socketsecurity 2.7.1__tar.gz → 2.7.2__tar.gz

{socketsecurity-2.7.1 → socketsecurity-2.7.2}/.github/workflows/python-tests.yml

@@ -67,6 +67,26 @@ jobs:
           uv export --no-hashes --no-emit-project --format requirements-txt > /tmp/req-audit.txt
           uvx pip-audit --strict --progress-spinner off --disable-pip --no-deps -r /tmp/req-audit.txt
 
+  ruff:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 1
+          persist-credentials: false
+      - name: 🐍 setup python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: ${{ env.PYTHON_VERSION }}
+      - name: 🛠️ install deps
+        run: |
+          python -m pip install --upgrade pip
+          pip install uv
+          uv sync --extra dev
+      - name: 🧹 run ruff
+        run: uv run ruff check
+
   unsupported-python-install:
     runs-on: ubuntu-latest
     timeout-minutes: 10

{socketsecurity-2.7.1 → socketsecurity-2.7.2}/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 2.7.2
+
+### Changed: bump pinned @coana-tech/cli to 15.10.39
+
+- Bumped the pinned reachability engine (`@coana-tech/cli`) from `15.10.36` to
+  `15.10.39`. See the [Coana changelogs](https://docs.coana.tech/changelogs) for
+  engine changes.
+
 ## 2.7.1
 
 ### Changed: bump pinned @coana-tech/cli to 15.10.36

{socketsecurity-2.7.1 → socketsecurity-2.7.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: socketsecurity
-Version: 2.7.1
+Version: 2.7.2
 Summary: Socket Security CLI for CI/CD
 Project-URL: Homepage, https://socket.dev
 Author-email: Douglas Coburn <douglas@socket.dev>

{socketsecurity-2.7.1 → socketsecurity-2.7.2}/docs/cli-reference.md

@@ -275,7 +275,7 @@ If you don't want to provide the Socket API Token every time then you can use th
 | Parameter                        | Required | Default | Description                                                                                                                |
 |:---------------------------------|:---------|:--------|:---------------------------------------------------------------------------------------------------------------------------|
 | `--reach`                          | False    | False   | Enable reachability analysis to identify which vulnerable functions are actually called by your code. Creates a full application reachability scan (`scan_type=socket_tier1`). |
-| `--reach-version`                  | False    | 15.10.36 | Version of @coana-tech/cli to use. Defaults to the pinned version that ships with this CLI release, so the engine only changes when you upgrade the Socket CLI. Pass `latest` to always use the newest published version (opt-in auto-update), or an explicit version (e.g. `1.2.3`) to pin it. |
+| `--reach-version`                  | False    | 15.10.39 | Version of @coana-tech/cli to use. Defaults to the pinned version that ships with this CLI release, so the engine only changes when you upgrade the Socket CLI. Pass `latest` to always use the newest published version (opt-in auto-update), or an explicit version (e.g. `1.2.3`) to pin it. |
 | `--reach-analysis-timeout`         | False    | 10m     | Timeout for each reachability analysis run, e.g. `90s`, `10m` or `1h`. Omitted by default, so coana applies its own default (`10m`). Alias: `--reach-timeout` |
 | `--reach-analysis-memory-limit`    | False    | 8GB     | Memory limit for each reachability analysis run, e.g. `512MB` or `8GB`. Omitted by default, so coana applies its own default (`8GB`). Alias: `--reach-memory-limit` |
 | `--reach-concurrency`              | False    | 1       | Control parallel analysis execution (must be >= 1). Omitted by default, so coana applies its own default.                  |

{socketsecurity-2.7.1 → socketsecurity-2.7.2}/pyproject.toml

@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.7.1"
+version = "2.7.2"
 requires-python = ">= 3.11"
 license = {"file" = "LICENSE"}
 dependencies = [

{socketsecurity-2.7.1 → socketsecurity-2.7.2}/socketsecurity/__init__.py

@@ -1,3 +1,3 @@
 __author__ = 'socket.dev'
-__version__ = '2.7.1'
+__version__ = '2.7.2'
 USER_AGENT = f'SocketPythonCLI/{__version__}'

{socketsecurity-2.7.1 → socketsecurity-2.7.2}/socketsecurity/config.py

@@ -1,12 +1,14 @@
 import argparse
+import json
 import logging
 import os
+import tomllib
 from dataclasses import asdict, dataclass, field
 from typing import List, Optional
-from socketsecurity import __version__
+
 from socketdev import INTEGRATION_TYPES, IntegrationType
-import json
-import tomllib
+
+from socketsecurity import __version__
 
 
 def get_plugin_config_from_env(prefix: str) -> dict:

{socketsecurity-2.7.1 → socketsecurity-2.7.2}/socketsecurity/core/cli_client.py

@@ -6,6 +6,7 @@ from typing import Dict, List, Optional, Union
 import requests
 
 from socketsecurity import USER_AGENT
+
 from .exceptions import APIFailure
 from .socket_config import SocketConfig
 

{socketsecurity-2.7.1 → socketsecurity-2.7.2}/socketsecurity/core/helper/__init__.py

@@ -1,7 +1,8 @@
+import string
+
 import markdown
 from bs4 import BeautifulSoup, Tag
 from bs4.element import NavigableString
-import string
 
 
 class Helper:

{socketsecurity-2.7.1 → socketsecurity-2.7.2}/socketsecurity/core/helper/socket_facts_loader.py

@@ -2,9 +2,9 @@
 
 import json
 import logging
-from pathlib import Path
-from typing import Dict, Any, Optional, List
 from copy import deepcopy
+from pathlib import Path
+from typing import Any, Dict, List, Optional
 
 logger = logging.getLogger(__name__)
 
@@ -65,7 +65,7 @@ def load_socket_facts(file_path: str = ".socket.facts.json") -> Optional[Dict[st
             return None
         
         if 'components' not in data:
-            logger.warning(f"Socket facts file missing 'components' key")
+            logger.warning("Socket facts file missing 'components' key")
         
         return data
     

{socketsecurity-2.7.1 → socketsecurity-2.7.2}/socketsecurity/core/lazy_file_loader.py

@@ -2,9 +2,7 @@
 Lazy file loading utilities for efficient manifest file processing.
 """
 import logging
-from typing import List, Tuple, Union, BinaryIO
-from io import BytesIO
-import os
+from typing import List, Tuple
 
 log = logging.getLogger("socketdev")
 

{socketsecurity-2.7.1 → socketsecurity-2.7.2}/socketsecurity/core/messages.py

@@ -5,6 +5,7 @@ import re
 import uuid
 from datetime import datetime, timezone
 from pathlib import Path
+
 from mdutils import MdUtils
 from prettytable import PrettyTable
 

{socketsecurity-2.7.1 → socketsecurity-2.7.2}/socketsecurity/core/resource_utils.py

@@ -2,7 +2,6 @@
 System resource utilities for the Socket Security CLI.
 """
 import logging
-import sys
 
 # The resource module is only available on Unix-like systems
 resource_available = False

{socketsecurity-2.7.1 → socketsecurity-2.7.2}/socketsecurity/core/scm/client.py

@@ -2,6 +2,7 @@ from abc import abstractmethod
 from typing import Dict
 
 from socketsecurity import USER_AGENT
+
 from ..cli_client import CliClient
 
 

{socketsecurity-2.7.1 → socketsecurity-2.7.2}/socketsecurity/core/scm/gitlab.py

@@ -2,9 +2,10 @@ import json
 import os
 import sys
 from dataclasses import dataclass
-from typing import Optional, Union
+from typing import Optional
 
 import requests
+
 from socketsecurity import USER_AGENT
 from socketsecurity.core import log
 from socketsecurity.core.classes import Comment
@@ -140,7 +141,7 @@ class Gitlab:
         except requests.exceptions.HTTPError as e:
             # Check if this is an authentication error (401)
             if e.response and e.response.status_code == 401:
-                log.debug(f"Authentication failed with initial headers, trying fallback method")
+                log.debug("Authentication failed with initial headers, trying fallback method")
                 
                 # Determine the fallback headers
                 original_headers = kwargs.get('headers', self.config.headers)
@@ -153,7 +154,7 @@ class Gitlab:
             
             # Re-raise the original exception if it's not an auth error or fallback failed
             raise
-        except Exception as e:
+        except Exception:
             # Handle other types of exceptions that don't have response attribute
             raise
 

{socketsecurity-2.7.1 → socketsecurity-2.7.2}/socketsecurity/core/socket_config.py

@@ -1,12 +1,11 @@
+import os
 from dataclasses import dataclass, field
-from typing import Dict, Optional
+from typing import List, Optional, Set
 from urllib.parse import urlparse
-from typing import Set, List
-import os
 
 from socketdev.core.issues import AllIssues
-from socketsecurity import __version__
 
+from socketsecurity import __version__
 
 default_exclude_dirs = {
     "node_modules", "bower_components", "jspm_packages",   # JS/TS

{socketsecurity-2.7.1 → socketsecurity-2.7.2}/socketsecurity/core/tools/reachability.py

@@ -1,15 +1,16 @@
-from socketdev import socketdev
-from typing import List, Optional, Dict, Any, Final
 import atexit
+import json
+import logging
 import os
+import pathlib
 import platform
 import shutil
 import subprocess
-import json
-import pathlib
-import logging
 import sys
 import tempfile
+from typing import Any, Dict, Final, List, Optional
+
+from socketdev import socketdev
 
 from socketsecurity import __version__
 
@@ -18,7 +19,7 @@ log = logging.getLogger(__name__)
 # Pinned @coana-tech/cli version. Bumped deliberately per Python CLI release so the
 # reachability engine version only changes through a standard pip upgrade (advance notice).
 # Pass --reach-version latest to opt into the newest published version instead.
-DEFAULT_COANA_CLI_VERSION: Final = "15.10.36"
+DEFAULT_COANA_CLI_VERSION: Final = "15.10.39"
 
 # Resolved @coana-tech/cli script paths from the npm-install fallback, keyed by version.
 # Lives for the process lifetime so repeated fallback invocations install only once
@@ -55,7 +56,7 @@ class ReachabilityAnalyzer:
     
     def _resolve_coana_package_spec(self, version: Optional[str] = None) -> str:
         """
-        Resolve the @coana-tech/cli package spec to run (e.g. '@coana-tech/cli@15.10.36').
+        Resolve the @coana-tech/cli package spec to run (e.g. '@coana-tech/cli@15.10.39').
 
         Args:
             version: Coana CLI version to use.
@@ -64,7 +65,7 @@ class ReachabilityAnalyzer:
                 - '<semver>': that exact version.
 
         Returns:
-            str: The package specifier to use with npx (e.g. '@coana-tech/cli@15.10.36').
+            str: The package specifier to use with npx (e.g. '@coana-tech/cli@15.10.39').
         """
         return f"@coana-tech/cli@{self._resolve_coana_version(version)}"
 
@@ -77,7 +78,7 @@ class ReachabilityAnalyzer:
         self,
         org_slug: str,
         target_directory: str,
-        tar_hash: Optional[str] = None,
+        tar_hash: str,
         output_path: str = ".socket.facts.json",
         timeout: Optional[str] = None,
         memory_limit: Optional[str] = None,
@@ -151,9 +152,7 @@ class ReachabilityAnalyzer:
         
         # Add conditional arguments. timeout/memory_limit are forwarded verbatim; coana owns
         # unit parsing/validation (e.g. '90s', '8GB'). We coerce to str only for subprocess
-        # safety — config-file values can arrive as ints via argparse set_defaults — and use
-        # `is not None` (not truthiness) so an explicit empty string still reaches coana and
-        # triggers coana's own error, rather than being silently dropped.
+        # safety — config-file values can arrive as ints via argparse set_defaults.
         if timeout is not None:
             coana_args.extend(["--analysis-timeout", str(timeout)])
 
@@ -170,9 +169,7 @@ class ReachabilityAnalyzer:
         if detailed_analysis_log_file:
             coana_args.append("--print-analysis-log-file")
 
-        # KEY POINT: Only add manifest tar hash if we have one
-        if tar_hash:
-            coana_args.extend(["--run-without-docker", "--manifests-tar-hash", tar_hash])
+        coana_args.extend(["--run-without-docker", "--manifests-tar-hash", tar_hash])
         
         if ecosystems:
             coana_args.extend(["--purl-types"] + ecosystems)
@@ -262,7 +259,7 @@ class ReachabilityAnalyzer:
             # Extract scan ID from output file
             scan_id = self._extract_scan_id(output_path)
             
-            log.info(f"Reachability analysis completed successfully")
+            log.info("Reachability analysis completed successfully")
             if scan_id:
                 log.info(f"Scan ID: {scan_id}")
             

{socketsecurity-2.7.1 → socketsecurity-2.7.2}/socketsecurity/output.py

@@ -2,18 +2,21 @@ import json
 import logging
 from pathlib import Path
 from typing import Any, Dict, Optional
-from .core.messages import Messages
-from .core.classes import Diff, Issue
-from .config import CliConfig
-from .fossa_compat import build_fossa_report_payload
-from socketsecurity.plugins.manager import PluginManager
+
+from socketdev import socketdev
+
 from socketsecurity.core.alert_selection import (
     clone_diff_with_selected_alerts,
     filter_alerts_by_reachability,
     load_components_with_alerts,
     select_diff_alerts,
 )
-from socketdev import socketdev
+from socketsecurity.plugins.manager import PluginManager
+
+from .config import CliConfig
+from .core.classes import Diff, Issue
+from .core.messages import Messages
+from .fossa_compat import build_fossa_report_payload
 
 
 class OutputHandler:

{socketsecurity-2.7.1 → socketsecurity-2.7.2}/socketsecurity/plugins/formatters/slack.py

@@ -1,8 +1,8 @@
 """Slack formatter for Socket Facts (reachability analysis) data."""
 
 import logging
-from typing import Dict, Any, List
 from collections import defaultdict
+from typing import Any, Dict, List
 
 logger = logging.getLogger(__name__)
 

{socketsecurity-2.7.1 → socketsecurity-2.7.2}/socketsecurity/plugins/jira.py

@@ -1,9 +1,12 @@
-from .base import Plugin
-import requests
 import base64
-from socketsecurity.core.classes import Diff
+
+import requests
+
 from socketsecurity.config import CliConfig
 from socketsecurity.core import log
+from socketsecurity.core.classes import Diff
+
+from .base import Plugin
 
 
 class JiraPlugin(Plugin):

{socketsecurity-2.7.1 → socketsecurity-2.7.2}/socketsecurity/plugins/manager.py

@@ -1,4 +1,4 @@
-from . import jira, webhook, slack, teams
+from . import jira, slack, teams, webhook
 
 PLUGIN_CLASSES = {
     "jira": jira.JiraPlugin,

{socketsecurity-2.7.1 → socketsecurity-2.7.2}/socketsecurity/plugins/slack.py

@@ -1,22 +1,25 @@
 import logging
 import os
+
 import requests
+
 from socketsecurity.config import CliConfig
-from .base import Plugin
-from socketsecurity.core.classes import Diff
-from socketsecurity.core.messages import Messages
 from socketsecurity.core.alert_selection import (
     clone_diff_with_selected_alerts,
     filter_alerts_by_reachability,
     select_diff_alerts,
 )
+from socketsecurity.core.classes import Diff
 from socketsecurity.core.helper.socket_facts_loader import (
-    load_socket_facts,
+    convert_to_alerts,
     get_components_with_vulnerabilities,
-    convert_to_alerts
+    load_socket_facts,
 )
+from socketsecurity.core.messages import Messages
 from socketsecurity.plugins.formatters.slack import format_socket_facts_for_slack
 
+from .base import Plugin
+
 logger = logging.getLogger(__name__)
 
 

{socketsecurity-2.7.1 → socketsecurity-2.7.2}/socketsecurity/plugins/teams.py

@@ -1,6 +1,8 @@
-from .base import Plugin
 import requests
 
+from .base import Plugin
+
+
 class TeamsPlugin(Plugin):
     def send(self, message, level):
         if not self.config.get("enabled", False):

{socketsecurity-2.7.1 → socketsecurity-2.7.2}/socketsecurity/plugins/webhook.py

@@ -1,6 +1,8 @@
-from .base import Plugin
 import requests
 
+from .base import Plugin
+
+
 class WebhookPlugin(Plugin):
     def send(self, message, level):
         if not self.config.get("enabled", False):

{socketsecurity-2.7.1 → socketsecurity-2.7.2}/socketsecurity/socketcli.py

@@ -391,14 +391,11 @@ def main_code():
 
             # Find manifest files in scan paths (excluding .socket.facts.json to avoid circular dependency)
             log.info("Finding manifest files for reachability analysis...")
-            manifest_files = []
-
-            # Always find all manifest files for the tar hash upload
-            for scan_path in scan_paths:
-                scan_manifests = core.find_files(scan_path)
-                # Filter out .socket.facts.json files from manifest upload
-                scan_manifests = [f for f in scan_manifests if not f.endswith('.socket.facts.json')]
-                manifest_files.extend(scan_manifests)
+            manifest_files = [
+                # Always find all manifest files for the tar hash upload
+                f for scan_path in scan_paths for f in core.find_files(scan_path)
+                if not f.endswith('.socket.facts.json')
+            ]
             
             if not manifest_files:
                 log.warning("No manifest files found for reachability analysis")
@@ -410,6 +407,7 @@ def main_code():
                 try:
                     # Get org_slug early (we'll need it)
                     org_slug = core.config.org_slug
+                    assert org_slug
                     
                     # Upload manifest files
                     tar_hash = sdk.uploadmanifests.upload_manifest_files(

{socketsecurity-2.7.1 → socketsecurity-2.7.2}/tests/core/test_diff_alerts.py

@@ -1,4 +1,3 @@
-import pytest
 from socketsecurity.core import Core
 from socketsecurity.core.classes import Issue
 

{socketsecurity-2.7.1 → socketsecurity-2.7.2}/tests/unit/test_cli_config.py

@@ -1,4 +1,5 @@
 import pytest
+
 from socketsecurity.config import CliConfig
 
 

{socketsecurity-2.7.1 → socketsecurity-2.7.2}/tests/unit/test_client.py

@@ -1,9 +1,12 @@
-import pytest
 from unittest.mock import Mock, patch
+
+import pytest
 import requests
+
 from socketsecurity.core.cli_client import CliClient
-from socketsecurity.core.socket_config import SocketConfig
 from socketsecurity.core.exceptions import APIFailure
+from socketsecurity.core.socket_config import SocketConfig
+
 
 @pytest.fixture
 def config():
@@ -100,14 +103,14 @@ def test_request_ssl_verification(client):
         client.request("test/path")
 
         args, kwargs = mock_request.call_args
-        assert kwargs['verify'] == True  # Default is True
+        assert kwargs['verify']  # Default is True
 
         # Test with SSL verification disabled
         client.config.allow_unverified_ssl = True
         client.request("test/path")
 
         args, kwargs = mock_request.call_args
-        assert kwargs['verify'] == False
+        assert not kwargs['verify']
 
 def test_request_with_payload(client):
     """Test request with payload data"""
@@ -154,7 +157,6 @@ def test_post_telemetry_events_sends_individually(client):
 
 def test_post_telemetry_events_continues_on_failure(client):
     """Test that a failed event does not prevent subsequent events from being sent"""
-    import json
 
     events = [
         {"event_kind": "user-action", "artifact_purl": "pkg:npm/foo@1.0.0"},

{socketsecurity-2.7.1 → socketsecurity-2.7.2}/tests/unit/test_config.py

@@ -1,9 +1,11 @@
+import tomllib
 from pathlib import Path
+
 import pytest
-from unittest.mock import patch
-import tomllib
-from socketsecurity.core.socket_config import SocketConfig
+
 from socketsecurity.config import CliConfig
+from socketsecurity.core.socket_config import SocketConfig
+
 
 def test_config_default_values():
     """Test that config initializes with correct default values"""

{socketsecurity-2.7.1 → socketsecurity-2.7.2}/tests/unit/test_disable_ignore.py

@@ -1,6 +1,5 @@
 """Tests for the --disable-ignore flag."""
 
-import pytest
 from dataclasses import dataclass
 
 from socketsecurity.config import CliConfig
@@ -8,7 +7,6 @@ from socketsecurity.core.classes import Comment, Diff, Issue
 from socketsecurity.core.messages import Messages
 from socketsecurity.core.scm_comments import Comments
 
-
 # --- CLI flag parsing tests ---
 
 class TestDisableIgnoreFlag:

{socketsecurity-2.7.1 → socketsecurity-2.7.2}/tests/unit/test_gitlab_auth.py

@@ -1,7 +1,8 @@
 """Tests for GitLab authentication patterns"""
 import os
+from unittest.mock import patch
+
 import pytest
-from unittest.mock import patch, MagicMock
 
 from socketsecurity import USER_AGENT
 from socketsecurity.core.scm.gitlab import GitlabConfig

{socketsecurity-2.7.1 → socketsecurity-2.7.2}/tests/unit/test_gitlab_auth_fallback.py

@@ -1,9 +1,10 @@
 """Integration test demonstrating GitLab authentication fallback"""
 import os
-from unittest.mock import patch, MagicMock
+from unittest.mock import MagicMock, patch
+
 import pytest
 
-from socketsecurity.core.scm.gitlab import Gitlab, GitlabConfig
+from socketsecurity.core.scm.gitlab import Gitlab
 from socketsecurity.socketcli import CliClient
 
 
@@ -37,7 +38,7 @@ class TestGitlabAuthFallback:
         gitlab = Gitlab(client=mock_client)
         
         # This should trigger the fallback mechanism
-        result = gitlab.get_comments_for_pr()
+        gitlab.get_comments_for_pr()
         
         # Verify two requests were made
         assert mock_client.request.call_count == 2
@@ -79,7 +80,7 @@ class TestGitlabAuthFallback:
         gitlab = Gitlab(client=mock_client)
         
         # This should trigger the fallback mechanism
-        result = gitlab.get_comments_for_pr()
+        gitlab.get_comments_for_pr()
         
         # Verify two requests were made
         assert mock_client.request.call_count == 2
@@ -140,7 +141,7 @@ class TestGitlabAuthFallback:
         gitlab = Gitlab(client=mock_client)
         
         # This should succeed on first try
-        result = gitlab.get_comments_for_pr()
+        gitlab.get_comments_for_pr()
         
         # Verify only one request was made
         assert mock_client.request.call_count == 1

{socketsecurity-2.7.1 → socketsecurity-2.7.2}/tests/unit/test_gitlab_commit_status.py

@@ -1,7 +1,5 @@
 """Tests for GitLab commit status integration"""
-import os
-import pytest
-from unittest.mock import patch, MagicMock, call
+from unittest.mock import MagicMock, patch
 
 from socketsecurity.core.scm.gitlab import Gitlab, GitlabConfig
 

{socketsecurity-2.7.1 → socketsecurity-2.7.2}/tests/unit/test_gitlab_format.py

@@ -1,8 +1,7 @@
 import re
 
-import pytest
-from socketsecurity.core.messages import Messages
 from socketsecurity.core.classes import Diff, Issue
+from socketsecurity.core.messages import Messages
 
 
 class TestGitLabFormat:

{socketsecurity-2.7.1 → socketsecurity-2.7.2}/tests/unit/test_include_dirs.py

@@ -6,8 +6,6 @@ normally-excluded directory (e.g. build) lets Core.find_files discover manifests
 import types
 from unittest.mock import MagicMock
 
-import pytest
-
 from socketsecurity.config import CliConfig
 from socketsecurity.core import Core
 from socketsecurity.core.socket_config import (