From a5ccebc30a58bd7470de66ec00aca2a9b1efc170 Mon Sep 17 00:00:00 2001 From: Jeppe Fredsgaard Blaabjerg Date: Wed, 29 Jul 2026 10:57:31 +0200 Subject: [PATCH 1/2] fix(scan): scope --reach-use-only-pregenerated-sboms to analysis input only The flag was also filtering which manifest files got uploaded as part of the scan, restricting it to pre-generated CDX/SPDX/facts files. That wasn't the intent: it should only control what reachability analysis uses as input (already forwarded to Coana as --use-only-pregenerated-sboms), not what gets included in the scan itself. --- CHANGELOG.md | 5 ++ package.json | 2 +- src/commands/scan/handle-create-new-scan.mts | 53 +++----------------- src/commands/scan/reachability-flags.mts | 2 +- 4 files changed, 14 insertions(+), 48 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 72d0bcec62..90c8f0eec6 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,6 +4,11 @@ All notable changes to this project will be documented in this file. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). +## [1.1.147](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.147) - 2026-07-29 + +### Fixed +- `--reach-use-only-pregenerated-sboms` now only controls what reachability analysis uses as input. Previously it also narrowed the manifest files uploaded as part of the scan, which was not the intent of the option. + ## [1.1.146](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.146) - 2026-07-24 ### Changed diff --git a/package.json b/package.json index daf45d6acb..f1d5d9f1ff 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "socket", - "version": "1.1.146", + "version": "1.1.147", "description": "CLI for Socket.dev", "homepage": "https://github.com/SocketDev/socket-cli", "license": "MIT", diff --git a/src/commands/scan/handle-create-new-scan.mts b/src/commands/scan/handle-create-new-scan.mts index 9e18e879cc..bf74508435 100644 --- a/src/commands/scan/handle-create-new-scan.mts +++ b/src/commands/scan/handle-create-new-scan.mts @@ -1,8 +1,6 @@ import { unlink } from 'node:fs/promises' import path from 'node:path' -import micromatch from 'micromatch' - import { debugDir, debugFn } from '@socketsecurity/registry/lib/debug' import { logger } from '@socketsecurity/registry/lib/logger' import { pluralize } from '@socketsecurity/registry/lib/words' @@ -29,40 +27,6 @@ import type { REPORT_LEVEL } from './types.mts' import type { OutputKind } from '../../types.mts' import type { ResolvedPathsSidecar } from '../manifest/scripts/sidecar.mts' import type { Remap } from '@socketsecurity/registry/lib/objects' -import type { SocketSdkSuccessResult } from '@socketsecurity/sdk' - -// Supported-files response keys whose files count as pre-generated SBOMs: -// CycloneDX, SPDX, and Socket facts (`.socket.facts.json`, under `socket`). -// Kept in sync with Coana's `--use-only-pregenerated-sboms` selection -// (extractPregeneratedSbomPatterns), which matches the same three keys. -const PREGENERATED_SBOM_KEYS = ['cdx', 'socket', 'spdx'] - -function getPregeneratedSbomPatterns( - supportedFiles: SocketSdkSuccessResult<'getReportSupportedFiles'>['data'], -): string[] { - const patterns: string[] = [] - for (const key of PREGENERATED_SBOM_KEYS) { - const supported = supportedFiles[key] - if (supported) { - for (const entry of Object.values(supported)) { - patterns.push(`**/${entry.pattern}`) - } - } - } - return patterns -} - -function filterToPregeneratedSboms( - filepaths: string[], - supportedFiles: SocketSdkSuccessResult<'getReportSupportedFiles'>['data'], -): string[] { - const patterns = getPregeneratedSbomPatterns(supportedFiles) - // `dot: true` lets `*`-prefixed patterns match leading-dot filenames such as - // `.socket.facts.json` (advertised as `*.socket.facts.json`). - return filepaths.filter(filepath => - micromatch.some(filepath, patterns, { dot: true, nocase: true }), - ) -} export type HandleCreateNewScanConfig = { autoManifest: boolean @@ -269,16 +233,13 @@ export async function handleCreateNewScan({ reachabilityReport = reachResult.data?.reachabilityReport - // When using only pre-generated SBOMs, build the scan from those inputs — - // CycloneDX, SPDX, and Socket facts (`.socket.facts.json`) — matching - // Coana's `--use-only-pregenerated-sboms` selection. Otherwise drop any - // stray `.socket.facts.json`; coana's fresh reachability report (appended - // below) is the authoritative facts file for the scan. - const pathsForScan = reach.reachUseOnlyPregeneratedSboms - ? filterToPregeneratedSboms(packagePaths, supportedFiles) - : packagePaths.filter( - p => path.basename(p) !== constants.DOT_SOCKET_DOT_FACTS_JSON, - ) + // Drop any stray `.socket.facts.json`; coana's fresh reachability report + // (appended below) is the authoritative facts file for the scan. + // `reachUseOnlyPregeneratedSboms` only controls what coana analyzes + // (forwarded in performReachabilityAnalysis), not what gets uploaded here. + const pathsForScan = packagePaths.filter( + p => path.basename(p) !== constants.DOT_SOCKET_DOT_FACTS_JSON, + ) // Append coana's reachability report, but not twice: a pre-generated facts // input can resolve to the same path coana wrote its report to. diff --git a/src/commands/scan/reachability-flags.mts b/src/commands/scan/reachability-flags.mts index 9f4dc6e891..3b4f2a31b0 100644 --- a/src/commands/scan/reachability-flags.mts +++ b/src/commands/scan/reachability-flags.mts @@ -120,7 +120,7 @@ export const reachabilityFlags: MeowFlags = { type: 'boolean', default: false, description: - 'When using this option, the scan is created based only on pre-generated CDX and SPDX files in your project.', + 'When using this option, reachability analysis is performed using only pre-generated CDX, SPDX, and Socket facts files in your project instead of resolving dependencies itself.', }, } From 179f48d33af9b8517b4708b41abb35ffcf42eb2e Mon Sep 17 00:00:00 2001 From: Jeppe Fredsgaard Blaabjerg Date: Wed, 29 Jul 2026 11:11:12 +0200 Subject: [PATCH 2/2] update changelog --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 90c8f0eec6..b3d6db73b1 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,7 +7,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). ## [1.1.147](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.147) - 2026-07-29 ### Fixed -- `--reach-use-only-pregenerated-sboms` now only controls what reachability analysis uses as input. Previously it also narrowed the manifest files uploaded as part of the scan, which was not the intent of the option. +- `--reach-use-only-pregenerated-sboms` now only controls what reachability analysis uses as input. Previously it also narrowed the manifest files uploaded as part of the scan. ## [1.1.146](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.146) - 2026-07-24