socket 1.1.166 → 1.1.168

package/CHANGELOG.md

@@ -4,6 +4,16 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## [1.1.168](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.168) - 2026-09-07
+
+### Changed
+- Updated the Coana CLI to v `15.10.37`.
+
+## [1.1.167](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.167) - 2026-09-03
+
+### Changed
+- Updated the Coana CLI to v `15.10.36`.
+
 ## [1.1.166](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.166) - 2026-09-03
 
 ### Changed

package/README.md

@@ -1,8 +1,8 @@
 # Socket CLI
 
 [![Socket Badge](https://socket.dev/api/badge/npm/package/socket)](https://socket.dev/npm/package/socket)
-[![Follow @SocketSecurity](https://raw.githubusercontent.com/SocketDev/socket-cli/v1.1.166/assets/fleet/badge-follow-x.svg)](https://twitter.com/SocketSecurity)
-[![Follow @socket.dev on Bluesky](https://raw.githubusercontent.com/SocketDev/socket-cli/v1.1.166/assets/fleet/badge-follow-bluesky.svg)](https://bsky.app/profile/socket.dev)
+[![Follow @SocketSecurity](https://raw.githubusercontent.com/SocketDev/socket-cli/v1.1.168/assets/fleet/badge-follow-x.svg)](https://twitter.com/SocketSecurity)
+[![Follow @socket.dev on Bluesky](https://raw.githubusercontent.com/SocketDev/socket-cli/v1.1.168/assets/fleet/badge-follow-bluesky.svg)](https://bsky.app/profile/socket.dev)
 
 CLI for [Socket.dev](https://socket.dev) — scan dependencies, audit packages, apply security patches, and gate installs from your terminal or CI. This is the 1.x line of the published `socket` package on npm.
 
@@ -138,8 +138,8 @@ MIT
 <br/>
 <div align="center">
   <picture>
-    <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.1.166/assets/fleet/socket-combomark-dark.svg">
-    <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.1.166/assets/fleet/socket-combomark-light.svg">
-    <img width="324" height="104" alt="Socket" src="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.1.166/assets/fleet/socket-combomark-light.svg">
+    <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.1.168/assets/fleet/socket-combomark-dark.svg">
+    <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.1.168/assets/fleet/socket-combomark-light.svg">
+    <img width="324" height="104" alt="Socket" src="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.1.168/assets/fleet/socket-combomark-light.svg">
   </picture>
 </div>

package/dist/cli.js

@@ -1915,8 +1915,7 @@ async function performReachabilityAnalysis(options) {
     repoName,
     resolvedPathsSidecar,
     spinner,
-    target,
-    uploadManifests = true
+    target
   } = {
     __proto__: null,
     ...options
@@ -1956,51 +1955,49 @@ async function performReachabilityAnalysis(options) {
     };
   }
   const wasSpinning = !!spinner?.isSpinning;
-  let tarHash;
-  if (uploadManifests && orgSlug && packagePaths) {
-    // Setup SDK for uploading manifests
-    const sockSdkCResult = await utils.setupSdk();
-    if (!sockSdkCResult.ok) {
-      return sockSdkCResult;
-    }
-    const sockSdk = sockSdkCResult.data;
-    spinner?.start('Uploading manifests for reachability analysis...');
-
-    // Ensure uploaded manifest files are relative to analysis target as coana resolves SBOM manifest files relative to this path
-    // NOTE: previously stripped any `.socket.facts.json` from packagePaths
-    // here to avoid uploading leftover post-reachability output. With the
-    // producer flow (`socket manifest gradle --facts`) those files are
-    // legitimate INPUT to compute-artifacts, so we now upload them. Stale
-    // facts files are cleaned up downstream — see the post-success
-    // deletion in handle-create-new-scan.mts.
-    const uploadCResult = await utils.handleApiCall(sockSdk.uploadManifestFiles(orgSlug, packagePaths, {
-      pathsRelativeTo: path.resolve(cwd, analysisTarget)
-    }), {
-      description: 'upload manifests',
-      spinner
-    });
-    spinner?.stop();
-    if (!uploadCResult.ok) {
-      if (wasSpinning) {
-        spinner.start();
-      }
-      return uploadCResult;
+
+  // Setup SDK for uploading manifests
+  const sockSdkCResult = await utils.setupSdk();
+  if (!sockSdkCResult.ok) {
+    return sockSdkCResult;
+  }
+  const sockSdk = sockSdkCResult.data;
+  spinner?.start('Uploading manifests for reachability analysis...');
+
+  // Ensure uploaded manifest files are relative to analysis target as coana resolves SBOM manifest files relative to this path
+  // NOTE: previously stripped any `.socket.facts.json` from packagePaths
+  // here to avoid uploading leftover post-reachability output. With the
+  // producer flow (`socket manifest gradle --facts`) those files are
+  // legitimate INPUT to compute-artifacts, so we now upload them. Stale
+  // facts files are cleaned up downstream — see the post-success
+  // deletion in handle-create-new-scan.mts.
+  const uploadCResult = await utils.handleApiCall(sockSdk.uploadManifestFiles(orgSlug, packagePaths, {
+    pathsRelativeTo: path.resolve(cwd, analysisTarget)
+  }), {
+    description: 'upload manifests',
+    spinner
+  });
+  spinner?.stop();
+  if (!uploadCResult.ok) {
+    if (wasSpinning) {
+      spinner.start();
     }
-    tarHash = uploadCResult.data?.tarHash;
-    if (!tarHash) {
-      if (wasSpinning) {
-        spinner.start();
-      }
-      return {
-        ok: false,
-        message: 'Failed to get manifest tar hash',
-        cause: 'Server did not return a tar hash for the uploaded manifests'
-      };
+    return uploadCResult;
+  }
+  const tarHash = uploadCResult.data?.tarHash;
+  if (!tarHash) {
+    if (wasSpinning) {
+      spinner.start();
     }
-    spinner?.start();
-    spinner?.success(`Manifests uploaded successfully. Tar hash: ${tarHash}`);
+    return {
+      ok: false,
+      message: 'Failed to get manifest tar hash',
+      cause: 'Server did not return a tar hash for the uploaded manifests'
+    };
   }
   spinner?.start();
+  spinner?.success(`Manifests uploaded successfully. Tar hash: ${tarHash}`);
+  spinner?.start();
   spinner?.infoAndStop('Running reachability analysis with Coana...');
   const outputFilePath = outputPath || constants.default.DOT_SOCKET_DOT_FACTS_JSON;
 
@@ -2014,12 +2011,12 @@ async function performReachabilityAnalysis(options) {
   }
 
   // Build Coana arguments.
-  const coanaArgs = ['run', analysisTarget, '--output-dir', path.dirname(outputFilePath), '--socket-mode', outputFilePath, '--disable-report-submission', ...(isOmittedReachValue(reachabilityOptions.reachAnalysisTimeout) ? [] : ['--analysis-timeout', reachabilityOptions.reachAnalysisTimeout]), ...(isOmittedReachValue(reachabilityOptions.reachAnalysisMemoryLimit) ? [] : ['--memory-limit', reachabilityOptions.reachAnalysisMemoryLimit]), ...(reachabilityOptions.reachConcurrency ? ['--concurrency', `${reachabilityOptions.reachConcurrency}`] : []), ...(reachabilityOptions.reachContinueOnAnalysisErrors ? ['--reach-continue-on-analysis-errors'] : []), ...(reachabilityOptions.reachContinueOnInstallErrors ? ['--reach-continue-on-install-errors'] : []), ...(reachabilityOptions.reachContinueOnMissingLockFiles ? ['--reach-continue-on-missing-lock-files'] : []), ...(reachabilityOptions.reachContinueOnNoSourceFiles ? ['--reach-continue-on-no-source-files'] : []), ...(reachabilityOptions.reachDebug ? ['--debug'] : []), ...(reachabilityOptions.reachDetailedAnalysisLogFile ? ['--print-analysis-log-file'] : []), ...(reachabilityOptions.reachDisableAnalytics ? ['--disable-analytics-sharing'] : []), ...(reachabilityOptions.reachDisableExternalToolChecks ? ['--disable-external-tool-checks'] : []), ...(reachabilityOptions.reachEnableAnalysisSplitting ? [] : ['--disable-analysis-splitting']), ...(tarHash ? ['--run-without-docker', '--manifests-tar-hash', tarHash] : []),
+  const coanaArgs = ['run', analysisTarget, '--output-dir', path.dirname(outputFilePath), '--socket-mode', outputFilePath, '--disable-report-submission', ...(isOmittedReachValue(reachabilityOptions.reachAnalysisTimeout) ? [] : ['--analysis-timeout', reachabilityOptions.reachAnalysisTimeout]), ...(isOmittedReachValue(reachabilityOptions.reachAnalysisMemoryLimit) ? [] : ['--memory-limit', reachabilityOptions.reachAnalysisMemoryLimit]), ...(reachabilityOptions.reachConcurrency ? ['--concurrency', `${reachabilityOptions.reachConcurrency}`] : []), ...(reachabilityOptions.reachContinueOnAnalysisErrors ? ['--reach-continue-on-analysis-errors'] : []), ...(reachabilityOptions.reachContinueOnInstallErrors ? ['--reach-continue-on-install-errors'] : []), ...(reachabilityOptions.reachContinueOnMissingLockFiles ? ['--reach-continue-on-missing-lock-files'] : []), ...(reachabilityOptions.reachContinueOnNoSourceFiles ? ['--reach-continue-on-no-source-files'] : []), ...(reachabilityOptions.reachDebug ? ['--debug'] : []), ...(reachabilityOptions.reachDetailedAnalysisLogFile ? ['--print-analysis-log-file'] : []), ...(reachabilityOptions.reachDisableAnalytics ? ['--disable-analytics-sharing'] : []), ...(reachabilityOptions.reachDisableExternalToolChecks ? ['--disable-external-tool-checks'] : []), ...(reachabilityOptions.reachEnableAnalysisSplitting ? [] : ['--disable-analysis-splitting']), '--run-without-docker', '--manifests-tar-hash', tarHash,
   // Empty reachEcosystems implies scanning all ecosystems.
   ...(reachabilityOptions.reachEcosystems.length ? ['--purl-types', ...reachabilityOptions.reachEcosystems] : []), ...(reachabilityOptions.reachExcludePaths.length ? ['--exclude-dirs', ...reachabilityOptions.reachExcludePaths] : []),
   // sidecarPath is always set above when this is true - Coana rejects this
   // flag without one.
-  ...(reachabilityOptions.dynamicSbomInference ? ['--maven-use-only-socket-facts'] : []), ...(reachabilityOptions.reachLazyMode ? ['--lazy-mode'] : []), ...(reachabilityOptions.reachSkipCache ? ['--skip-cache-usage'] : []), ...(reachabilityOptions.reachUseOnlyPregeneratedSboms ? ['--use-only-pregenerated-sboms'] : []), ...(sidecarPath ? ['--compute-artifacts-sidecar', sidecarPath] : [])];
+  ...(reachabilityOptions.dynamicSbomInference ? ['--maven-use-only-socket-facts'] : []), ...(reachabilityOptions.reachSkipCache ? ['--skip-cache-usage'] : []), ...(reachabilityOptions.reachUseOnlyPregeneratedSboms ? ['--use-only-pregenerated-sboms'] : []), ...(sidecarPath ? ['--compute-artifacts-sidecar', sidecarPath] : [])];
 
   // Build environment variables.
   const coanaEnv = {};
@@ -7465,7 +7462,6 @@ async function handleCi(autoManifest) {
       reachEcosystems: [],
       reachEnableAnalysisSplitting: false,
       reachExcludePaths: [],
-      reachLazyMode: false,
       reachRetainFactsFile: false,
       reachSkipCache: false,
       reachUseOnlyPregeneratedSboms: false,
@@ -19380,8 +19376,8 @@ const reachabilityFlags = {
   reachLazyMode: {
     type: 'boolean',
     default: false,
-    description: 'Enable lazy mode for reachability analysis.',
-    hidden: true
+    hidden: true,
+    description: 'Deprecated: lazy mode is no longer supported. This flag is a no-op.'
   },
   reachRetainFactsFile: {
     type: 'boolean',
@@ -19461,6 +19457,10 @@ async function validateReachabilityTarget(targets, cwd) {
 }
 
 const CMD_NAME$a = 'create';
+
+// Accepted for backwards compatibility but forwarded nowhere, so passing one
+// must not imply --reach.
+const DEPRECATED_NO_OP_REACH_FLAGS = new Set(['reachDisableAnalysisSplitting', 'reachLazyMode']);
 const description$c = 'Create a new Socket scan and report';
 const hidden$a = false;
 const generalFlags$1 = {
@@ -19668,7 +19668,7 @@ async function run$d(argv, importMeta, {
     reachDisableAnalytics,
     reachDisableExternalToolChecks,
     reachEnableAnalysisSplitting,
-    reachLazyMode,
+    reachLazyMode: _reachLazyMode,
     reachRetainFactsFile,
     reachSkipCache,
     reachUseOnlyPregeneratedSboms,
@@ -19823,9 +19823,8 @@ async function run$d(argv, importMeta, {
 
   // Compare every boolean reach flag against its declared default so newly
   // added flags require --reach automatically instead of relying on a
-  // hand-maintained list. The deprecated no-op
-  // --reach-disable-analysis-splitting is excluded on purpose.
-  const isUsingAnyBooleanReachFlag = Object.entries(reachabilityFlags).some(([name, flag]) => flag.type === 'boolean' && name !== 'reachDisableAnalysisSplitting' && cli.flags[name] !== flag.default);
+  // hand-maintained list. Deprecated no-ops are excluded on purpose.
+  const isUsingAnyBooleanReachFlag = Object.entries(reachabilityFlags).some(([name, flag]) => flag.type === 'boolean' && !DEPRECATED_NO_OP_REACH_FLAGS.has(name) && cli.flags[name] !== flag.default);
   const isUsingAnyReachabilityFlags = hasReachEcosystems || hasReachExcludePaths || isUsingAnyBooleanReachFlag || isUsingNonDefaultConcurrency || isUsingNonDefaultMemoryLimit || isUsingNonDefaultTimeout || isUsingNonDefaultVersion;
 
   // Validate target constraints when --reach is enabled.
@@ -19927,7 +19926,6 @@ async function run$d(argv, importMeta, {
       reachEcosystems,
       reachEnableAnalysisSplitting: Boolean(reachEnableAnalysisSplitting),
       reachExcludePaths,
-      reachLazyMode: Boolean(reachLazyMode),
       reachRetainFactsFile: Boolean(reachRetainFactsFile),
       reachSkipCache: Boolean(reachSkipCache),
       reachUseOnlyPregeneratedSboms: Boolean(reachUseOnlyPregeneratedSboms),
@@ -20645,7 +20643,6 @@ async function scanOneRepo(repoSlug, {
       reachEcosystems: [],
       reachEnableAnalysisSplitting: false,
       reachExcludePaths: [],
-      reachLazyMode: false,
       reachRetainFactsFile: false,
       reachSkipCache: false,
       reachUseOnlyPregeneratedSboms: false,
@@ -21899,8 +21896,7 @@ async function runScanReach({
     reachabilityOptions: mergedReachabilityOptions,
     resolvedPathsSidecar,
     spinner,
-    target: targets[0],
-    uploadManifests: true
+    target: targets[0]
   });
   spinner.stop();
 
@@ -22042,7 +22038,7 @@ async function run$7(argv, importMeta, {
     reachDisableAnalytics,
     reachDisableExternalToolChecks,
     reachEnableAnalysisSplitting,
-    reachLazyMode,
+    reachLazyMode: _reachLazyMode,
     reachRetainFactsFile,
     reachSkipCache,
     reachUseOnlyPregeneratedSboms,
@@ -22147,7 +22143,6 @@ async function run$7(argv, importMeta, {
       reachEcosystems,
       reachEnableAnalysisSplitting: Boolean(reachEnableAnalysisSplitting),
       reachExcludePaths,
-      reachLazyMode: Boolean(reachLazyMode),
       reachRetainFactsFile: Boolean(reachRetainFactsFile),
       reachSkipCache: Boolean(reachSkipCache),
       reachUseOnlyPregeneratedSboms: Boolean(reachUseOnlyPregeneratedSboms),
@@ -24098,5 +24093,5 @@ process.on('unhandledRejection', async (reason, promise) => {
   // eslint-disable-next-line n/no-process-exit
   process.exit(1);
 });
-//# debugId=33f14952-bd82-49b9-8fcf-7a7cc5bf3926
+//# debugId=4125e182-5da6-4cc5-ae30-fed3061b33a7
 //# sourceMappingURL=cli.js.map