socketsecurity 2.11.4__tar.gz → 2.11.6__tar.gz

{socketsecurity-2.11.4 → socketsecurity-2.11.6}/CHANGELOG.md

@@ -1,5 +1,22 @@
 # Changelog
 
+## 2.11.6
+
+### Added: `--reach-disable-dependency-downloads`
+
+- Reachability analysis uses only dependencies that are already installed (e.g.
+  in `.venv`, `vendor/` or the module cache), and reports missing ones as
+  install failures.
+
+## 2.11.5
+
+### Changed: bump pinned Coana CLI to 15.13.2
+
+- Bumped the pinned reachability engine (the Coana CLI) from `15.13.0` to
+  `15.13.2`. See the
+  [reachability analysis changelog](https://docs.socket.dev/docs/reachability-analysis-changelog)
+  for engine changes.
+
 ## 2.11.4
 
 ### Fixed: bump `brotli` and `brotlicffi` to patched versions

{socketsecurity-2.11.4 → socketsecurity-2.11.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: socketsecurity
-Version: 2.11.4
+Version: 2.11.6
 Summary: Socket Security CLI for CI/CD
 Project-URL: Homepage, https://socket.dev
 Author-email: Douglas Coburn <douglas@socket.dev>

{socketsecurity-2.11.4 → socketsecurity-2.11.6}/docs/cli-reference.md

@@ -219,7 +219,7 @@ socketcli [-h] [--api-token API_TOKEN] [--repo REPO] [--workspace WORKSPACE] [--
           [--reach] [--reach-version REACH_VERSION] [--reach-analysis-timeout REACH_ANALYSIS_TIMEOUT]
           [--reach-analysis-memory-limit REACH_ANALYSIS_MEMORY_LIMIT] [--reach-concurrency REACH_CONCURRENCY] [--reach-ecosystems REACH_ECOSYSTEMS]
           [--reach-min-severity <level>] [--reach-skip-cache] [--reach-disable-analytics] [--reach-enable-analysis-splitting] [--reach-detailed-analysis-log-file]
-          [--reach-use-only-pregenerated-sboms] [--reach-debug] [--reach-disable-external-tool-checks]
+          [--reach-use-only-pregenerated-sboms] [--reach-debug] [--reach-disable-external-tool-checks] [--reach-disable-dependency-downloads]
           [--reach-output-file REACH_OUTPUT_FILE] [--only-facts-file] [--version]
 ````
 
@@ -338,7 +338,7 @@ If you don't want to provide the Socket API Token every time then you can use th
 | Parameter                        | Required | Default | Description                                                                                                                |
 |:---------------------------------|:---------|:--------|:---------------------------------------------------------------------------------------------------------------------------|
 | `--reach`                          | False    | False   | Enable reachability analysis to identify which vulnerable functions are actually called by your code. Creates a full application reachability scan (`scan_type=socket_tier1`). |
-| `--reach-version`                  | False    | 15.13.0 | Version of the Coana CLI to use. Defaults to the pinned version that ships with this CLI release, so the engine only changes when you upgrade the Socket CLI. Pass `latest` to always use the newest published version (opt-in auto-update), or an explicit version (e.g. `1.2.3`) to pin it. |
+| `--reach-version`                  | False    | 15.13.2 | Version of the Coana CLI to use. Defaults to the pinned version that ships with this CLI release, so the engine only changes when you upgrade the Socket CLI. Pass `latest` to always use the newest published version (opt-in auto-update), or an explicit version (e.g. `1.2.3`) to pin it. |
 | `--reach-analysis-timeout`         | False    | 10m     | Timeout for each reachability analysis run, e.g. `90s`, `10m` or `1h`. Omitted by default, so coana applies its own default (`10m`). Alias: `--reach-timeout` |
 | `--reach-analysis-memory-limit`    | False    | 8GB     | Memory limit for each reachability analysis run, e.g. `512MB` or `8GB`. Omitted by default, so coana applies its own default (`8GB`). Alias: `--reach-memory-limit` |
 | `--reach-concurrency`              | False    | 1       | Control parallel analysis execution (must be >= 1). Omitted by default, so coana applies its own default.                  |
@@ -352,6 +352,7 @@ If you don't want to provide the Socket API Token every time then you can use th
 | `--reach-use-only-pregenerated-sboms` | False | False   | Build the scan only from pre-generated CycloneDX (CDX) and SPDX files in your project (requires --reach)                    |
 | `--reach-debug`                    | False    | False   | Enable coana debug output (`--debug`) for the analysis, independent of the global `--enable-debug`                         |
 | `--reach-disable-external-tool-checks` | False | False | Disable coana's external tool availability checks (passes `--disable-external-tool-checks`)                              |
+| `--reach-disable-dependency-downloads` | False | False | Only analyze dependencies that are already installed (e.g. in `.venv`, `vendor/` or the module cache); missing ones count as install failures (passes `--disable-dependency-downloads`) |
 | `--reach-output-file`              | False    | .socket.facts.json | Path where reachability analysis results should be saved                                                        |
 | `--reach-exclude-paths`            | False    |         | **[DEPRECATED — use `--exclude-paths`]** Comma-separated paths to exclude from reachability analysis. Still honored (unioned with `--exclude-paths`) but will be hidden in a future release |
 | `--only-facts-file`                | False    | False   | Submit only the .socket.facts.json file when creating the full scan (requires --reach)                                     |

{socketsecurity-2.11.4 → socketsecurity-2.11.6}/pyproject.toml

@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.11.4"
+version = "2.11.6"
 requires-python = ">= 3.11"
 license = {"file" = "LICENSE"}
 dependencies = [

{socketsecurity-2.11.4 → socketsecurity-2.11.6}/socketsecurity/__init__.py

@@ -1,3 +1,3 @@
 __author__ = 'socket.dev'
-__version__ = '2.11.4'
+__version__ = '2.11.6'
 USER_AGENT = f'SocketPythonCLI/{__version__}'

{socketsecurity-2.11.4 → socketsecurity-2.11.6}/socketsecurity/config.py

@@ -222,6 +222,7 @@ class CliConfig:
     reach_continue_on_no_source_files: bool = False
     reach_debug: bool = False
     reach_disable_external_tool_checks: bool = False
+    reach_disable_dependency_downloads: bool = False
     max_purl_batch_size: int = 5000
     enable_commit_status: bool = False
     legal: bool = False
@@ -369,6 +370,7 @@ class CliConfig:
             'reach_continue_on_no_source_files': args.reach_continue_on_no_source_files,
             'reach_debug': args.reach_debug,
             'reach_disable_external_tool_checks': args.reach_disable_external_tool_checks,
+            'reach_disable_dependency_downloads': args.reach_disable_dependency_downloads,
             'max_purl_batch_size': args.max_purl_batch_size,
             'enable_commit_status': args.enable_commit_status,
             'legal': args.legal or args.legal_format == "fossa",
@@ -1223,6 +1225,14 @@ def create_argument_parser() -> argparse.ArgumentParser:
         help="Disable coana's external tool availability checks during reachability analysis "
              "(passes --disable-external-tool-checks to the coana CLI)."
     )
+    reachability_group.add_argument(
+        "--reach-disable-dependency-downloads",
+        dest="reach_disable_dependency_downloads",
+        action="store_true",
+        help="Only analyze dependencies that are already installed (e.g. in the project's .venv, "
+             "vendor directory or module cache); missing ones count as install failures "
+             "(passes --disable-dependency-downloads to the coana CLI)."
+    )
 
     parser.add_argument(
         '--version',

{socketsecurity-2.11.4 → socketsecurity-2.11.6}/socketsecurity/core/tools/reachability.py

@@ -22,7 +22,7 @@ log = logging.getLogger(__name__)
 # Pinned Coana CLI version. Bumped deliberately per Python CLI release so the
 # reachability engine version only changes through a standard pip upgrade (advance notice).
 # Pass --reach-version latest to opt into the newest published version instead.
-DEFAULT_COANA_CLI_VERSION: Final = "15.13.0"
+DEFAULT_COANA_CLI_VERSION: Final = "15.13.2"
 
 # Vendored from coana-package-manager, where it is generated; the only code that may read or
 # write the cache Coana shares with the Socket CLIs. See "Launching Coana" in that repo's
@@ -124,6 +124,7 @@ class ReachabilityAnalyzer:
         continue_on_no_source_files: bool = False,
         reach_debug: bool = False,
         disable_external_tool_checks: bool = False,
+        disable_dependency_downloads: bool = False,
     ) -> Dict[str, Any]:
         """
         Run reachability analysis.
@@ -213,6 +214,9 @@ class ReachabilityAnalyzer:
         if disable_external_tool_checks:
             coana_args.append("--disable-external-tool-checks")
 
+        if disable_dependency_downloads:
+            coana_args.append("--disable-dependency-downloads")
+
         if use_only_pregenerated_sboms:
             coana_args.append("--use-only-pregenerated-sboms")
 

{socketsecurity-2.11.4 → socketsecurity-2.11.6}/socketsecurity/socketcli.py

@@ -552,6 +552,7 @@ def main_code():
                         continue_on_no_source_files=config.reach_continue_on_no_source_files,
                         reach_debug=config.reach_debug,
                         disable_external_tool_checks=config.reach_disable_external_tool_checks,
+                        disable_dependency_downloads=config.reach_disable_dependency_downloads,
                     )
                     
                     log.info("Reachability analysis completed successfully")

{socketsecurity-2.11.4 → socketsecurity-2.11.6}/uv.lock

@@ -1332,7 +1332,7 @@ wheels = [
 
 [[package]]
 name = "socketsecurity"
-version = "2.11.4"
+version = "2.11.6"
 source = { editable = "." }
 dependencies = [
     { name = "beautifulsoup4" },