socket 1.1.141 → 1.1.143

package/CHANGELOG.md

@@ -4,6 +4,20 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## [1.1.143](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.143) - 2026-07-10
+
+### Changed
+- Updated the Coana CLI to v `15.8.8`.
+
+## [1.1.142](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.142) - 2026-07-10
+
+### Added
+- The `socket manifest` commands (`auto`, `gradle`, `kotlin`, `maven`, `scala`) now accept `--exclude-paths`, keeping excluded subprojects and their dependencies out of generated manifests.
+
+### Fixed
+- `--exclude-paths` is now fully honored across JVM, .NET, and Rust reachability analysis: excluded directories no longer contribute dependencies, code, or framework resources to scan results. Includes an update of the Coana CLI to v `15.8.7`.
+- Invalid `--exclude-paths` glob patterns are rejected with a clear error instead of failing mid-scan.
+
 ## [1.1.141](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.141) - 2026-07-10
 
 ### Changed

package/dist/cli.js

@@ -955,12 +955,50 @@ function applyFullExcludePaths({
 // silently producing an empty scan or a no-op exclusion.
 const DEGENERATE_EXCLUDE_PATHS = new Set(['', '.', './', './**', '/', '**', '/**']);
 
+/**
+ * NIO glob syntax (used by the JVM manifest producers) throws on unbalanced
+ * `[`/`{` and nested `{...}` groups, where micromatch silently falls back to a
+ * literal match. Detect those shapes so the CLI can reject them up front
+ * instead of crashing mid-build inside gradle/maven/sbt. Backslashes are
+ * normalized to `/` throughout the pipeline, so no escape handling is needed.
+ */
+function hasNioIncompatibleGlobBrackets(pattern) {
+  let braceDepth = 0;
+  for (let i = 0; i < pattern.length; i += 1) {
+    const ch = pattern[i];
+    if (ch === '[') {
+      let j = i + 1;
+      if (pattern[j] === '!' || pattern[j] === '^') {
+        j += 1;
+      }
+      // NIO glob has no literal-`]`-first convention: `[]x` / `[!]x` throws
+      // as an empty/unclosed class.
+      if (j >= pattern.length || pattern[j] === ']') {
+        return true;
+      }
+      const close = pattern.indexOf(']', j + 1);
+      if (close === -1) {
+        return true;
+      }
+      i = close;
+    } else if (ch === '{') {
+      braceDepth += 1;
+      if (braceDepth > 1) {
+        return true;
+      }
+    } else if (ch === '}' && braceDepth > 0) {
+      braceDepth -= 1;
+    }
+  }
+  return braceDepth !== 0;
+}
+
 /**
  * Validates --exclude-paths entries before they reach either exclusion sink.
  * Rejects gitignore-style negations (coana's --exclude-dirs has no negation
  * form), absolute paths (the flag is scan-root relative), patterns escaping
- * the scan root via `..`, and degenerate match-everything sentinels like `.`,
- * `**`, `/`.
+ * the scan root via `..`, degenerate match-everything sentinels like `.`,
+ * `**`, `/`, and bracket shapes the JVM producers' NIO glob parser rejects.
  */
 function assertValidExcludePaths(paths) {
   for (const p of paths) {
@@ -977,6 +1015,9 @@ function assertValidExcludePaths(paths) {
     if (posix === '..' || posix.startsWith('../') || posix.includes('/../')) {
       throw new utils.InputError(`--exclude-paths cannot escape the scan root with '..'. Got: '${p}'.`);
     }
+    if (hasNioIncompatibleGlobBrackets(posix)) {
+      throw new utils.InputError(`--exclude-paths contains a glob with unbalanced or nested '[' / '{' brackets: '${p}'. Note that '{a,b}' alternations are not supported (values are comma-split).`);
+    }
   }
 }
 
@@ -5336,6 +5377,11 @@ function commonProps(opts, prefix) {
   if (opts.excludeConfigs) {
     props.push(`${prefix}socket.excludeConfigs=${opts.excludeConfigs}`);
   }
+  if (opts.excludePaths?.length) {
+    // CSV: `--exclude-paths` is comma-split at the CLI, so an entry can never
+    // contain a comma.
+    props.push(`${prefix}socket.excludePaths=${opts.excludePaths.join(',')}`);
+  }
   return props;
 }
 async function runGradle(opts) {
@@ -5466,6 +5512,7 @@ async function runManifestFacts({
   cwd,
   ecosystem,
   excludeConfigs,
+  excludePaths,
   ignoreUnresolved,
   includeConfigs,
   sidecarAcc,
@@ -5477,6 +5524,7 @@ async function runManifestFacts({
   const scriptOpts = {
     bin: bin || undefined,
     excludeConfigs: excludeConfigs || undefined,
+    excludePaths: excludePaths?.length ? excludePaths : undefined,
     includeConfigs: includeConfigs || undefined,
     projectDir: cwd,
     // Stream the build tool's output only when asked; otherwise capture it and
@@ -5587,6 +5635,7 @@ async function convertGradleToFacts({
   bin,
   cwd,
   excludeConfigs,
+  excludePaths,
   gradleOpts,
   ignoreUnresolved,
   includeConfigs,
@@ -5600,6 +5649,7 @@ async function convertGradleToFacts({
     cwd,
     ecosystem: 'gradle',
     excludeConfigs,
+    excludePaths,
     ignoreUnresolved,
     includeConfigs,
     sidecarAcc,
@@ -5613,6 +5663,7 @@ async function convertMavenToFacts({
   bin,
   cwd,
   excludeConfigs,
+  excludePaths,
   ignoreUnresolved,
   includeConfigs,
   mavenOpts,
@@ -5626,6 +5677,7 @@ async function convertMavenToFacts({
     cwd,
     ecosystem: 'maven',
     excludeConfigs,
+    excludePaths,
     ignoreUnresolved,
     includeConfigs,
     sidecarAcc,
@@ -5641,6 +5693,7 @@ async function convertSbtToFacts({
   bin,
   cwd,
   excludeConfigs,
+  excludePaths,
   ignoreUnresolved,
   includeConfigs,
   sbtOpts,
@@ -5654,6 +5707,7 @@ async function convertSbtToFacts({
     cwd,
     ecosystem: 'sbt',
     excludeConfigs,
+    excludePaths,
     ignoreUnresolved,
     includeConfigs,
     sidecarAcc,
@@ -5665,6 +5719,7 @@ async function convertSbtToFacts({
 async function convertGradleToMaven({
   bin,
   cwd,
+  excludePaths,
   gradleOpts,
   verbose
 }) {
@@ -5693,7 +5748,11 @@ async function convertGradleToMaven({
     // I'd prefer something plain-text if it is to be committed.
     // Note: init.gradle will be exported by .config/rollup.dist.config.mjs
     const initLocation = path.join(constants.default.distPath, 'init.gradle');
-    const commandArgs = ['--init-script', initLocation, ...gradleOpts, 'pom'];
+    // CSV: `--exclude-paths` is comma-split at the CLI, so an entry can never
+    // contain a comma. The init script skips POM generation for excluded
+    // subprojects.
+    const excludeProps = excludePaths?.length ? [`-Psocket.excludePaths=${excludePaths.join(',')}`] : [];
+    const commandArgs = ['--init-script', initLocation, ...excludeProps, ...gradleOpts, 'pom'];
     if (verbose) {
       logger.logger.log('[VERBOSE] Executing:', [bin], ', args:', commandArgs);
     }
@@ -6175,6 +6234,7 @@ async function generateAutoManifest({
   computeArtifactsSidecar,
   cwd,
   detected,
+  excludePaths,
   outputKind,
   verbose
 }) {
@@ -6205,6 +6265,7 @@ async function generateAutoManifest({
       await convertSbtToFacts({
         ...sbtArgs,
         excludeConfigs: sockJson.defaults?.manifest?.sbt?.excludeConfigs ?? '',
+        excludePaths,
         ignoreUnresolved: Boolean(sockJson.defaults?.manifest?.sbt?.ignoreUnresolved),
         includeConfigs: sockJson.defaults?.manifest?.sbt?.includeConfigs ?? '',
         sidecarAcc,
@@ -6237,6 +6298,7 @@ async function generateAutoManifest({
       await convertGradleToFacts({
         ...gradleArgs,
         excludeConfigs: sockJson.defaults?.manifest?.gradle?.excludeConfigs ?? '',
+        excludePaths,
         ignoreUnresolved: Boolean(sockJson.defaults?.manifest?.gradle?.ignoreUnresolved),
         includeConfigs: sockJson.defaults?.manifest?.gradle?.includeConfigs ?? '',
         sidecarAcc,
@@ -6258,6 +6320,7 @@ async function generateAutoManifest({
       bin: sockJson.defaults?.manifest?.maven?.bin ?? resolveBuildToolBin('maven', cwd),
       cwd,
       excludeConfigs: sockJson.defaults?.manifest?.maven?.excludeConfigs ?? '',
+      excludePaths,
       ignoreUnresolved: Boolean(sockJson.defaults?.manifest?.maven?.ignoreUnresolved),
       includeConfigs: sockJson.defaults?.manifest?.maven?.includeConfigs ?? '',
       mavenOpts: parseBuildToolOpts(sockJson.defaults?.manifest?.maven?.mavenOpts),
@@ -6399,6 +6462,7 @@ async function handleCreateNewScan({
       computeArtifactsSidecar: reach.runReachabilityAnalysis,
       cwd,
       detected,
+      excludePaths: reach.excludePaths,
       outputKind,
       verbose: false
     });
@@ -11307,12 +11371,125 @@ async function run$G(argv, importMeta, {
   evaluateEcosystemOutcomes(outcomes, wasExplicitEcosystemSelection);
 }
 
+const reachabilityFlags = {
+  reachVersion: {
+    type: 'string',
+    description: `Override the version of @coana-tech/cli used for reachability analysis. Default: ${constants.default.ENV.INLINED_SOCKET_CLI_COANA_TECH_CLI_VERSION}.`
+  },
+  reachAnalysisMemoryLimit: {
+    type: 'string',
+    default: '8192',
+    description: 'The maximum memory for the reachability analysis as a whole number optionally followed by MB or GB (e.g. 512MB, 8GB). The default is 8GB.'
+  },
+  reachAnalysisTimeout: {
+    type: 'string',
+    default: '',
+    description: 'Set the timeout for the reachability analysis as a whole number optionally followed by s, m or h (e.g. 90s, 10m, 1h). Defaults to 10m. Split analysis runs may cause the total scan time to exceed this timeout significantly.'
+  },
+  reachConcurrency: {
+    type: 'number',
+    default: 1,
+    description: 'Set the maximum number of concurrent reachability analysis runs. It is recommended to choose a concurrency level that ensures each analysis run has at least the --reach-analysis-memory-limit amount of memory available.'
+  },
+  reachContinueOnAnalysisErrors: {
+    type: 'boolean',
+    default: false,
+    description: 'Continue reachability analysis when errors occur (timeouts, OOM, parse errors, etc.), falling back to precomputed reachability results. By default, the CLI halts on analysis errors.'
+  },
+  reachContinueOnInstallErrors: {
+    type: 'boolean',
+    default: false,
+    description: 'Continue reachability analysis when package installation fails, falling back to precomputed reachability results. By default, the CLI halts on installation errors.'
+  },
+  reachContinueOnMissingLockFiles: {
+    type: 'boolean',
+    default: false,
+    description: 'Continue reachability analysis when a Gradle or SBT project is missing its lock file (or version catalog / pre-generated SBOM). By default, the CLI halts.'
+  },
+  reachContinueOnNoSourceFiles: {
+    type: 'boolean',
+    default: false,
+    description: 'Continue reachability analysis when a workspace contains no source files for its ecosystem. By default, the CLI halts.'
+  },
+  reachDisableExternalToolChecks: {
+    type: 'boolean',
+    default: false,
+    description: 'Disable external tool checks during reachability analysis.'
+  },
+  reachDebug: {
+    type: 'boolean',
+    default: false,
+    description: 'Enable debug mode for reachability analysis. Provides verbose logging from the reachability CLI.'
+  },
+  reachDetailedAnalysisLogFile: {
+    type: 'boolean',
+    default: false,
+    description: 'A log file with detailed analysis logs is written to root of each analyzed workspace.'
+  },
+  reachDisableAnalytics: {
+    type: 'boolean',
+    default: false,
+    description: 'Disable reachability analytics sharing with Socket. Also disables caching-based optimizations.'
+  },
+  reachDisableAnalysisSplitting: {
+    type: 'boolean',
+    default: false,
+    hidden: true,
+    description: 'Deprecated: Analysis splitting is now disabled by default. This flag is a no-op.'
+  },
+  reachEnableAnalysisSplitting: {
+    type: 'boolean',
+    default: false,
+    description: 'Allow the reachability analysis to partition CVEs into buckets that are processed in separate analysis runs. May improve accuracy, but not recommended by default.'
+  },
+  reachEcosystems: {
+    type: 'string',
+    isMultiple: true,
+    description: 'List of ecosystems to conduct reachability analysis on, as either a comma separated value or as multiple flags. Defaults to all ecosystems.'
+  },
+  reachExcludePaths: {
+    type: 'string',
+    isMultiple: true,
+    hidden: true,
+    description: 'Deprecated: use --exclude-paths instead. List of paths to exclude from reachability analysis, as either a comma separated value or as multiple flags.'
+  },
+  reachLazyMode: {
+    type: 'boolean',
+    default: false,
+    description: 'Enable lazy mode for reachability analysis.',
+    hidden: true
+  },
+  reachRetainFactsFile: {
+    type: 'boolean',
+    default: false,
+    description: 'Keep the `.socket.facts.json` reachability report that the analysis writes to the scan directory instead of deleting it after a successful scan. IMPORTANT: you must delete this file before running a fresh full application reachability scan. A stale `.socket.facts.json` left in place is picked up as a pre-generated input and silently overrides fresh analysis, so the new scan results will not be reliable.'
+  },
+  reachSkipCache: {
+    type: 'boolean',
+    default: false,
+    description: 'Skip caching-based optimizations. By default, the reachability analysis will use cached configurations from previous runs to speed up the analysis.'
+  },
+  reachUseOnlyPregeneratedSboms: {
+    type: 'boolean',
+    default: false,
+    description: 'When using this option, the scan is created based only on pre-generated CDX and SPDX files in your project.'
+  }
+};
+const excludePathsFlag = {
+  excludePaths: {
+    type: 'string',
+    isMultiple: true,
+    description: 'List of glob patterns to exclude from the scan, including SCA/SBOM manifest discovery and (when --reach is enabled) full application reachability analysis. Patterns are anchored micromatch globs matched relative to the Socket scan root, which is the command working directory (`--cwd` if set), not the reachability target: `tests` matches only `<cwd>/tests`; use `**/tests` to match at any depth. Negation patterns (`!path`) are not supported. Accepts a comma-separated value or multiple flags.'
+  }
+};
+
 const config$e = {
   commandName: 'auto',
   description: 'Auto-detect build and attempt to generate manifest file',
   hidden: false,
   flags: {
     ...flags.commonFlags,
+    ...excludePathsFlag,
     verbose: {
       type: 'boolean',
       default: false,
@@ -11392,9 +11569,12 @@ async function run$F(argv, importMeta, {
     process.exitCode = 1;
     return;
   }
+  const excludePaths = utils.cmdFlagValueToArray(cli.flags['excludePaths']);
+  assertValidExcludePaths(excludePaths);
   await generateAutoManifest({
     detected,
     cwd,
+    excludePaths,
     outputKind,
     verbose
   });
@@ -11583,6 +11763,7 @@ const config$c = {
       type: 'string',
       description: 'When generating facts: comma-separated glob patterns; Gradle configurations matching any pattern are skipped (applied after --include-configs)'
     },
+    ...excludePathsFlag,
     ignoreUnresolved: {
       type: 'boolean',
       description: 'When generating facts: warn on unresolved dependencies instead of failing the run (unresolved deps are not emitted to the facts file)'
@@ -11778,11 +11959,14 @@ async function run$D(argv, importMeta, {
     return;
   }
   const parsedGradleOpts = parseBuildToolOpts(String(gradleOpts || ''));
+  const excludePaths = utils.cmdFlagValueToArray(cli.flags['excludePaths']);
+  assertValidExcludePaths(excludePaths);
   if (facts) {
     await convertGradleToFacts({
       bin: String(bin),
       cwd,
       excludeConfigs: String(excludeConfigs || ''),
+      excludePaths,
       gradleOpts: parsedGradleOpts,
       ignoreUnresolved: Boolean(ignoreUnresolved),
       includeConfigs: String(includeConfigs || ''),
@@ -11793,6 +11977,7 @@ async function run$D(argv, importMeta, {
   await convertGradleToMaven({
     bin: String(bin),
     cwd,
+    excludePaths,
     gradleOpts: parsedGradleOpts,
     verbose: Boolean(verbose)
   });
@@ -11829,6 +12014,7 @@ const config$b = {
       type: 'string',
       description: 'When generating facts: comma-separated glob patterns; Gradle configurations matching any pattern are skipped (applied after --include-configs)'
     },
+    ...excludePathsFlag,
     ignoreUnresolved: {
       type: 'boolean',
       description: 'When generating facts: warn on unresolved dependencies instead of failing the run (unresolved deps are not emitted to the facts file)'
@@ -12022,11 +12208,14 @@ async function run$C(argv, importMeta, {
     return;
   }
   const parsedGradleOpts = parseBuildToolOpts(String(gradleOpts || ''));
+  const excludePaths = utils.cmdFlagValueToArray(cli.flags['excludePaths']);
+  assertValidExcludePaths(excludePaths);
   if (facts) {
     await convertGradleToFacts({
       bin: String(bin),
       cwd,
       excludeConfigs: String(excludeConfigs || ''),
+      excludePaths,
       gradleOpts: parsedGradleOpts,
       ignoreUnresolved: Boolean(ignoreUnresolved),
       includeConfigs: String(includeConfigs || ''),
@@ -12037,6 +12226,7 @@ async function run$C(argv, importMeta, {
   await convertGradleToMaven({
     bin: String(bin),
     cwd,
+    excludePaths,
     gradleOpts: parsedGradleOpts,
     verbose: Boolean(verbose)
   });
@@ -12060,6 +12250,7 @@ const config$a = {
       type: 'string',
       description: 'Comma-separated glob patterns; Maven scopes matching any pattern are skipped (applied after --include-configs)'
     },
+    ...excludePathsFlag,
     ignoreUnresolved: {
       type: 'boolean',
       description: 'Warn on unresolved dependencies instead of failing the run (unresolved deps are not emitted to the facts file)'
@@ -12215,10 +12406,13 @@ async function run$B(argv, importMeta, {
     return;
   }
   const parsedMavenOpts = parseBuildToolOpts(String(mavenOpts || ''));
+  const excludePaths = utils.cmdFlagValueToArray(cli.flags['excludePaths']);
+  assertValidExcludePaths(excludePaths);
   await convertMavenToFacts({
     bin: String(bin),
     cwd,
     excludeConfigs: String(excludeConfigs || ''),
+    excludePaths,
     ignoreUnresolved: Boolean(ignoreUnresolved),
     includeConfigs: String(includeConfigs || ''),
     mavenOpts: parsedMavenOpts,
@@ -12252,6 +12446,7 @@ const config$9 = {
       type: 'string',
       description: 'When generating facts: comma-separated glob patterns; sbt configurations matching any pattern are skipped (applied after --include-configs)'
     },
+    ...excludePathsFlag,
     ignoreUnresolved: {
       type: 'boolean',
       description: 'When generating facts: warn on unresolved dependencies instead of failing the run (unresolved deps are not emitted to the facts file)'
@@ -12491,11 +12686,14 @@ async function run$A(argv, importMeta, {
     return;
   }
   const parsedSbtOpts = parseBuildToolOpts(String(sbtOpts || ''));
+  const excludePaths = utils.cmdFlagValueToArray(cli.flags['excludePaths']);
+  assertValidExcludePaths(excludePaths);
   if (facts) {
     await convertSbtToFacts({
       bin: String(bin),
       cwd,
       excludeConfigs: String(excludeConfigs || ''),
+      excludePaths,
       ignoreUnresolved: Boolean(ignoreUnresolved),
       includeConfigs: String(includeConfigs || ''),
       sbtOpts: parsedSbtOpts,
@@ -17238,118 +17436,6 @@ const cmdRepository = {
   }
 };
 
-const reachabilityFlags = {
-  reachVersion: {
-    type: 'string',
-    description: `Override the version of @coana-tech/cli used for reachability analysis. Default: ${constants.default.ENV.INLINED_SOCKET_CLI_COANA_TECH_CLI_VERSION}.`
-  },
-  reachAnalysisMemoryLimit: {
-    type: 'string',
-    default: '8192',
-    description: 'The maximum memory for the reachability analysis as a whole number optionally followed by MB or GB (e.g. 512MB, 8GB). The default is 8GB.'
-  },
-  reachAnalysisTimeout: {
-    type: 'string',
-    default: '',
-    description: 'Set the timeout for the reachability analysis as a whole number optionally followed by s, m or h (e.g. 90s, 10m, 1h). Defaults to 10m. Split analysis runs may cause the total scan time to exceed this timeout significantly.'
-  },
-  reachConcurrency: {
-    type: 'number',
-    default: 1,
-    description: 'Set the maximum number of concurrent reachability analysis runs. It is recommended to choose a concurrency level that ensures each analysis run has at least the --reach-analysis-memory-limit amount of memory available.'
-  },
-  reachContinueOnAnalysisErrors: {
-    type: 'boolean',
-    default: false,
-    description: 'Continue reachability analysis when errors occur (timeouts, OOM, parse errors, etc.), falling back to precomputed reachability results. By default, the CLI halts on analysis errors.'
-  },
-  reachContinueOnInstallErrors: {
-    type: 'boolean',
-    default: false,
-    description: 'Continue reachability analysis when package installation fails, falling back to precomputed reachability results. By default, the CLI halts on installation errors.'
-  },
-  reachContinueOnMissingLockFiles: {
-    type: 'boolean',
-    default: false,
-    description: 'Continue reachability analysis when a Gradle or SBT project is missing its lock file (or version catalog / pre-generated SBOM). By default, the CLI halts.'
-  },
-  reachContinueOnNoSourceFiles: {
-    type: 'boolean',
-    default: false,
-    description: 'Continue reachability analysis when a workspace contains no source files for its ecosystem. By default, the CLI halts.'
-  },
-  reachDisableExternalToolChecks: {
-    type: 'boolean',
-    default: false,
-    description: 'Disable external tool checks during reachability analysis.'
-  },
-  reachDebug: {
-    type: 'boolean',
-    default: false,
-    description: 'Enable debug mode for reachability analysis. Provides verbose logging from the reachability CLI.'
-  },
-  reachDetailedAnalysisLogFile: {
-    type: 'boolean',
-    default: false,
-    description: 'A log file with detailed analysis logs is written to root of each analyzed workspace.'
-  },
-  reachDisableAnalytics: {
-    type: 'boolean',
-    default: false,
-    description: 'Disable reachability analytics sharing with Socket. Also disables caching-based optimizations.'
-  },
-  reachDisableAnalysisSplitting: {
-    type: 'boolean',
-    default: false,
-    hidden: true,
-    description: 'Deprecated: Analysis splitting is now disabled by default. This flag is a no-op.'
-  },
-  reachEnableAnalysisSplitting: {
-    type: 'boolean',
-    default: false,
-    description: 'Allow the reachability analysis to partition CVEs into buckets that are processed in separate analysis runs. May improve accuracy, but not recommended by default.'
-  },
-  reachEcosystems: {
-    type: 'string',
-    isMultiple: true,
-    description: 'List of ecosystems to conduct reachability analysis on, as either a comma separated value or as multiple flags. Defaults to all ecosystems.'
-  },
-  reachExcludePaths: {
-    type: 'string',
-    isMultiple: true,
-    hidden: true,
-    description: 'Deprecated: use --exclude-paths instead. List of paths to exclude from reachability analysis, as either a comma separated value or as multiple flags.'
-  },
-  reachLazyMode: {
-    type: 'boolean',
-    default: false,
-    description: 'Enable lazy mode for reachability analysis.',
-    hidden: true
-  },
-  reachRetainFactsFile: {
-    type: 'boolean',
-    default: false,
-    description: 'Keep the `.socket.facts.json` reachability report that the analysis writes to the scan directory instead of deleting it after a successful scan. IMPORTANT: you must delete this file before running a fresh full application reachability scan. A stale `.socket.facts.json` left in place is picked up as a pre-generated input and silently overrides fresh analysis, so the new scan results will not be reliable.'
-  },
-  reachSkipCache: {
-    type: 'boolean',
-    default: false,
-    description: 'Skip caching-based optimizations. By default, the reachability analysis will use cached configurations from previous runs to speed up the analysis.'
-  },
-  reachUseOnlyPregeneratedSboms: {
-    type: 'boolean',
-    default: false,
-    description: 'When using this option, the scan is created based only on pre-generated CDX and SPDX files in your project.'
-  }
-};
-const excludePathsFlag = {
-  excludePaths: {
-    type: 'string',
-    isMultiple: true,
-    description: 'List of glob patterns to exclude from the scan, including SCA/SBOM manifest discovery and (when --reach is enabled) full application reachability analysis. Patterns are anchored micromatch globs matched relative to the Socket scan root, which is the command working directory (`--cwd` if set), not the reachability target: `tests` matches only `<cwd>/tests`; use `**/tests` to match at any depth. Negation patterns (`!path`) are not supported. Accepts a comma-separated value or multiple flags.'
-  }
-};
-
 async function suggestTarget() {
   // We could prefill this with sub-dirs of the current
   // dir ... but is that going to be useful?
@@ -21902,5 +21988,5 @@ process.on('unhandledRejection', async (reason, promise) => {
   // eslint-disable-next-line n/no-process-exit
   process.exit(1);
 });
-//# debugId=e3648eac-e83a-498a-89eb-cf4c309aaf2a
+//# debugId=90319482-1408-4a2f-a2ea-db0456ffd3c2
 //# sourceMappingURL=cli.js.map