socket 1.1.179 → 1.1.180

package/CHANGELOG.md

@@ -4,6 +4,15 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## [1.1.180](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.180) - 2026-09-25
+
+### Changed
+- A failed Conda manifest step now stops `--auto-manifest` instead of uploading a scan that under-reports your `pip:` dependencies, matching how Gradle, Maven and sbt already behave.
+
+### Fixed
+- `--auto-manifest` now reads whichever Conda environment file your project uses, `environment.yml` or `environment.yaml`. Repos on the `.yaml` spelling no longer need a `socket.json` workaround.
+- The Conda `requirements.txt` now lands in the directory you targeted, so scans pick it up even when you run the CLI from somewhere else.
+
 ## [1.1.179](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.179) - 2026-09-24
 
 ### Changed

package/README.md

@@ -1,8 +1,8 @@
 # Socket CLI
 
 [![Socket Badge](https://socket.dev/api/badge/npm/package/socket)](https://socket.dev/npm/package/socket)
-[![Follow @SocketSecurity](https://raw.githubusercontent.com/SocketDev/socket-cli/v1.1.179/assets/fleet/badge-follow-x.svg)](https://twitter.com/SocketSecurity)
-[![Follow @socket.dev on Bluesky](https://raw.githubusercontent.com/SocketDev/socket-cli/v1.1.179/assets/fleet/badge-follow-bluesky.svg)](https://bsky.app/profile/socket.dev)
+[![Follow @SocketSecurity](https://raw.githubusercontent.com/SocketDev/socket-cli/v1.1.180/assets/fleet/badge-follow-x.svg)](https://twitter.com/SocketSecurity)
+[![Follow @socket.dev on Bluesky](https://raw.githubusercontent.com/SocketDev/socket-cli/v1.1.180/assets/fleet/badge-follow-bluesky.svg)](https://bsky.app/profile/socket.dev)
 
 CLI for [Socket.dev](https://socket.dev) — scan dependencies, audit packages, apply security patches, and gate installs from your terminal or CI. This is the 1.x line of the published `socket` package on npm.
 
@@ -138,8 +138,8 @@ MIT
 <br/>
 <div align="center">
   <picture>
-    <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.1.179/assets/fleet/socket-combomark-dark.svg">
-    <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.1.179/assets/fleet/socket-combomark-light.svg">
-    <img width="324" height="104" alt="Socket" src="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.1.179/assets/fleet/socket-combomark-light.svg">
+    <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.1.180/assets/fleet/socket-combomark-dark.svg">
+    <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.1.180/assets/fleet/socket-combomark-light.svg">
+    <img width="324" height="104" alt="Socket" src="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.1.180/assets/fleet/socket-combomark-light.svg">
   </picture>
 </div>

package/dist/cli.js

@@ -4002,6 +4002,16 @@ async function runDynamicSbomInference({
 // The point here is to attempt to detect the various supported manifest files
 // the CLI can generate. This would be environments that we can't do server side
 
+// Conda reads both spellings of the environment file.
+function findCondaFile(cwd) {
+  if (fs$1.existsSync(path.join(cwd, constants.ENVIRONMENT_YML))) {
+    return constants.ENVIRONMENT_YML;
+  }
+  if (fs$1.existsSync(path.join(cwd, constants.ENVIRONMENT_YAML))) {
+    return constants.ENVIRONMENT_YAML;
+  }
+  return '';
+}
 async function detectManifestActions(
 // Passing in null means we attempt detection for every supported language
 // regardless of local socket.json status. Sometimes we want that.
@@ -4012,6 +4022,7 @@ sockJson, cwd = process.cwd()) {
     // TODO
     count: 0,
     conda: false,
+    condaFile: '',
     gradle: false,
     maven: false,
     sbt: false
@@ -4049,13 +4060,11 @@ sockJson, cwd = process.cwd()) {
   if (sockJson?.defaults?.manifest?.conda?.disabled) {
     debug.debugLog('notice', `[DEBUG] - conda auto-detection is disabled in ${constants.SOCKET_JSON}`);
   } else {
-    const envyml = path.join(cwd, constants.ENVIRONMENT_YML);
-    const hasEnvyml = fs$1.existsSync(envyml);
-    const envyaml = path.join(cwd, constants.ENVIRONMENT_YAML);
-    const hasEnvyaml = !hasEnvyml && fs$1.existsSync(envyaml);
-    if (hasEnvyml || hasEnvyaml) {
-      debug.debugLog('notice', '[DEBUG] - Detected an environment.yml Conda file');
+    const condaFile = findCondaFile(cwd);
+    if (condaFile) {
+      debug.debugLog('notice', `[DEBUG] - Detected the Conda file ${condaFile}`);
       output.conda = true;
+      output.condaFile = condaFile;
       output.count += 1;
     }
   }
@@ -6898,7 +6907,10 @@ async function handleManifestConda({
   verbose
 }) {
   const data = await convertCondaToRequirements(filename, cwd, verbose);
-  await outputRequirements(data, outputKind, out);
+
+  // --auto-manifest only collects the generated file when it lands inside
+  // the dir being scanned.
+  await outputRequirements(data, outputKind, out === '-' ? out : path.resolve(cwd, out));
 }
 
 // Under --auto-manifest, a manifest generator that failed — raising the exit
@@ -7018,14 +7030,17 @@ async function generateAutoManifest({
     abortManifestRunIfFailed('maven', beforeExitCode);
   }
   if (!sockJson?.defaults?.manifest?.conda?.disabled && detected.conda) {
-    logger.logger.log('Detected an environment.yml file, running default Conda generator...');
+    const condaFile = sockJson.defaults?.manifest?.conda?.infile || detected.condaFile || constants.ENVIRONMENT_YML;
+    logger.logger.log(`Detected ${condaFile}, running default Conda generator...`);
+    const beforeExitCode = process.exitCode;
     await handleManifestConda({
       cwd,
-      filename: sockJson.defaults?.manifest?.conda?.infile ?? 'environment.yml',
+      filename: condaFile,
       outputKind,
       out: sockJson.defaults?.manifest?.conda?.outfile ?? constants.REQUIREMENTS_TXT,
       verbose: Boolean(sockJson.defaults?.manifest?.conda?.verbose)
     });
+    abortManifestRunIfFailed('conda', beforeExitCode);
   }
   if (!sockJson?.defaults?.manifest?.bazel?.disabled && detected.bazel) {
     const bazelConfig = sockJson?.defaults?.manifest?.bazel;
@@ -12420,7 +12435,7 @@ async function run$F(argv, importMeta, {
       filename = sockJson.defaults?.manifest?.conda?.infile;
       logger.logger.info(`Using default --file from ${constants.SOCKET_JSON}:`, filename);
     } else {
-      filename = constants.ENVIRONMENT_YML;
+      filename = findCondaFile(cwd) || constants.ENVIRONMENT_YML;
     }
   }
   if (stdout === undefined && sockJson.defaults?.manifest?.conda?.stdout !== undefined) {
@@ -24131,5 +24146,5 @@ process.on('unhandledRejection', async (reason, promise) => {
   // eslint-disable-next-line n/no-process-exit
   process.exit(1);
 });
-//# debugId=3a134c7c-6936-4bbb-befc-4c0c7084f488
+//# debugId=d61b6b1f-4e7a-4403-b8f9-087745dd936f
 //# sourceMappingURL=cli.js.map