
+      cmdName: CMD_NAME$n,
       logger: logger.logger,
       spinner
     });
@@ -8228,7 +8435,7 @@ async function handleOptimize({
   prod
 }) {
   const pkgEnvCResult = await utils.detectAndValidatePackageEnvironment(cwd, {
-    cmdName: CMD_NAME$m,
+    cmdName: CMD_NAME$n,
     logger: logger.logger,
     prod
   });
@@ -8253,7 +8460,7 @@ async function handleOptimize({
     await outputOptimizeResult({
       ok: false,
       message: 'Unsupported',
-      cause: utils.cmdPrefixMessage(CMD_NAME$m, `${agent} v${agentVersion} does not support overrides.`)
+      cause: utils.cmdPrefixMessage(CMD_NAME$n, `${agent} v${agentVersion} does not support overrides.`)
     }, outputKind);
     return;
   }
@@ -8267,21 +8474,21 @@ async function handleOptimize({
 const {
   DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$r
 } = constants;
-const CMD_NAME$l = 'optimize';
-const description$r = 'Optimize dependencies with @socketregistry overrides';
-const hidden$l = false;
+const CMD_NAME$m = 'optimize';
+const description$s = 'Optimize dependencies with @socketregistry overrides';
+const hidden$m = false;
 const cmdOptimize = {
-  description: description$r,
-  hidden: hidden$l,
-  run: run$r
+  description: description$s,
+  hidden: hidden$m,
+  run: run$s
 };
-async function run$r(argv, importMeta, {
+async function run$s(argv, importMeta, {
   parentName
 }) {
   const config = {
-    commandName: CMD_NAME$l,
-    description: description$r,
-    hidden: hidden$l,
+    commandName: CMD_NAME$m,
+    description: description$s,
+    hidden: hidden$m,
     flags: {
       ...flags.commonFlags,
       pin: {
@@ -8300,7 +8507,7 @@ async function run$r(argv, importMeta, {
       $ ${command} [options] [CWD=.]
 
     API Token Requirements
-      ${utils.getFlagApiRequirementsOutput(`${parentName}:${CMD_NAME$l}`)}
+      ${utils.getFlagApiRequirementsOutput(`${parentName}:${CMD_NAME$m}`)}
 
     Options
       ${utils.getFlagListOutput(config.flags)}
@@ -8446,21 +8653,21 @@ async function handleDependencies({
 const {
   DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$q
 } = constants;
-const CMD_NAME$k = 'dependencies';
-const description$q = 'Search for any dependency that is being used in your organization';
-const hidden$k = false;
+const CMD_NAME$l = 'dependencies';
+const description$r = 'Search for any dependency that is being used in your organization';
+const hidden$l = false;
 const cmdOrganizationDependencies = {
-  description: description$q,
-  hidden: hidden$k,
-  run: run$q
+  description: description$r,
+  hidden: hidden$l,
+  run: run$r
 };
-async function run$q(argv, importMeta, {
+async function run$r(argv, importMeta, {
   parentName
 }) {
   const config = {
-    commandName: CMD_NAME$k,
-    description: description$q,
-    hidden: hidden$k,
+    commandName: CMD_NAME$l,
+    description: description$r,
+    hidden: hidden$l,
     flags: {
       ...flags.commonFlags,
       limit: {
@@ -8480,7 +8687,7 @@ async function run$q(argv, importMeta, {
       ${command} [options]
 
     API Token Requirements
-      ${utils.getFlagApiRequirementsOutput(`${parentName}:${CMD_NAME$k}`)}
+      ${utils.getFlagApiRequirementsOutput(`${parentName}:${CMD_NAME$l}`)}
 
     Options
       ${utils.getFlagListOutput(config.flags)}
@@ -8503,7 +8710,7 @@ async function run$q(argv, importMeta, {
     offset
   } = cli.flags;
   const dryRun = !!cli.flags['dryRun'];
-  const hasApiToken = utils.hasDefaultToken();
+  const hasApiToken = utils.hasDefaultApiToken();
   const outputKind = utils.getOutputKind(json, markdown);
   const wasValidInput = utils.checkCommandInput(outputKind, {
     nook: true,
@@ -8583,21 +8790,21 @@ async function handleLicensePolicy(orgSlug, outputKind) {
 const {
   DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$p
 } = constants;
-const CMD_NAME$j = 'license';
-const description$p = 'Retrieve the license policy of an organization';
-const hidden$j = false;
+const CMD_NAME$k = 'license';
+const description$q = 'Retrieve the license policy of an organization';
+const hidden$k = false;
 const cmdOrganizationPolicyLicense = {
-  description: description$p,
-  hidden: hidden$j,
-  run: run$p
+  description: description$q,
+  hidden: hidden$k,
+  run: run$q
 };
-async function run$p(argv, importMeta, {
+async function run$q(argv, importMeta, {
   parentName
 }) {
   const config = {
-    commandName: CMD_NAME$j,
-    description: description$p,
-    hidden: hidden$j,
+    commandName: CMD_NAME$k,
+    description: description$q,
+    hidden: hidden$k,
     flags: {
       ...flags.commonFlags,
       ...flags.outputFlags,
@@ -8616,7 +8823,7 @@ async function run$p(argv, importMeta, {
       $ ${command} [options]
 
     API Token Requirements
-      ${utils.getFlagApiRequirementsOutput(`${parentName}:${CMD_NAME$j}`)}
+      ${utils.getFlagApiRequirementsOutput(`${parentName}:${CMD_NAME$k}`)}
 
     Options
       ${utils.getFlagListOutput(config.flags)}
@@ -8642,7 +8849,7 @@ async function run$p(argv, importMeta, {
   } = cli.flags;
   const dryRun = !!cli.flags['dryRun'];
   const interactive = !!cli.flags['interactive'];
-  const hasApiToken = utils.hasDefaultToken();
+  const hasApiToken = utils.hasDefaultApiToken();
   const [orgSlug] = await utils.determineOrgSlug(String(orgFlag || ''), interactive, dryRun);
   const outputKind = utils.getOutputKind(json, markdown);
   const wasValidInput = utils.checkCommandInput(outputKind, {
@@ -8720,21 +8927,21 @@ async function handleSecurityPolicy(orgSlug, outputKind) {
 const {
   DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$o
 } = constants;
-const CMD_NAME$i = 'security';
-const description$o = 'Retrieve the security policy of an organization';
-const hidden$i = true;
+const CMD_NAME$j = 'security';
+const description$p = 'Retrieve the security policy of an organization';
+const hidden$j = true;
 const cmdOrganizationPolicySecurity = {
-  description: description$o,
-  hidden: hidden$i,
-  run: run$o
+  description: description$p,
+  hidden: hidden$j,
+  run: run$p
 };
-async function run$o(argv, importMeta, {
+async function run$p(argv, importMeta, {
   parentName
 }) {
   const config = {
-    commandName: CMD_NAME$i,
-    description: description$o,
-    hidden: hidden$i,
+    commandName: CMD_NAME$j,
+    description: description$p,
+    hidden: hidden$j,
     flags: {
       ...flags.commonFlags,
       ...flags.outputFlags,
@@ -8753,7 +8960,7 @@ async function run$o(argv, importMeta, {
       $ ${command} [options]
 
     API Token Requirements
-      ${utils.getFlagApiRequirementsOutput(`${parentName}:${CMD_NAME$i}`)}
+      ${utils.getFlagApiRequirementsOutput(`${parentName}:${CMD_NAME$j}`)}
 
     Options
       ${utils.getFlagListOutput(config.flags)}
@@ -8779,7 +8986,7 @@ async function run$o(argv, importMeta, {
   } = cli.flags;
   const dryRun = !!cli.flags['dryRun'];
   const interactive = !!cli.flags['interactive'];
-  const hasApiToken = utils.hasDefaultToken();
+  const hasApiToken = utils.hasDefaultApiToken();
   const [orgSlug] = await utils.determineOrgSlug(String(orgFlag || ''), interactive, dryRun);
   const outputKind = utils.getOutputKind(json, markdown);
   const wasValidInput = utils.checkCommandInput(outputKind, {
@@ -8858,21 +9065,21 @@ async function handleOrganizationList(outputKind = 'text') {
 const {
   DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$n
 } = constants;
-const CMD_NAME$h = 'list';
-const description$n = 'List organizations associated with the Socket API token';
-const hidden$h = false;
+const CMD_NAME$i = 'list';
+const description$o = 'List organizations associated with the Socket API token';
+const hidden$i = false;
 const cmdOrganizationList = {
-  description: description$n,
-  hidden: hidden$h,
-  run: run$n
+  description: description$o,
+  hidden: hidden$i,
+  run: run$o
 };
-async function run$n(argv, importMeta, {
+async function run$o(argv, importMeta, {
   parentName
 }) {
   const config = {
-    commandName: CMD_NAME$h,
-    description: description$n,
-    hidden: hidden$h,
+    commandName: CMD_NAME$i,
+    description: description$o,
+    hidden: hidden$i,
     flags: {
       ...flags.commonFlags,
       ...flags.outputFlags
@@ -8882,7 +9089,7 @@ async function run$n(argv, importMeta, {
       $ ${command} [options]
 
     API Token Requirements
-      ${utils.getFlagApiRequirementsOutput(`${parentName}:${CMD_NAME$h}`)}
+      ${utils.getFlagApiRequirementsOutput(`${parentName}:${CMD_NAME$i}`)}
 
     Options
       ${utils.getFlagListOutput(config.flags)}
@@ -8903,7 +9110,7 @@ async function run$n(argv, importMeta, {
     markdown
   } = cli.flags;
   const dryRun = !!cli.flags['dryRun'];
-  const hasApiToken = utils.hasDefaultToken();
+  const hasApiToken = utils.hasDefaultApiToken();
   const outputKind = utils.getOutputKind(json, markdown);
   const wasValidInput = utils.checkCommandInput(outputKind, {
     nook: true,
@@ -8926,9 +9133,9 @@ async function run$n(argv, importMeta, {
   await handleOrganizationList(outputKind);
 }
 
-const description$m = 'Organization policy details';
+const description$n = 'Organization policy details';
 const cmdOrganizationPolicy = {
-  description: description$m,
+  description: description$n,
   // Hidden because it was broken all this time (nobody could be using it)
   // and we're not sure if it's useful to anyone in its current state.
   // Until we do, we'll hide this to keep the help tidier.
@@ -8942,7 +9149,7 @@ const cmdOrganizationPolicy = {
       license: cmdOrganizationPolicyLicense
     }, {
       argv,
-      description: description$m,
+      description: description$n,
       defaultSub: 'list',
       // Backwards compat
       importMeta,
@@ -9022,9 +9229,9 @@ const config$5 = {
 const cmdOrganizationQuota = {
   description: config$5.description,
   hidden: config$5.hidden,
-  run: run$m
+  run: run$n
 };
-async function run$m(argv, importMeta, {
+async function run$n(argv, importMeta, {
   parentName
 }) {
   const cli = utils.meowOrExit({
@@ -9036,7 +9243,7 @@ async function run$m(argv, importMeta, {
   const dryRun = !!cli.flags['dryRun'];
   const json = Boolean(cli.flags['json']);
   const markdown = Boolean(cli.flags['markdown']);
-  const hasApiToken = utils.hasDefaultToken();
+  const hasApiToken = utils.hasDefaultApiToken();
   const outputKind = utils.getOutputKind(json, markdown);
   const wasValidInput = utils.checkCommandInput(outputKind, {
     nook: true,
@@ -9059,9 +9266,9 @@ async function run$m(argv, importMeta, {
   await handleQuota(outputKind);
 }
 
-const description$l = 'Manage Socket organization account details';
+const description$m = 'Manage Socket organization account details';
 const cmdOrganization = {
-  description: description$l,
+  description: description$m,
   hidden: false,
   async run(argv, importMeta, {
     parentName
@@ -9090,7 +9297,7 @@ const cmdOrganization = {
         }
       },
       argv,
-      description: description$l,
+      description: description$m,
       importMeta,
       name: `${parentName} organization`
     });
@@ -9318,21 +9525,21 @@ function parsePackageSpecifiers(ecosystem, pkgs) {
 const {
   DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$l
 } = constants;
-const CMD_NAME$g = 'score';
-const description$k = 'Look up score for one package which reflects all of its transitive dependencies as well';
-const hidden$g = false;
+const CMD_NAME$h = 'score';
+const description$l = 'Look up score for one package which reflects all of its transitive dependencies as well';
+const hidden$h = false;
 const cmdPackageScore = {
-  description: description$k,
-  hidden: hidden$g,
-  run: run$l
+  description: description$l,
+  hidden: hidden$h,
+  run: run$m
 };
-async function run$l(argv, importMeta, {
+async function run$m(argv, importMeta, {
   parentName
 }) {
   const config = {
-    commandName: CMD_NAME$g,
-    description: description$k,
-    hidden: hidden$g,
+    commandName: CMD_NAME$h,
+    description: description$l,
+    hidden: hidden$h,
     flags: {
       ...flags.commonFlags,
       ...flags.outputFlags
@@ -9342,7 +9549,7 @@ async function run$l(argv, importMeta, {
       $ ${command} [options] <<ECOSYSTEM> <NAME> | <PURL>>
 
     API Token Requirements
-      ${utils.getFlagApiRequirementsOutput(`${parentName}:${CMD_NAME$g}`)}
+      ${utils.getFlagApiRequirementsOutput(`${parentName}:${CMD_NAME$h}`)}
 
     Options
       ${utils.getFlagListOutput(config.flags)}
@@ -9385,7 +9592,7 @@ async function run$l(argv, importMeta, {
   } = cli.flags;
   const dryRun = !!cli.flags['dryRun'];
   const [ecosystem = '', purl] = cli.input;
-  const hasApiToken = utils.hasDefaultToken();
+  const hasApiToken = utils.hasDefaultApiToken();
   const outputKind = utils.getOutputKind(json, markdown);
   const {
     purls,
@@ -9492,7 +9699,7 @@ function formatReportCard(artifact, colorize) {
     colorize
   });
   if (!artifact.ecosystem) {
-    require$$6.debugFn('notice', 'miss: artifact ecosystem', artifact);
+    require$$8.debugFn('notice', 'miss: artifact ecosystem', artifact);
   }
   const purl = `pkg:${artifact.ecosystem}/${artifact.name}${artifact.version ? '@' + artifact.version : ''}`;
 
@@ -9703,28 +9910,28 @@ async function handlePurlsShallowScore({
 const {
   DRY_RUN_BAILING_NOW: DRY_RUN_BAILING_NOW$k
 } = constants;
-const CMD_NAME$f = 'shallow';
-const description$j = 'Look up info regarding one or more packages but not their transitives';
-const hidden$f = false;
+const CMD_NAME$g = 'shallow';
+const description$k = 'Look up info regarding one or more packages but not their transitives';
+const hidden$g = false;
 const cmdPackageShallow = {
-  description: description$j,
-  hidden: hidden$f,
+  description: description$k,
+  hidden: hidden$g,
   alias: {
     shallowScore: {
-      description: description$j,
+      description: description$k,
       hidden: true,
       argv: []
     }
   },
-  run: run$k
+  run: run$l
 };
-async function run$k(argv, importMeta, {
+async function run$l(argv, importMeta, {
   parentName
 }) {
   const config = {
-    commandName: CMD_NAME$f,
-    description: description$j,
-    hidden: hidden$f,
+    commandName: CMD_NAME$g,
+    description: description$k,
+    hidden: hidden$g,
     flags: {
       ...flags.commonFlags,
       ...flags.outputFlags
@@ -9734,7 +9941,7 @@ async function run$k(argv, importMeta, {
       $ ${command} [options] <<ECOSYSTEM> <PKGNAME> [<PKGNAME> ...] | <PURL> [<PURL> ...]>
 
     API Token Requirements
-      ${utils.getFlagApiRequirementsOutput(`${parentName}:${CMD_NAME$f}`)}
+      ${utils.getFlagApiRequirementsOutput(`${parentName}:${CMD_NAME$g}`)}
 
     Options
       ${utils.getFlagListOutput(config.flags)}
@@ -9808,9 +10015,9 @@ async function run$k(argv, importMeta, {
   });
 }
 
-const description$i = 'Look up published package details';
+const description$j = 'Look up published package details';
 const cmdPackage = {
-  description: description$i,
+  description: description$j,
   hidden: false,
   async run(argv, importMeta, {
     parentName
@@ -9821,19 +10028,166 @@ const cmdPackage = {
     }, {
       aliases: {
         deep: {
-          description: description$i,
+          description: description$j,
           hidden: true,
           argv: ['score']
         }
       },
       argv,
-      description: description$i,
+      description: description$j,
       importMeta,
       name: `${parentName} package`
     });
   }
 };
 
+async function outputPatchResult(result, outputKind) {
+  if (!result.ok) {
+    process.exitCode = result.code ?? 1;
+  }
+  if (outputKind === 'json') {
+    logger.logger.log(utils.serializeResultJson(result));
+    return;
+  }
+  if (!result.ok) {
+    logger.logger.fail(utils.failMsgWithBadge(result.message, result.cause));
+    return;
+  }
+  const {
+    patchedPackages
+  } = result.data;
+  if (patchedPackages.length > 0) {
+    logger.logger.success(`Successfully processed patches for ${patchedPackages.length} package(s):`);
+    for (const pkg of patchedPackages) {
+      logger.logger.success(pkg);
+    }
+  } else {
+    logger.logger.info('No packages found requiring patches');
+  }
+  logger.logger.log('');
+  logger.logger.success('Patch command completed!');
+}
+
+async function handlePatch({
+  outputKind,
+  packages,
+  spinner
+}) {
+  spinner.start('Analyzing dependencies for security patches...');
+  try {
+    // TODO: Implement actual patch logic
+    // This is a stub implementation
+    const result = {
+      ok: true,
+      data: {
+        patchedPackages: packages.length > 0 ? packages : ['example-package']
+      }
+    };
+    spinner.stop();
+    logger.logger.log('');
+    if (packages.length > 0) {
+      logger.logger.info(`Checking patches for: ${packages.join(', ')}`);
+    } else {
+      logger.logger.info('Scanning all dependencies for available patches');
+    }
+    logger.logger.log('');
+    await outputPatchResult(result, outputKind);
+  } catch (e) {
+    spinner.stop();
+    const result = {
+      ok: false,
+      code: 1,
+      message: 'Failed to apply patches',
+      cause: e?.message || 'Unknown error'
+    };
+    await outputPatchResult(result, outputKind);
+  }
+}
+
+const {
+  DRY_RUN_NOT_SAVING
+} = constants;
+const CMD_NAME$f = 'patch';
+const description$i = 'Apply CVE patches to dependencies';
+const hidden$f = true;
+const cmdPatch = {
+  description: description$i,
+  hidden: hidden$f,
+  run: run$k
+};
+async function run$k(argv, importMeta, {
+  parentName
+}) {
+  const config = {
+    commandName: CMD_NAME$f,
+    description: description$i,
+    hidden: hidden$f,
+    flags: {
+      ...flags.commonFlags,
+      ...flags.outputFlags,
+      package: {
+        type: 'string',
+        default: [],
+        description: 'Specify packages to patch, as either a comma separated value or as multiple flags',
+        isMultiple: true,
+        shortFlag: 'p'
+      }
+    },
+    help: (command, config) => `
+    Usage
+      $ ${command} [options] [CWD=.]
+
+    API Token Requirements
+      ${utils.getFlagApiRequirementsOutput(`${parentName}:${CMD_NAME$f}`)}
+
+    Options
+      ${utils.getFlagListOutput(config.flags)}
+
+    Examples
+      $ ${command}
+      $ ${command} --package lodash
+      $ ${command} ./proj/tree --package lodash,react
+    `
+  };
+  const cli = utils.meowOrExit({
+    allowUnknownFlags: false,
+    argv,
+    config,
+    importMeta,
+    parentName
+  });
+  const dryRun = !!cli.flags['dryRun'];
+  const outputKind = utils.getOutputKind(cli.flags['json'], cli.flags['markdown']);
+  const wasValidInput = utils.checkCommandInput(outputKind, {
+    nook: true,
+    test: !cli.flags['json'] || !cli.flags['markdown'],
+    message: 'The json and markdown flags cannot be both set, pick one',
+    fail: 'omit one'
+  });
+  if (!wasValidInput) {
+    return;
+  }
+  if (dryRun) {
+    logger.logger.log(DRY_RUN_NOT_SAVING);
+    return;
+  }
+  let [cwd = '.'] = cli.input;
+  // Note: path.resolve vs .join:
+  // If given path is absolute then cwd should not affect it.
+  cwd = path.resolve(process.cwd(), cwd);
+
+  // Lazily access constants.spinner.
+  const {
+    spinner
+  } = constants;
+  const packages = Array.isArray(cli.flags['package']) ? cli.flags['package'].flatMap(p => String(p).split(',')) : String(cli.flags['package'] || '').split(',').filter(Boolean);
+  await handlePatch({
+    outputKind,
+    packages,
+    spinner
+  });
+}
+
 async function runRawNpm(argv) {
   const spawnPromise = spawn.spawn(utils.getNpmBinPath(), argv, {
     // Lazily access constants.WIN32.
@@ -10115,7 +10469,7 @@ async function run$h(argv, importMeta, {
   const interactive = !!cli.flags['interactive'];
   const noLegacy = !cli.flags['repoName'];
   const [repoName = ''] = cli.input;
-  const hasApiToken = utils.hasDefaultToken();
+  const hasApiToken = utils.hasDefaultApiToken();
   const [orgSlug] = await utils.determineOrgSlug(String(orgFlag || ''), interactive, dryRun);
   const outputKind = utils.getOutputKind(json, markdown);
   const wasValidInput = utils.checkCommandInput(outputKind, {
@@ -10252,7 +10606,7 @@ async function run$g(argv, importMeta, {
   const interactive = !!cli.flags['interactive'];
   const noLegacy = !cli.flags['repoName'];
   const [repoName = ''] = cli.input;
-  const hasApiToken = utils.hasDefaultToken();
+  const hasApiToken = utils.hasDefaultApiToken();
   const [orgSlug] = await utils.determineOrgSlug(String(orgFlag || ''), interactive, dryRun);
   const outputKind = utils.getOutputKind(json, markdown);
   const wasValidInput = utils.checkCommandInput(outputKind, {
@@ -10545,7 +10899,7 @@ async function run$f(argv, importMeta, {
   } = cli.flags;
   const dryRun = !!cli.flags['dryRun'];
   const interactive = !!cli.flags['interactive'];
-  const hasApiToken = utils.hasDefaultToken();
+  const hasApiToken = utils.hasDefaultApiToken();
   const [orgSlug] = await utils.determineOrgSlug(String(orgFlag || ''), interactive, dryRun);
   const outputKind = utils.getOutputKind(json, markdown);
   const wasValidInput = utils.checkCommandInput(outputKind, {
@@ -10741,7 +11095,7 @@ async function run$e(argv, importMeta, {
   const interactive = !!cli.flags['interactive'];
   const noLegacy = !cli.flags['repoName'];
   const [repoName = ''] = cli.input;
-  const hasApiToken = utils.hasDefaultToken();
+  const hasApiToken = utils.hasDefaultApiToken();
   const [orgSlug] = await utils.determineOrgSlug(String(orgFlag || ''), interactive, dryRun);
   const outputKind = utils.getOutputKind(json, markdown);
   const wasValidInput = utils.checkCommandInput(outputKind, {
@@ -10904,7 +11258,7 @@ async function run$d(argv, importMeta, {
   const interactive = !!cli.flags['interactive'];
   const noLegacy = !cli.flags['repoName'];
   const [repoName = ''] = cli.input;
-  const hasApiToken = utils.hasDefaultToken();
+  const hasApiToken = utils.hasDefaultApiToken();
   const [orgSlug] = await utils.determineOrgSlug(String(orgFlag || ''), interactive, dryRun);
   const outputKind = utils.getOutputKind(json, markdown);
   const wasValidInput = utils.checkCommandInput(outputKind, {
@@ -11265,7 +11619,7 @@ async function run$c(argv, importMeta, {
   // We're going to need an api token to suggest data because those suggestions
   // must come from data we already know. Don't error on missing api token yet.
   // If the api-token is not set, ignore it for the sake of suggestions.
-  const hasApiToken = utils.hasDefaultToken();
+  const hasApiToken = utils.hasDefaultApiToken();
   const outputKind = utils.getOutputKind(json, markdown);
   const pendingHead = tmp ? false : pendingHeadFlag;
 
@@ -11481,7 +11835,7 @@ async function run$b(argv, importMeta, {
   const dryRun = !!cli.flags['dryRun'];
   const interactive = !!cli.flags['interactive'];
   const [scanId = ''] = cli.input;
-  const hasApiToken = utils.hasDefaultToken();
+  const hasApiToken = utils.hasDefaultApiToken();
   const [orgSlug, defaultOrgSlug] = await utils.determineOrgSlug(String(orgFlag || ''), interactive, dryRun);
   const outputKind = utils.getOutputKind(json, markdown);
   const wasValidInput = utils.checkCommandInput(outputKind, {
@@ -11636,13 +11990,15 @@ async function handleMarkdown(data) {
       logger.logger.log(`  ... and ${data.artifacts.updated.length - 10} more`);
     }
   }
-  logger.logger.log(`- Unchanged packages: ${data.artifacts.unchanged.length}`);
-  if (data.artifacts.unchanged.length > 0) {
-    data.artifacts.unchanged.slice(0, 10).forEach(artifact => {
+  const unchanged = data.artifacts.unchanged ?? [];
+  logger.logger.log(`- Unchanged packages: ${unchanged.length}`);
+  if (unchanged.length > 0) {
+    const firstUpToTen = unchanged.slice(0, 10);
+    for (const artifact of firstUpToTen) {
       logger.logger.log(`  - ${artifact.type} ${artifact.name}@${artifact.version}`);
-    });
-    if (data.artifacts.unchanged.length > 10) {
-      logger.logger.log(`  ... and ${data.artifacts.unchanged.length - 10} more`);
+    }
+    if (unchanged.length > 10) {
+      logger.logger.log(`  ... and ${unchanged.length - 10} more`);
     }
   }
   logger.logger.log('');
@@ -11789,7 +12145,7 @@ async function run$a(argv, importMeta, {
   if (id2.startsWith(SOCKET_SBOM_URL_PREFIX)) {
     id2 = id2.slice(SOCKET_SBOM_URL_PREFIX_LENGTH);
   }
-  const hasApiToken = utils.hasDefaultToken();
+  const hasApiToken = utils.hasDefaultApiToken();
   const [orgSlug] = await utils.determineOrgSlug(String(orgFlag || ''), interactive, dryRun);
   const outputKind = utils.getOutputKind(json, markdown);
   const wasValidInput = utils.checkCommandInput(outputKind, {
@@ -11968,7 +12324,7 @@ async function scanOneRepo(repoSlug, {
     };
   }
   const tmpDir = fs$1.mkdtempSync(path.join(os.tmpdir(), repoSlug));
-  require$$6.debugFn('notice', 'init: temp dir for scan root', tmpDir);
+  require$$8.debugFn('notice', 'init: temp dir for scan root', tmpDir);
   const downloadResult = await testAndDownloadManifestFiles({
     files,
     tmpDir,
@@ -12089,11 +12445,11 @@ async function testAndDownloadManifestFile({
   repoApiUrl,
   tmpDir
 }) {
-  require$$6.debugFn('notice', 'testing: file', file);
+  require$$8.debugFn('notice', 'testing: file', file);
   const supportedFilesCResult = await fetchSupportedScanFileNames();
   const supportedFiles = supportedFilesCResult.ok ? supportedFilesCResult.data : undefined;
   if (!supportedFiles || !utils.isReportSupportedFile(file, supportedFiles)) {
-    require$$6.debugFn('notice', '  - skip: not a known pattern');
+    require$$8.debugFn('notice', 'skip: not a known pattern');
     // Not an error.
     return {
       ok: true,
@@ -12102,7 +12458,7 @@ async function testAndDownloadManifestFile({
       }
     };
   }
-  require$$6.debugFn('notice', 'found: manifest file, going to attempt to download it;', file);
+  require$$8.debugFn('notice', 'found: manifest file, going to attempt to download it;', file);
   const result = await downloadManifestFile({
     file,
     tmpDir,
@@ -12124,9 +12480,9 @@ async function downloadManifestFile({
   repoApiUrl,
   tmpDir
 }) {
-  require$$6.debugFn('notice', 'request: download url from GitHub');
+  require$$8.debugFn('notice', 'request: download url from GitHub');
   const fileUrl = `${repoApiUrl}/contents/${file}?ref=${defaultBranch}`;
-  require$$6.debugDir('inspect', {
+  require$$8.debugDir('inspect', {
     fileUrl
   });
   const downloadUrlResponse = await fetch(fileUrl, {
@@ -12135,9 +12491,9 @@ async function downloadManifestFile({
       Authorization: `Bearer ${githubToken}`
     }
   });
-  require$$6.debugFn('notice', 'complete: request');
+  require$$8.debugFn('notice', 'complete: request');
   const downloadUrlText = await downloadUrlResponse.text();
-  require$$6.debugFn('inspect', 'response: raw download url', downloadUrlText);
+  require$$8.debugFn('inspect', 'response: raw download url', downloadUrlText);
   let downloadUrl;
   try {
     downloadUrl = JSON.parse(downloadUrlText).download_url;
@@ -12150,7 +12506,7 @@ async function downloadManifestFile({
     };
   }
   const localPath = path.join(tmpDir, file);
-  require$$6.debugFn('notice', 'download: manifest file started', downloadUrl, '->', localPath);
+  require$$8.debugFn('notice', 'download: manifest file started', downloadUrl, '->', localPath);
 
   // Now stream the file to that file...
   const result = await streamDownloadWithFetch(localPath, downloadUrl);
@@ -12159,7 +12515,7 @@ async function downloadManifestFile({
     logger.logger.fail(`Failed to download manifest file, skipping to next file. File: ${file}`);
     return result;
   }
-  require$$6.debugFn('notice', 'download: manifest file completed');
+  require$$8.debugFn('notice', 'download: manifest file completed');
   return {
     ok: true,
     data: undefined
@@ -12211,7 +12567,7 @@ async function streamDownloadWithFetch(localPath, downloadUrl) {
     };
   } catch (error) {
     logger.logger.fail('An error was thrown while trying to download a manifest file... url:', downloadUrl);
-    require$$6.debugDir('inspect', {
+    require$$8.debugDir('inspect', {
       error
     });
 
@@ -12235,7 +12591,7 @@ async function streamDownloadWithFetch(localPath, downloadUrl) {
       // If error was due to bad HTTP status
       detailedError += ` (HTTP Status: ${response.status} ${response.statusText})`;
     }
-    require$$6.debugFn('error', detailedError);
+    require$$8.debugFn('error', detailedError);
     return {
       ok: false,
       message: 'Download Failed',
@@ -12252,14 +12608,14 @@ async function getLastCommitDetails({
 }) {
   logger.logger.info(`Requesting last commit for default branch ${defaultBranch} for ${orgGithub}/${repoSlug}...`);
   const commitApiUrl = `${repoApiUrl}/commits?sha=${defaultBranch}&per_page=1`;
-  require$$6.debugFn('inspect', 'url: commit', commitApiUrl);
+  require$$8.debugFn('inspect', 'url: commit', commitApiUrl);
   const commitResponse = await fetch(commitApiUrl, {
     headers: {
       Authorization: `Bearer ${githubToken}`
     }
   });
   const commitText = await commitResponse.text();
-  require$$6.debugFn('inspect', 'response: commit', commitText);
+  require$$8.debugFn('inspect', 'response: commit', commitText);
   let lastCommit;
   try {
     lastCommit = JSON.parse(commitText)?.[0];
@@ -12346,7 +12702,7 @@ async function getRepoDetails({
   repoSlug
 }) {
   const repoApiUrl = `${githubApiUrl}/repos/${orgGithub}/${repoSlug}`;
-  require$$6.debugDir('inspect', {
+  require$$8.debugDir('inspect', {
     repoApiUrl
   });
   const repoDetailsResponse = await fetch(repoApiUrl, {
@@ -12357,7 +12713,7 @@ async function getRepoDetails({
   });
   logger.logger.success(`Request completed.`);
   const repoDetailsText = await repoDetailsResponse.text();
-  require$$6.debugFn('inspect', 'response: repo', repoDetailsText);
+  require$$8.debugFn('inspect', 'response: repo', repoDetailsText);
   let repoDetails;
   try {
     repoDetails = JSON.parse(repoDetailsText);
@@ -12396,7 +12752,7 @@ async function getRepoBranchTree({
 }) {
   logger.logger.info(`Requesting default branch file tree; branch \`${defaultBranch}\`, repo \`${orgGithub}/${repoSlug}\`...`);
   const treeApiUrl = `${repoApiUrl}/git/trees/${defaultBranch}?recursive=1`;
-  require$$6.debugFn('inspect', 'url: tree', treeApiUrl);
+  require$$8.debugFn('inspect', 'url: tree', treeApiUrl);
   const treeResponse = await fetch(treeApiUrl, {
     method: 'GET',
     headers: {
@@ -12404,7 +12760,7 @@ async function getRepoBranchTree({
     }
   });
   const treeText = await treeResponse.text();
-  require$$6.debugFn('inspect', 'response: tree', treeText);
+  require$$8.debugFn('inspect', 'response: tree', treeText);
   let treeDetails;
   try {
     treeDetails = JSON.parse(treeText);
@@ -12433,7 +12789,7 @@ async function getRepoBranchTree({
     };
   }
   if (!treeDetails.tree || !Array.isArray(treeDetails.tree)) {
-    require$$6.debugDir('inspect', {
+    require$$8.debugDir('inspect', {
       treeDetails: {
         tree: treeDetails.tree
       }
@@ -12627,7 +12983,7 @@ async function run$9(argv, importMeta, {
   // We're going to need an api token to suggest data because those suggestions
   // must come from data we already know. Don't error on missing api token yet.
   // If the api-token is not set, ignore it for the sake of suggestions.
-  const hasSocketApiToken = utils.hasDefaultToken();
+  const hasSocketApiToken = utils.hasDefaultApiToken();
   const outputKind = utils.getOutputKind(json, markdown);
 
   // If the current cwd is unknown and is used as a repo slug anyways, we will
@@ -12905,7 +13261,7 @@ async function run$8(argv, importMeta, {
   const noLegacy = !cli.flags['repo'];
   const [repo = '', branchArg = ''] = cli.input;
   const branch = String(branchFlag || branchArg || '');
-  const hasApiToken = utils.hasDefaultToken();
+  const hasApiToken = utils.hasDefaultApiToken();
   const [orgSlug] = await utils.determineOrgSlug(String(orgFlag || ''), interactive, dryRun);
   const outputKind = utils.getOutputKind(json, markdown);
   const wasValidInput = utils.checkCommandInput(outputKind, {
@@ -13065,7 +13421,7 @@ async function run$7(argv, importMeta, {
   const dryRun = !!cli.flags['dryRun'];
   const interactive = !!cli.flags['interactive'];
   const [scanId = ''] = cli.input;
-  const hasApiToken = utils.hasDefaultToken();
+  const hasApiToken = utils.hasDefaultApiToken();
   const [orgSlug] = await utils.determineOrgSlug(String(orgFlag || ''), interactive, dryRun);
   const outputKind = utils.getOutputKind(json, markdown);
   const wasValidInput = utils.checkCommandInput(outputKind, {
@@ -13277,7 +13633,7 @@ async function run$6(argv, importMeta, {
     targets = await suggestTarget();
   }
   const [orgSlug] = await utils.determineOrgSlug(String(orgFlag || ''), interactive, dryRun);
-  const hasApiToken = utils.hasDefaultToken();
+  const hasApiToken = utils.hasDefaultApiToken();
   const outputKind = utils.getOutputKind(json, markdown);
   const wasValidInput = utils.checkCommandInput(outputKind, {
     nook: true,
@@ -13426,7 +13782,7 @@ async function run$5(argv, importMeta, {
   const dryRun = !!cli.flags['dryRun'];
   const interactive = !!cli.flags['interactive'];
   const [scanId = '', file = ''] = cli.input;
-  const hasApiToken = utils.hasDefaultToken();
+  const hasApiToken = utils.hasDefaultApiToken();
   const [orgSlug] = await utils.determineOrgSlug(String(orgFlag || ''), interactive, dryRun);
   const outputKind = utils.getOutputKind(json, markdown);
   const wasValidInput = utils.checkCommandInput(outputKind, {
@@ -13848,8 +14204,8 @@ async function fetchScan(orgSlug, scanId) {
       return JSON.parse(line);
     } catch (e) {
       ok = false;
-      require$$6.debugFn('error', 'caught: JSON.parse error');
-      require$$6.debugDir('inspect', {
+      require$$8.debugFn('error', 'caught: JSON.parse error');
+      require$$8.debugDir('inspect', {
         error: e,
         line
       });
@@ -14036,7 +14392,7 @@ async function run$3(argv, importMeta, {
   const dryRun = !!cli.flags['dryRun'];
   const interactive = !!cli.flags['interactive'];
   const [scanId = '', file = ''] = cli.input;
-  const hasApiToken = utils.hasDefaultToken();
+  const hasApiToken = utils.hasDefaultApiToken();
   const [orgSlug] = await utils.determineOrgSlug(String(orgFlag || ''), interactive, dryRun);
   const outputKind = utils.getOutputKind(json, markdown);
   const wasValidInput = utils.checkCommandInput(outputKind, {
@@ -14475,7 +14831,7 @@ async function run$2(argv, importMeta, {
   if (argSet.size) {
     logger.logger.info(`Warning: ignoring these excessive args: ${Array.from(argSet).join(', ')}`);
   }
-  const hasApiToken = utils.hasDefaultToken();
+  const hasApiToken = utils.hasDefaultApiToken();
   const [orgSlug] = await utils.determineOrgSlug(String(orgFlag || ''), interactive, dryRun);
   const outputKind = utils.getOutputKind(json, markdown);
   const wasValidInput = utils.checkCommandInput(outputKind, {
@@ -14740,8 +15096,8 @@ Do you want to install "safe npm" (this will create an alias to the socket-npm c
       }
     }
   } catch (e) {
-    require$$6.debugFn('error', 'caught: tab completion setup error');
-    require$$6.debugDir('inspect', {
+    require$$8.debugFn('error', 'caught: tab completion setup error');
+    require$$8.debugDir('inspect', {
       error: e
     });
     // Ignore. Skip tab completion setup.
@@ -14934,6 +15290,7 @@ const rootCommands = {
   optimize: cmdOptimize,
   organization: cmdOrganization,
   package: cmdPackage,
+  patch: cmdPatch,
   'raw-npm': cmdRawNpm,
   'raw-npx': cmdRawNpx,
   repository: cmdRepository,
@@ -15048,8 +15405,8 @@ void (async () => {
     });
   } catch (e) {
     process.exitCode = 1;
-    require$$6.debugFn('error', 'Uncaught error (BAD!):');
-    require$$6.debugDir('inspect', {
+    require$$8.debugFn('error', 'Uncaught error (BAD!):');
+    require$$8.debugDir('inspect', {
       error: e
     });
     let errorBody;
@@ -15095,7 +15452,7 @@ void (async () => {
       logger.logger.error('\n');
       logger.logger.fail(utils.failMsgWithBadge(errorTitle, errorMessage));
       if (errorBody) {
-        require$$6.debugDir('inspect', {
+        require$$8.debugDir('inspect', {
           errorBody
         });
       }
@@ -15103,5 +15460,5 @@ void (async () => {
     await utils.captureException(e);
   }
 })();
-//# debugId=9a03c00b-a929-45e3-8075-54853c769f02
+//# debugId=293e0fae-5f8d-4051-915d-b3c213feafed
 //# sourceMappingURL=cli.js.map