socket 1.1.39 → 1.1.40

package/CHANGELOG.md

@@ -4,6 +4,14 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## [1.1.40](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.40) - 2025-12-02
+
+### Fixed
+- Fix a bug where vulnerabilities were not found correctly during `socket fix`.
+
+### Changed
+- Updated the Coana CLI to v `14.12.110`.
+
 ## [1.1.39](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.39) - 2025-12-01
 
 ### Added

package/dist/cli.js

@@ -3689,7 +3689,7 @@ async function getFixEnv() {
  * Discovers GHSA IDs by running coana without applying fixes.
  * Returns a list of GHSA IDs, optionally limited.
  */
-async function discoverGhsaIds(orgSlug, tarHash, fixConfig, options) {
+async function discoverGhsaIds(orgSlug, tarHash, options) {
   const {
     cwd = process.cwd(),
     limit,
@@ -3698,12 +3698,21 @@ async function discoverGhsaIds(orgSlug, tarHash, fixConfig, options) {
     __proto__: null,
     ...options
   };
-  const foundCResult = await utils.spawnCoanaDlx(['compute-fixes-and-upgrade-purls', cwd, '--manifests-tar-hash', tarHash, ...(fixConfig.rangeStyle ? ['--range-style', fixConfig.rangeStyle] : []), ...(fixConfig.minimumReleaseAge ? ['--minimum-release-age', fixConfig.minimumReleaseAge] : []), ...(fixConfig.include.length ? ['--include', ...fixConfig.include] : []), ...(fixConfig.exclude.length ? ['--exclude', ...fixConfig.exclude] : []), ...(fixConfig.disableMajorUpdates ? ['--disable-major-updates'] : []), ...(fixConfig.showAffectedDirectDependencies ? ['--show-affected-direct-dependencies'] : []), ...fixConfig.unknownFlags], orgSlug, {
+  const foundCResult = await utils.spawnCoanaDlx(['find-vulnerabilities', cwd, '--manifests-tar-hash', tarHash], orgSlug, {
     cwd,
     spinner
+  }, {
+    stdio: 'pipe'
   });
   if (foundCResult.ok) {
-    const foundIds = utils.cmdFlagValueToArray(/(?<=Vulnerabilities found:).*/.exec(foundCResult.data));
+    // Coana prints ghsaIds as json-formatted string on the final line of the output
+    const foundIds = [];
+    try {
+      const ghsaIdsRaw = foundCResult.data.trim().split('\n').pop();
+      if (ghsaIdsRaw) {
+        foundIds.push(...JSON.parse(ghsaIdsRaw));
+      }
+    } catch {}
     return limit !== undefined ? foundIds.slice(0, limit) : foundIds;
   }
   return [];
@@ -3781,7 +3790,7 @@ async function coanaFix(fixConfig) {
     }
     let ids;
     if (isAll && limit > 0) {
-      ids = await discoverGhsaIds(orgSlug, tarHash, fixConfig, {
+      ids = await discoverGhsaIds(orgSlug, tarHash, {
         cwd,
         limit,
         spinner
@@ -3864,7 +3873,7 @@ async function coanaFix(fixConfig) {
   const shouldSpawnCoana = adjustedLimit > 0;
   let ids;
   if (shouldSpawnCoana && isAll) {
-    ids = await discoverGhsaIds(orgSlug, tarHash, fixConfig, {
+    ids = await discoverGhsaIds(orgSlug, tarHash, {
       cwd,
       limit: adjustedLimit,
       spinner
@@ -15439,5 +15448,5 @@ void (async () => {
     await utils.captureException(e);
   }
 })();
-//# debugId=8693f005-3cc6-4712-ba1e-c0aa7f093c42
+//# debugId=abe9e0d9-90ff-4e73-99b1-648bc5ca3347
 //# sourceMappingURL=cli.js.map