socketsecurity 2.1.0__tar.gz → 2.1.3__tar.gz

{socketsecurity-2.1.0 → socketsecurity-2.1.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: socketsecurity
-Version: 2.1.0
+Version: 2.1.3
 Summary: Socket Security CLI for CI/CD
 Project-URL: Homepage, https://socket.dev
 Author-email: Douglas Coburn <douglas@socket.dev>
@@ -39,7 +39,7 @@ Requires-Dist: packaging
 Requires-Dist: prettytable
 Requires-Dist: python-dotenv
 Requires-Dist: requests
-Requires-Dist: socket-sdk-python<3,>=2.1.2
+Requires-Dist: socket-sdk-python<3,>=2.1.5
 Provides-Extra: dev
 Requires-Dist: hatch; extra == 'dev'
 Requires-Dist: pip-tools>=7.4.0; extra == 'dev'
@@ -96,12 +96,12 @@ If you don't want to provide the Socket API Token every time then you can use th
 | --commit-sha     | False    | ""      | Commit SHA          |
 
 #### Path and File
-| Parameter          | Required | Default | Description                                                                                                                                                                    |
-|:-------------------|:---------|:--------|:-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| --target-path      | False    | ./      | Target path for analysis                                                                                                                                                       |
-| --sbom-file        | False    |         | SBOM file path                                                                                                                                                                 |
-| --files            | False    | []      | Files to analyze (JSON array string)                                                                                                                                           |
-| --exclude-patterns | False    | []      | List of patterns to exclude from analysis (JSON array string). You can get supported files form the [Supported Files API](https://docs.socket.dev/reference/getsupportedfiles) |
+| Parameter             | Required | Default | Description                                                                                                                                                                    |
+|:----------------------|:---------|:--------|:-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| --target-path         | False    | ./      | Target path for analysis                                                                                                                                                       |
+| --sbom-file           | False    |         | SBOM file path                                                                                                                                                                 |
+| --files               | False    | []      | Files to analyze (JSON array string)                                                                                                                                           |
+| --excluded-ecosystems | False    | []      | List of ecosystems to exclude from analysis (JSON array string). You can get supported files from the [Supported Files API](https://docs.socket.dev/reference/getsupportedfiles) |
 
 #### Branch and Scan Configuration
 | Parameter        | Required | Default | Description                                                 |

{socketsecurity-2.1.0 → socketsecurity-2.1.3}/README.md

@@ -40,12 +40,12 @@ If you don't want to provide the Socket API Token every time then you can use th
 | --commit-sha     | False    | ""      | Commit SHA          |
 
 #### Path and File
-| Parameter          | Required | Default | Description                                                                                                                                                                    |
-|:-------------------|:---------|:--------|:-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| --target-path      | False    | ./      | Target path for analysis                                                                                                                                                       |
-| --sbom-file        | False    |         | SBOM file path                                                                                                                                                                 |
-| --files            | False    | []      | Files to analyze (JSON array string)                                                                                                                                           |
-| --exclude-patterns | False    | []      | List of patterns to exclude from analysis (JSON array string). You can get supported files form the [Supported Files API](https://docs.socket.dev/reference/getsupportedfiles) |
+| Parameter             | Required | Default | Description                                                                                                                                                                    |
+|:----------------------|:---------|:--------|:-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| --target-path         | False    | ./      | Target path for analysis                                                                                                                                                       |
+| --sbom-file           | False    |         | SBOM file path                                                                                                                                                                 |
+| --files               | False    | []      | Files to analyze (JSON array string)                                                                                                                                           |
+| --excluded-ecosystems | False    | []      | List of ecosystems to exclude from analysis (JSON array string). You can get supported files from the [Supported Files API](https://docs.socket.dev/reference/getsupportedfiles) |
 
 #### Branch and Scan Configuration
 | Parameter        | Required | Default | Description                                                 |

{socketsecurity-2.1.0 → socketsecurity-2.1.3}/pyproject.toml

@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.1.0"
+version = "2.1.3"
 requires-python = ">= 3.10"
 license = {"file" = "LICENSE"}
 dependencies = [
@@ -16,7 +16,7 @@ dependencies = [
     'GitPython',
     'packaging',
     'python-dotenv',
-    'socket-sdk-python>=2.1.2,<3'
+    'socket-sdk-python>=2.1.5,<3'
 ]
 readme = "README.md"
 description = "Socket Security CLI for CI/CD"

{socketsecurity-2.1.0 → socketsecurity-2.1.3}/socketsecurity/__init__.py

@@ -1,2 +1,2 @@
 __author__ = 'socket.dev'
-__version__ = '2.1.0'
+__version__ = '2.1.3'

{socketsecurity-2.1.0 → socketsecurity-2.1.3}/socketsecurity/core/__init__.py

@@ -15,7 +15,7 @@ from socketdev.fullscans import FullScanParams, SocketArtifact
 from socketdev.org import Organization
 from socketdev.repos import RepositoryInfo
 from socketdev.settings import SecurityPolicyRule
-
+import copy
 from socketsecurity import __version__
 from socketsecurity.core.classes import (
     Alert,
@@ -187,6 +187,7 @@ class Core:
         for ecosystem in patterns:
             if ecosystem in self.config.excluded_ecosystems:
                 continue
+            log.info(f'Scanning ecosystem: {ecosystem}')
             ecosystem_patterns = patterns[ecosystem]
             for file_name in ecosystem_patterns:
                 original_pattern = ecosystem_patterns[file_name]["pattern"]
@@ -209,7 +210,7 @@ class Core:
                     glob_end = time.time()
                     log.debug(f"Globbing took {glob_end - glob_start:.4f} seconds")
 
-        log.debug(f"Total files found: {len(files)}")
+        log.info(f"Total files found: {len(files)}")
         return sorted(files)
 
     def get_supported_patterns(self) -> Dict:
@@ -331,7 +332,7 @@ class Core:
         Returns:
             FullScan object with scan results
         """
-        log.debug("Creating new full scan")
+        log.info("Creating new full scan")
         create_full_start = time.time()
 
         res = self.sdk.fullscans.post(files, params, use_types=True)
@@ -627,11 +628,14 @@ class Core:
             head_full_scan_id = None
 
         if head_full_scan_id is None:
-            tmp_params = params
+            new_params = copy.deepcopy(params.__dict__)
+            new_params.pop('include_license_details')
+            tmp_params = FullScanParams(**new_params)
+            tmp_params.include_license_details = params.include_license_details
             tmp_params.tmp = True
             tmp_params.set_as_pending_head = False
             tmp_params.make_default_branch = False
-            head_full_scan = self.create_full_scan(Core.empty_head_scan_file(), params)
+            head_full_scan = self.create_full_scan(Core.empty_head_scan_file(), tmp_params)
             head_full_scan_id = head_full_scan.id
 
         # Create new scan
@@ -666,7 +670,7 @@ class Core:
         diff.report_url = report_url
 
         if head_full_scan_id is not None:
-            diff.diff_url = f"{base_socket}/{self.config.org_slug}/diff/{diff.id}/{head_full_scan_id}"
+            diff.diff_url = f"{base_socket}/{self.config.org_slug}/diff/{head_full_scan_id}/{diff.id}"
         else:
             diff.diff_url = diff.report_url
 
@@ -795,6 +799,8 @@ class Core:
         introduced_by = []
         if package.direct:
             manifests = ""
+            if not hasattr(package, "manifestFiles"):
+                return introduced_by
             for manifest_data in package.manifestFiles:
                 manifest_file = manifest_data.get("file")
                 manifests += f"{manifest_file};"