socket 1.4.2 → 1.5.0

package/CHANGELOG.md

@@ -4,6 +4,14 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## [1.5.0](https://github.com/SocketDev/socket-cli/releases/tag/v1.5.0) - 2026-10-06
+
+### Added
+- `socket fix --allow-overrides` fixes a vulnerability that a parent package's version range blocks by writing an override or resolution that forces the fixed version under that parent, in npm, pnpm, Yarn Berry and Rush projects.
+
+### Changed
+- Updated the Coana CLI to v `15.12.0`.
+
 ## [1.4.2](https://github.com/SocketDev/socket-cli/releases/tag/v1.4.2) - 2026-10-05
 
 ### Changed

package/README.md

@@ -1,8 +1,8 @@
 # Socket CLI
 
 [![Socket Badge](https://socket.dev/api/badge/npm/package/socket)](https://socket.dev/npm/package/socket)
-[![Follow @SocketSecurity](https://raw.githubusercontent.com/SocketDev/socket-cli/v1.4.2/assets/fleet/badge-follow-x.svg)](https://twitter.com/SocketSecurity)
-[![Follow @socket.dev on Bluesky](https://raw.githubusercontent.com/SocketDev/socket-cli/v1.4.2/assets/fleet/badge-follow-bluesky.svg)](https://bsky.app/profile/socket.dev)
+[![Follow @SocketSecurity](https://raw.githubusercontent.com/SocketDev/socket-cli/v1.5.0/assets/fleet/badge-follow-x.svg)](https://twitter.com/SocketSecurity)
+[![Follow @socket.dev on Bluesky](https://raw.githubusercontent.com/SocketDev/socket-cli/v1.5.0/assets/fleet/badge-follow-bluesky.svg)](https://bsky.app/profile/socket.dev)
 
 CLI for [Socket.dev](https://socket.dev) — scan dependencies, audit packages, apply security patches, and gate installs from your terminal or CI. This is the 1.x line of the published `socket` package on npm.
 
@@ -171,8 +171,8 @@ MIT
 <br/>
 <div align="center">
   <picture>
-    <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.4.2/assets/fleet/socket-combomark-dark.svg">
-    <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.4.2/assets/fleet/socket-combomark-light.svg">
-    <img width="324" height="104" alt="Socket" src="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.4.2/assets/fleet/socket-combomark-light.svg">
+    <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.5.0/assets/fleet/socket-combomark-dark.svg">
+    <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.5.0/assets/fleet/socket-combomark-light.svg">
+    <img width="324" height="104" alt="Socket" src="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.5.0/assets/fleet/socket-combomark-light.svg">
   </picture>
 </div>

package/dist/cli.js

@@ -9016,6 +9016,7 @@ async function coanaFix(fixConfig) {
 async function coanaFixWithFacts(fixConfig, factsSlot) {
   const {
     all,
+    allowOverrides,
     applyFixes,
     autopilot,
     coanaVersion,
@@ -9204,7 +9205,7 @@ async function coanaFixWithFacts(fixConfig, factsSlot) {
     const tmpDir = os.tmpdir();
     const tmpFile = path.join(tmpDir, `socket-fix-${Date.now()}.json`);
     try {
-      const fixCResult = await utils.spawnCoanaDlx(['compute-fixes-and-upgrade-purls', cwd, '--manifests-tar-hash', tarHash, '--apply-fixes-to', ...ids, ...(fixConfig.rangeStyle ? ['--range-style', fixConfig.rangeStyle] : []), ...(minimumReleaseAge ? ['--minimum-release-age', minimumReleaseAge] : []), ...(include.length ? ['--include', ...include] : []), ...(coanaExcludePatterns.length ? ['--exclude', ...coanaExcludePatterns] : []), ...(ecosystems.length ? ['--purl-types', ...ecosystems] : []), ...(packageManagers.length ? ['--package-managers', ...packageManagers] : []), ...factsFlags, ...(!applyFixes ? [constants.FLAG_DRY_RUN] : []), '--output-file', tmpFile, ...(debug$1 ? ['--debug'] : []), ...(disableExternalToolChecks ? ['--disable-external-tool-checks'] : []), ...(disableMajorUpdates ? ['--disable-major-updates'] : []), ...(showAffectedDirectDependencies ? ['--show-affected-direct-dependencies'] : []), ...fixConfig.unknownFlags], fixConfig.orgSlug, {
+      const fixCResult = await utils.spawnCoanaDlx(['compute-fixes-and-upgrade-purls', cwd, '--manifests-tar-hash', tarHash, '--apply-fixes-to', ...ids, ...(fixConfig.rangeStyle ? ['--range-style', fixConfig.rangeStyle] : []), ...(minimumReleaseAge ? ['--minimum-release-age', minimumReleaseAge] : []), ...(include.length ? ['--include', ...include] : []), ...(coanaExcludePatterns.length ? ['--exclude', ...coanaExcludePatterns] : []), ...(ecosystems.length ? ['--purl-types', ...ecosystems] : []), ...(packageManagers.length ? ['--package-managers', ...packageManagers] : []), ...factsFlags, ...(!applyFixes ? [constants.FLAG_DRY_RUN] : []), '--output-file', tmpFile, ...(debug$1 ? ['--debug'] : []), ...(disableExternalToolChecks ? ['--disable-external-tool-checks'] : []), ...(disableMajorUpdates ? ['--disable-major-updates'] : []), ...(allowOverrides ? ['--allow-overrides'] : []), ...(showAffectedDirectDependencies ? ['--show-affected-direct-dependencies'] : []), ...fixConfig.unknownFlags], fixConfig.orgSlug, {
         coanaVersion,
         cwd,
         spinner: silence ? undefined : spinner,
@@ -9335,7 +9336,7 @@ async function coanaFixWithFacts(fixConfig, factsSlot) {
 
     // Apply fix for single GHSA ID.
     // eslint-disable-next-line no-await-in-loop
-    const fixCResult = await utils.spawnCoanaDlx(['compute-fixes-and-upgrade-purls', cwd, '--manifests-tar-hash', tarHash, '--apply-fixes-to', ghsaId, ...(fixConfig.rangeStyle ? ['--range-style', fixConfig.rangeStyle] : []), ...(minimumReleaseAge ? ['--minimum-release-age', minimumReleaseAge] : []), ...(include.length ? ['--include', ...include] : []), ...(coanaExcludePatterns.length ? ['--exclude', ...coanaExcludePatterns] : []), ...(ecosystems.length ? ['--purl-types', ...ecosystems] : []), ...(packageManagers.length ? ['--package-managers', ...packageManagers] : []), ...factsFlags, ...(debug$1 ? ['--debug'] : []), ...(disableExternalToolChecks ? ['--disable-external-tool-checks'] : []), ...(disableMajorUpdates ? ['--disable-major-updates'] : []), ...(showAffectedDirectDependencies ? ['--show-affected-direct-dependencies'] : []), '--output-file', tmpFile, ...fixConfig.unknownFlags], fixConfig.orgSlug, {
+    const fixCResult = await utils.spawnCoanaDlx(['compute-fixes-and-upgrade-purls', cwd, '--manifests-tar-hash', tarHash, '--apply-fixes-to', ghsaId, ...(fixConfig.rangeStyle ? ['--range-style', fixConfig.rangeStyle] : []), ...(minimumReleaseAge ? ['--minimum-release-age', minimumReleaseAge] : []), ...(include.length ? ['--include', ...include] : []), ...(coanaExcludePatterns.length ? ['--exclude', ...coanaExcludePatterns] : []), ...(ecosystems.length ? ['--purl-types', ...ecosystems] : []), ...(packageManagers.length ? ['--package-managers', ...packageManagers] : []), ...factsFlags, ...(debug$1 ? ['--debug'] : []), ...(disableExternalToolChecks ? ['--disable-external-tool-checks'] : []), ...(disableMajorUpdates ? ['--disable-major-updates'] : []), ...(allowOverrides ? ['--allow-overrides'] : []), ...(showAffectedDirectDependencies ? ['--show-affected-direct-dependencies'] : []), '--output-file', tmpFile, ...fixConfig.unknownFlags], fixConfig.orgSlug, {
       coanaVersion,
       cwd,
       spinner: silence ? undefined : spinner,
@@ -9665,6 +9666,7 @@ async function convertIdsToGhsas(ids, options) {
 }
 async function handleFix({
   all,
+  allowOverrides,
   applyFixes,
   autopilot,
   coanaVersion,
@@ -9695,6 +9697,7 @@ async function handleFix({
   debug.debugFn('notice', `Starting fix command for ${orgSlug}`);
   debug.debugDir('inspect', {
     all,
+    allowOverrides,
     applyFixes,
     autopilot,
     coanaVersion,
@@ -9722,6 +9725,7 @@ async function handleFix({
   });
   await outputFixResult(await coanaFix({
     all,
+    allowOverrides,
     applyFixes,
     autopilot,
     coanaVersion,
@@ -9884,6 +9888,11 @@ const cmdFix = {
   run: run$N
 };
 const generalFlags$2 = {
+  allowOverrides: {
+    type: 'boolean',
+    default: false,
+    description: "When the only fix for a vulnerability is blocked by a parent package's declared version range, write an override or resolution that forces the fixed version under that parent. This can install a version outside the range the parent declares, so test the parent afterwards. Works for npm, pnpm, Yarn Berry and Rush projects."
+  },
   autopilot: {
     type: 'boolean',
     default: false,
@@ -10119,6 +10128,7 @@ async function run$N(argv, importMeta, {
   });
   const {
     all,
+    allowOverrides,
     applyFixes,
     autopilot,
     debug,
@@ -10249,6 +10259,7 @@ async function run$N(argv, importMeta, {
   } = constants.default;
   await handleFix({
     all,
+    allowOverrides,
     applyFixes,
     autopilot,
     coanaVersion: fixVersion,
@@ -24420,5 +24431,5 @@ process.on('unhandledRejection', async (reason, promise) => {
   // eslint-disable-next-line n/no-process-exit
   process.exit(1);
 });
-//# debugId=71bcae26-79e9-4006-9570-248817c517a
+//# debugId=49b84e0d-2ad3-4172-ac33-4d007769e3c8
 //# sourceMappingURL=cli.js.map