socketsecurity 2.4.9__tar.gz → 2.4.11__tar.gz

{socketsecurity-2.4.9 → socketsecurity-2.4.11}/CHANGELOG.md

@@ -1,5 +1,33 @@
 # Changelog
 
+## 2.4.11
+
+### Changed: units for `--reach-analysis-timeout` and `--reach-analysis-memory-limit`
+
+- `--reach-analysis-timeout` now accepts a duration with an optional unit suffix — `s`, `m`
+  or `h` (e.g. `90s`, `10m`, `1h`). `--reach-analysis-memory-limit` now accepts a size with an
+  optional unit suffix — `MB` or `GB`, case-insensitive (e.g. `512MB`, `8GB`). The value is
+  passed through verbatim to the reachability engine (`@coana-tech/cli`), which owns parsing
+  and validation, so error messages come from a single source of truth.
+- Backward compatible: a bare number is still accepted (seconds for the timeout, MB for the
+  memory limit), exactly as before. This legacy form is no longer documented but keeps working.
+- Bumped the pinned `@coana-tech/cli` version to `15.5.0`, which ships the unit parser.
+
+## 2.4.10
+
+### Added: opt directories back into manifest discovery via `--include-dirs`
+
+- New `--include-dirs` flag (comma-separated directory names) that re-includes directories
+  the CLI excludes from manifest discovery by default. The default exclude list
+  (`node_modules`, `bower_components`, `jspm_packages`, `__pycache__`, `.venv`, `venv`,
+  `build`, `dist`, `.tox`, `.mypy_cache`, `.pytest_cache`, `*.egg-info`, `vendor`) is a sane
+  default, but some projects keep manifest files under those names — e.g. `build/requirements.txt`.
+  Pass `--include-dirs build,dist` to scan them. Names are matched against any path segment,
+  mirroring how the default exclude list is applied.
+- `--include-module-folders` now functions as documented: it re-includes the JS/TS module
+  folders (`node_modules`, `bower_components`, `jspm_packages`) as a group. Previously the
+  flag was accepted but had no effect.
+
 ## 2.4.9
 
 ### Added: opt-in streaming log channel via `--upload-logs`

{socketsecurity-2.4.9 → socketsecurity-2.4.11}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: socketsecurity
-Version: 2.4.9
+Version: 2.4.11
 Summary: Socket Security CLI for CI/CD
 Project-URL: Homepage, https://socket.dev
 Author-email: Douglas Coburn <douglas@socket.dev>

{socketsecurity-2.4.9 → socketsecurity-2.4.11}/docs/cli-reference.md

@@ -148,7 +148,7 @@ socketcli [-h] [--api-token API_TOKEN] [--repo REPO] [--workspace WORKSPACE] [--
           [--owner OWNER] [--pr-number PR_NUMBER] [--commit-message COMMIT_MESSAGE] [--commit-sha COMMIT_SHA] [--committers [COMMITTERS ...]]
           [--target-path TARGET_PATH] [--sbom-file SBOM_FILE] [--license-file-name LICENSE_FILE_NAME] [--save-submitted-files-list SAVE_SUBMITTED_FILES_LIST]
           [--save-manifest-tar SAVE_MANIFEST_TAR] [--files FILES] [--sub-path SUB_PATH] [--workspace-name WORKSPACE_NAME]
-          [--excluded-ecosystems EXCLUDED_ECOSYSTEMS] [--exclude-paths EXCLUDE_PATHS] [--default-branch] [--pending-head] [--generate-license] [--enable-debug]
+          [--excluded-ecosystems EXCLUDED_ECOSYSTEMS] [--exclude-paths EXCLUDE_PATHS] [--include-dirs INCLUDE_DIRS] [--default-branch] [--pending-head] [--generate-license] [--enable-debug]
           [--enable-json] [--enable-sarif] [--sarif-file <path>] [--sarif-scope {diff,full}] [--sarif-grouping {instance,alert}] [--sarif-reachability {all,reachable,potentially,reachable-or-potentially}] [--enable-gitlab-security] [--gitlab-security-file <path>]
           [--disable-overview] [--exclude-license-details] [--allow-unverified] [--disable-security-issue]
           [--ignore-commit-files] [--disable-blocking] [--disable-ignore] [--enable-diff] [--scm SCM] [--timeout TIMEOUT] [--include-module-folders]
@@ -205,13 +205,14 @@ If you don't want to provide the Socket API Token every time then you can use th
 | `--workspace-name`            | False    |                       | Workspace name suffix to append to repository name (repo-name-workspace_name). Must be used with `--sub-path`                                                                     |
 | `--excluded-ecosystems`       | False    | []                    | List of ecosystems to exclude from analysis (JSON array string). You can get supported files from the [Supported Files API](https://docs.socket.dev/reference/getsupportedfiles) |
 | `--exclude-paths`             | False    |                       | Comma-separated paths/globs to exclude from **both** manifest discovery (every scan) **and** reachability analysis (e.g. `tests/**,packages/legacy,*.spec.ts`). Patterns are scan-root-relative, case-sensitive globs where `*` does not cross `/` and `**` does. Supersedes `--reach-exclude-paths`. |
+| `--include-dirs`              | False    |                       | Comma-separated directory **names** that are excluded from manifest discovery by default but should be scanned (e.g. `build,dist`). Names are matched against any path segment, mirroring the default exclude list (`node_modules`, `bower_components`, `jspm_packages`, `__pycache__`, `.venv`, `venv`, `build`, `dist`, `.tox`, `.mypy_cache`, `.pytest_cache`, `*.egg-info`, `vendor`). Use this when manifest files live under a normally-ignored folder, e.g. `build/requirements.txt`. |
 
 #### Branch and Scan Configuration
 | Parameter                | Required | Default | Description                                                                                           |
 |:-------------------------|:---------|:--------|:------------------------------------------------------------------------------------------------------|
 | `--default-branch`         | False    | *auto*  | Make this branch the default branch (auto-detected from git and CI environment when not specified)   |
 | `--pending-head`           | False    | *auto*  | If true, the new scan will be set as the branch's head scan (automatically synced with default-branch) |
-| `--include-module-folders` | False    | False   | If enabled will include manifest files from folders like node_modules                                |
+| `--include-module-folders` | False    | False   | If enabled, re-includes the JS/TS module folders (`node_modules`, `bower_components`, `jspm_packages`) in manifest discovery. For other excluded directories, use `--include-dirs`. |
 
 #### Output Configuration
 | Parameter                 | Required | Default | Description                                                                       |
@@ -240,9 +241,9 @@ If you don't want to provide the Socket API Token every time then you can use th
 | Parameter                        | Required | Default | Description                                                                                                                |
 |:---------------------------------|:---------|:--------|:---------------------------------------------------------------------------------------------------------------------------|
 | `--reach`                          | False    | False   | Enable reachability analysis to identify which vulnerable functions are actually called by your code. Creates a tier-1 full-application reachability scan (`scan_type=socket_tier1`). |
-| `--reach-version`                  | False    | 15.3.24 | Version of @coana-tech/cli to use. Defaults to the pinned version that ships with this CLI release, so the engine only changes when you upgrade the Socket CLI. Pass `latest` to always use the newest published version (opt-in auto-update), or an explicit version (e.g. `1.2.3`) to pin it. |
-| `--reach-analysis-timeout`         | False    | 600     | Timeout in seconds for the reachability analysis. Omitted by default, so coana applies its own default. Alias: `--reach-timeout` |
-| `--reach-analysis-memory-limit`    | False    | 8192    | Memory limit in MB for the reachability analysis. Omitted by default, so coana applies its own default. Alias: `--reach-memory-limit` |
+| `--reach-version`                  | False    | 15.5.0  | Version of @coana-tech/cli to use. Defaults to the pinned version that ships with this CLI release, so the engine only changes when you upgrade the Socket CLI. Pass `latest` to always use the newest published version (opt-in auto-update), or an explicit version (e.g. `1.2.3`) to pin it. |
+| `--reach-analysis-timeout`         | False    | 10m     | Timeout for each reachability analysis run, e.g. `90s`, `10m` or `1h`. Omitted by default, so coana applies its own default (`10m`). Alias: `--reach-timeout` |
+| `--reach-analysis-memory-limit`    | False    | 8GB     | Memory limit for each reachability analysis run, e.g. `512MB` or `8GB`. Omitted by default, so coana applies its own default (`8GB`). Alias: `--reach-memory-limit` |
 | `--reach-concurrency`              | False    | 1       | Control parallel analysis execution (must be >= 1). Omitted by default, so coana applies its own default.                  |
 | `--reach-additional-params`        | False    |         | Pass custom parameters to the coana CLI tool                                                                               |
 | `--reach-ecosystems`               | False    |         | Comma-separated list of ecosystems to analyze (e.g., "npm,pypi"). If not specified, all supported ecosystems are analyzed  |

{socketsecurity-2.4.9 → socketsecurity-2.4.11}/pyproject.toml

@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.4.9"
+version = "2.4.11"
 requires-python = ">= 3.11"
 license = {"file" = "LICENSE"}
 dependencies = [

{socketsecurity-2.4.9 → socketsecurity-2.4.11}/socketsecurity/__init__.py

@@ -1,3 +1,3 @@
 __author__ = 'socket.dev'
-__version__ = '2.4.9'
+__version__ = '2.4.11'
 USER_AGENT = f'SocketPythonCLI/{__version__}'

{socketsecurity-2.4.9 → socketsecurity-2.4.11}/socketsecurity/config.py

@@ -154,6 +154,7 @@ class CliConfig:
     repo_is_public: bool = False
     excluded_ecosystems: list[str] = field(default_factory=lambda: [])
     exclude_paths: Optional[List[str]] = None
+    included_dirs: List[str] = field(default_factory=lambda: [])
     version: str = __version__
     jira_plugin: PluginConfig = field(default_factory=PluginConfig)
     slack_plugin: PluginConfig = field(default_factory=PluginConfig)
@@ -167,8 +168,8 @@ class CliConfig:
     # Reachability Flags
     reach: bool = False
     reach_version: Optional[str] = None
-    reach_analysis_memory_limit: Optional[int] = None
-    reach_analysis_timeout: Optional[int] = None
+    reach_analysis_memory_limit: Optional[str] = None
+    reach_analysis_timeout: Optional[str] = None
     reach_disable_analytics: bool = False
     reach_disable_analysis_splitting: bool = False  # Deprecated, kept for backwards compatibility
     reach_enable_analysis_splitting: bool = False
@@ -314,6 +315,7 @@ class CliConfig:
             'reach_ecosystems': args.reach_ecosystems.split(',') if args.reach_ecosystems else None,
             'reach_exclude_paths': args.reach_exclude_paths.split(',') if args.reach_exclude_paths else None,
             'exclude_paths': normalize_exclude_paths(args.exclude_paths),
+            'included_dirs': normalize_exclude_paths(args.include_dirs) or [],
             'reach_skip_cache': args.reach_skip_cache,
             'reach_min_severity': args.reach_min_severity,
             'reach_output_file': args.reach_output_file,
@@ -639,6 +641,17 @@ def create_argument_parser() -> argparse.ArgumentParser:
              "Supersedes --reach-exclude-paths."
     )
 
+    path_group.add_argument(
+        "--include-dirs",
+        dest="include_dirs",
+        metavar="<list>",
+        help="Comma-separated directory names that are excluded from manifest discovery by "
+             "default but should be scanned (e.g. 'build,dist'). Names are matched against any "
+             "path segment, mirroring the default exclude list. Defaults excluded: "
+             "node_modules, bower_components, jspm_packages, __pycache__, .venv, venv, build, "
+             "dist, .tox, .mypy_cache, .pytest_cache, *.egg-info, vendor."
+    )
+
     # Branch and Scan Configuration
     config_group = parser.add_argument_group('Branch and Scan Configuration')
     config_group.add_argument(
@@ -975,29 +988,25 @@ def create_argument_parser() -> argparse.ArgumentParser:
     reachability_group.add_argument(
         "--reach-analysis-timeout",
         dest="reach_analysis_timeout",
-        type=int,
-        metavar="<seconds>",
-        help="Timeout for reachability analysis in seconds"
+        metavar="<duration>",
+        help="Set the timeout for each reachability analysis run, e.g. 90s, 10m or 1h. (default: 10m)"
     )
     # Backwards-compatible alias for the pre-alignment name. Kept working, hidden from help.
     reachability_group.add_argument(
         "--reach-timeout",
         dest="reach_analysis_timeout",
-        type=int,
         help=argparse.SUPPRESS
     )
     reachability_group.add_argument(
         "--reach-analysis-memory-limit",
         dest="reach_analysis_memory_limit",
-        type=int,
-        metavar="<mb>",
-        help="Memory limit for reachability analysis in MB (defaults to the coana CLI's own default, currently 8192)"
+        metavar="<size>",
+        help="Set the memory limit for each reachability analysis run, e.g. 512MB or 8GB. (default: 8GB)"
     )
     # Backwards-compatible alias for the pre-alignment name. Kept working, hidden from help.
     reachability_group.add_argument(
         "--reach-memory-limit",
         dest="reach_analysis_memory_limit",
-        type=int,
         help=argparse.SUPPRESS
     )
     reachability_group.add_argument(

{socketsecurity-2.4.9 → socketsecurity-2.4.11}/socketsecurity/core/socket_config.py

@@ -15,6 +15,10 @@ default_exclude_dirs = {
     "vendor"
 }
 
+# Subset of default_exclude_dirs that hold installed JS/TS modules. Re-included as a group
+# by --include-module-folders (see CliConfig.include_module_folders).
+module_folder_dirs = {"node_modules", "bower_components", "jspm_packages"}
+
 @dataclass
 class SocketConfig:
     api_key: str

{socketsecurity-2.4.9 → socketsecurity-2.4.11}/socketsecurity/core/tools/reachability.py

@@ -18,7 +18,7 @@ log = logging.getLogger(__name__)
 # Pinned @coana-tech/cli version. Bumped deliberately per Python CLI release so the
 # reachability engine version only changes through a standard pip upgrade (advance notice).
 # Pass --reach-version latest to opt into the newest published version instead.
-DEFAULT_COANA_CLI_VERSION: Final = "15.3.24"
+DEFAULT_COANA_CLI_VERSION: Final = "15.5.0"
 
 # Resolved @coana-tech/cli script paths from the npm-install fallback, keyed by version.
 # Lives for the process lifetime so repeated fallback invocations install only once
@@ -55,7 +55,7 @@ class ReachabilityAnalyzer:
     
     def _resolve_coana_package_spec(self, version: Optional[str] = None) -> str:
         """
-        Resolve the @coana-tech/cli package spec to run (e.g. '@coana-tech/cli@15.3.24').
+        Resolve the @coana-tech/cli package spec to run (e.g. '@coana-tech/cli@15.5.0').
 
         Args:
             version: Coana CLI version to use.
@@ -64,7 +64,7 @@ class ReachabilityAnalyzer:
                 - '<semver>': that exact version.
 
         Returns:
-            str: The package specifier to use with npx (e.g. '@coana-tech/cli@15.3.24').
+            str: The package specifier to use with npx (e.g. '@coana-tech/cli@15.5.0').
         """
         return f"@coana-tech/cli@{self._resolve_coana_version(version)}"
 
@@ -79,8 +79,8 @@ class ReachabilityAnalyzer:
         target_directory: str,
         tar_hash: Optional[str] = None,
         output_path: str = ".socket.facts.json",
-        timeout: Optional[int] = None,
-        memory_limit: Optional[int] = None,
+        timeout: Optional[str] = None,
+        memory_limit: Optional[str] = None,
         ecosystems: Optional[List[str]] = None,
         exclude_paths: Optional[List[str]] = None,
         min_severity: Optional[str] = None,
@@ -112,8 +112,10 @@ class ReachabilityAnalyzer:
             target_directory: Directory to analyze
             tar_hash: Tar hash from manifest upload or existing scan (optional)
             output_path: Output file path for results
-            timeout: Analysis timeout in seconds
-            memory_limit: Memory limit in MB
+            timeout: Analysis timeout, forwarded verbatim to coana --analysis-timeout
+                (coana parses the units, e.g. '90s', '10m', '1h'; a bare number is seconds)
+            memory_limit: Memory limit, forwarded verbatim to coana --memory-limit
+                (coana parses the units, e.g. '512MB', '8GB'; a bare number is MB)
             ecosystems: List of ecosystems to analyze (e.g., ['npm', 'pypi'])
             exclude_paths: Paths to exclude from analysis
             min_severity: Minimum severity level (info, low, moderate, high, critical)
@@ -149,11 +151,15 @@ class ReachabilityAnalyzer:
             "--disable-report-submission"
         ])
         
-        # Add conditional arguments
-        if timeout:
+        # Add conditional arguments. timeout/memory_limit are forwarded verbatim; coana owns
+        # unit parsing/validation (e.g. '90s', '8GB'). We coerce to str only for subprocess
+        # safety — config-file values can arrive as ints via argparse set_defaults — and use
+        # `is not None` (not truthiness) so an explicit empty string still reaches coana and
+        # triggers coana's own error, rather than being silently dropped.
+        if timeout is not None:
             coana_args.extend(["--analysis-timeout", str(timeout)])
-        
-        if memory_limit:
+
+        if memory_limit is not None:
             coana_args.extend(["--memory-limit", str(memory_limit)])
         
         if disable_analytics:

{socketsecurity-2.4.9 → socketsecurity-2.4.11}/socketsecurity/socketcli.py

@@ -19,7 +19,7 @@ from socketsecurity.core.git_interface import Git
 from socketsecurity.core.logging import initialize_logging, set_debug_mode
 from socketsecurity.core.messages import Messages
 from socketsecurity.core.scm_comments import Comments
-from socketsecurity.core.socket_config import SocketConfig
+from socketsecurity.core.socket_config import SocketConfig, module_folder_dirs
 from socketsecurity.core.streaming import StreamingLogs
 from socketsecurity.fossa_compat import build_fossa_attribution_payload
 from socketsecurity.output import OutputHandler
@@ -195,7 +195,19 @@ def main_code():
     ) as streaming:
         core = Core(socket_config, sdk, config)
         log.debug("loaded core")
-        
+
+        # Re-include directories that are excluded from manifest discovery by default
+        # (e.g. build/dist). --include-dirs names them individually; --include-module-folders
+        # re-includes the JS module folders as a group. Build a new set rather than mutating
+        # the shared default_exclude_dirs in place. Applied here so it covers every find_files
+        # call below, including the sub-path manifest pre-check.
+        dirs_to_include = set(config.included_dirs or [])
+        if config.include_module_folders:
+            dirs_to_include |= module_folder_dirs
+        if dirs_to_include:
+            core.config.excluded_dirs = set(core.config.excluded_dirs) - dirs_to_include
+            log.debug(f"Re-including normally-excluded directories in scan: {sorted(dirs_to_include)}")
+
         # Check for required dependencies if reachability analysis is enabled
         if config.reach:
             log.info("Reachability analysis enabled, checking for required dependencies...")

{socketsecurity-2.4.9 → socketsecurity-2.4.11}/tests/unit/test_config.py

@@ -180,21 +180,31 @@ class TestReachAlignmentFlags:
         assert config.reach_analysis_timeout is None
 
     def test_reach_node_style_name_aliases(self):
-        """G8: Node-style primary names map to the same dests."""
+        """G8: Node-style primary names map to the same dests. Values are kept as raw
+        strings and forwarded verbatim to coana (coana owns unit parsing)."""
         config = CliConfig.from_args(
             self.BASE_ARGS
             + ["--reach", "--reach-analysis-timeout", "300", "--reach-analysis-memory-limit", "2048"]
         )
-        assert config.reach_analysis_timeout == 300
-        assert config.reach_analysis_memory_limit == 2048
+        assert config.reach_analysis_timeout == "300"
+        assert config.reach_analysis_memory_limit == "2048"
 
     def test_reach_legacy_name_aliases_still_work(self):
         """G8: pre-alignment names keep working (hidden aliases)."""
         config = CliConfig.from_args(
             self.BASE_ARGS + ["--reach", "--reach-timeout", "111", "--reach-memory-limit", "512"]
         )
-        assert config.reach_analysis_timeout == 111
-        assert config.reach_analysis_memory_limit == 512
+        assert config.reach_analysis_timeout == "111"
+        assert config.reach_analysis_memory_limit == "512"
+
+    def test_reach_unit_suffixes_are_passed_through_verbatim(self):
+        """Unit-bearing values (parsed/validated by coana) are stored as-is, not coerced."""
+        config = CliConfig.from_args(
+            self.BASE_ARGS
+            + ["--reach", "--reach-analysis-timeout", "10m", "--reach-analysis-memory-limit", "8GB"]
+        )
+        assert config.reach_analysis_timeout == "10m"
+        assert config.reach_analysis_memory_limit == "8GB"
 
     def test_reach_debug_flag(self):
         """G9: dedicated --reach-debug flag, independent of --enable-debug."""

socketsecurity-2.4.11/tests/unit/test_include_dirs.py

@@ -0,0 +1,99 @@
+"""Tests for --include-dirs (and the now-functional --include-module-folders).
+
+Covers config parsing of the comma-separated directory names and that re-including a
+normally-excluded directory (e.g. build) lets Core.find_files discover manifests under it.
+"""
+import types
+from unittest.mock import MagicMock
+
+import pytest
+
+from socketsecurity.config import CliConfig
+from socketsecurity.core import Core
+from socketsecurity.core.socket_config import (
+    SocketConfig,
+    default_exclude_dirs,
+    module_folder_dirs,
+)
+
+BASE_ARGS = ["--api-token", "test-token", "--repo", "test-repo"]
+
+
+# ---- config parsing ------------------------------------------------------
+
+def test_include_dirs_parses_to_list():
+    config = CliConfig.from_args(BASE_ARGS + ["--include-dirs", "build, dist , vendor"])
+    assert config.included_dirs == ["build", "dist", "vendor"]
+
+
+def test_include_dirs_defaults_empty():
+    config = CliConfig.from_args(BASE_ARGS)
+    assert config.included_dirs == []
+
+
+def test_include_dirs_from_config_file(tmp_path):
+    import json
+    cfg = tmp_path / "socketcli.json"
+    cfg.write_text(json.dumps({"socketcli": {"include_dirs": ["build", "dist"]}}), encoding="utf-8")
+    config = CliConfig.from_args(BASE_ARGS + ["--config", str(cfg)])
+    assert config.included_dirs == ["build", "dist"]
+
+
+def test_module_folder_dirs_is_subset_of_defaults():
+    assert module_folder_dirs <= default_exclude_dirs
+
+
+# ---- find_files integration ----------------------------------------------
+
+def _make_core(excluded_dirs):
+    core = Core.__new__(Core)
+    core.config = SocketConfig(api_key="test-key", excluded_dirs=excluded_dirs)
+    core.cli_config = types.SimpleNamespace(exclude_paths=None)
+    core.sdk = MagicMock()
+    return core
+
+
+def _seed_manifests(tmp_path):
+    for rel in ("requirements.txt", "build/requirements.txt", "dist/requirements.txt"):
+        p = tmp_path / rel
+        p.parent.mkdir(parents=True, exist_ok=True)
+        p.write_text("flask==1.0\n", encoding="utf-8")
+
+
+def test_find_files_excludes_build_by_default(tmp_path, mocker):
+    _seed_manifests(tmp_path)
+    core = _make_core(set(default_exclude_dirs))
+    mocker.patch.object(
+        core, "get_supported_patterns",
+        return_value={"pypi": {"requirements.txt": {"pattern": "requirements.txt"}}},
+    )
+
+    found = core.find_files(str(tmp_path))
+    assert not any("/build/" in f for f in found)
+    assert not any("/dist/" in f for f in found)
+    assert any(f.endswith("/requirements.txt") for f in found)
+
+
+def test_find_files_includes_build_when_unexcluded(tmp_path, mocker):
+    """Mirrors socketcli wiring: dropping a name from excluded_dirs re-includes its manifests."""
+    _seed_manifests(tmp_path)
+    core = _make_core(set(default_exclude_dirs) - {"build"})
+    mocker.patch.object(
+        core, "get_supported_patterns",
+        return_value={"pypi": {"requirements.txt": {"pattern": "requirements.txt"}}},
+    )
+
+    found = core.find_files(str(tmp_path))
+    assert any("/build/requirements.txt" in f for f in found)
+    # dist is still excluded since only build was re-included
+    assert not any("/dist/" in f for f in found)
+
+
+def test_unexcluding_does_not_mutate_shared_defaults():
+    """The socketcli flow builds a new set rather than mutating the module-level default."""
+    before = set(default_exclude_dirs)
+    config = SocketConfig(api_key="test-key")
+    config.excluded_dirs = set(config.excluded_dirs) - {"build"}
+    assert "build" not in config.excluded_dirs
+    assert default_exclude_dirs == before
+    assert "build" in default_exclude_dirs

{socketsecurity-2.4.9 → socketsecurity-2.4.11}/tests/unit/test_reachability.py

@@ -87,11 +87,26 @@ def test_disable_external_tool_checks(analyzer, mocker):
 
 def test_concurrency_and_memory_args(analyzer, mocker):
     """G7: explicit concurrency/memory propagate as coana args."""
-    cmd, _ = _run(analyzer, mocker, concurrency=1, memory_limit=8192)
+    cmd, _ = _run(analyzer, mocker, concurrency=1, memory_limit="8192")
     assert "--concurrency" in cmd and cmd[cmd.index("--concurrency") + 1] == "1"
     assert "--memory-limit" in cmd and cmd[cmd.index("--memory-limit") + 1] == "8192"
 
 
+def test_timeout_and_memory_units_forwarded_verbatim(analyzer, mocker):
+    """Unit-bearing timeout/memory strings are forwarded to coana untouched (coana parses them)."""
+    cmd, _ = _run(analyzer, mocker, timeout="10m", memory_limit="8GB")
+    assert cmd[cmd.index("--analysis-timeout") + 1] == "10m"
+    assert cmd[cmd.index("--memory-limit") + 1] == "8GB"
+
+
+def test_timeout_and_memory_int_values_coerced_to_str(analyzer, mocker):
+    """Config-file values can arrive as ints (set_defaults bypasses argparse type=); they must
+    still reach subprocess as strings, not raw ints."""
+    cmd, _ = _run(analyzer, mocker, timeout=300, memory_limit=2048)
+    assert cmd[cmd.index("--analysis-timeout") + 1] == "300"
+    assert cmd[cmd.index("--memory-limit") + 1] == "2048"
+
+
 def test_env_identifies_python_cli(analyzer, mocker):
     """G5: SOCKET_CLI_VERSION + SOCKET_CALLER_USER_AGENT forwarded to coana."""
     _, env = _run(analyzer, mocker)

{socketsecurity-2.4.9 → socketsecurity-2.4.11}/uv.lock

@@ -1283,7 +1283,7 @@ wheels = [
 
 [[package]]
 name = "socketsecurity"
-version = "2.4.9"
+version = "2.4.11"
 source = { editable = "." }
 dependencies = [
     { name = "brotli", marker = "platform_python_implementation == 'CPython'" },