Skip to content

Commit 39a114d

Browse files
jfblaajfblaa
authored
add --ecosystems flag and rename --limit to --pr-limit for socket fix (#960)
1 parent eeeb240 commit 39a114d

File tree

9 files changed

+280
-126
lines changed

9 files changed

+280
-126
lines changed

‎CHANGELOG.md‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,17 @@ All notable changes to this project will be documented in this file.
44

55
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
66

7-
## [1.1.41](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.40) - 2025-12-02
7+
## [1.1.42](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.42) - 2025-12-04
8+
9+
### Added
10+
- Added `--ecosystems` flag to `socket fix`.
11+
12+
### Changed
13+
- Updated the Coana CLI to v `14.12.113`.
14+
- Rename `--limit` flag to `--pr-limit` for `socket fix`, but keep old flag as an alias. Note: `--pr-limit` has no effect in local mode, use `--id` options instead.
15+
- Process all vulnerabilities with `socket fix` when no `--id` options are provided.
16+
17+
## [1.1.41](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.41) - 2025-12-02
818

919
### Added
1020
- Added `--reach-version` flag to `socket scan create` and `socket scan reach` to override the @coana-tech/cli version used for reachability analysis.

‎package.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "socket",
3-
"version": "1.1.41",
3+
"version": "1.1.42",
44
"description": "CLI for Socket.dev",
55
"homepage": "https://github.com/SocketDev/socket-cli",
66
"license": "MIT AND OFL-1.1",
@@ -94,7 +94,7 @@
9494
"@babel/preset-typescript": "7.27.1",
9595
"@babel/runtime": "7.28.4",
9696
"@biomejs/biome": "2.2.4",
97-
"@coana-tech/cli": "14.12.110",
97+
"@coana-tech/cli": "14.12.113",
9898
"@cyclonedx/cdxgen": "11.11.0",
9999
"@dotenvx/dotenvx": "1.49.0",
100100
"@eslint/compat": "1.3.2",

‎pnpm-lock.yaml‎

Lines changed: 5 additions & 5 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎src/commands/fix/cmd-fix.integration.test.mts‎

Lines changed: 115 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -166,6 +166,7 @@ describe('socket fix', async () => {
166166
Options
167167
--autopilot Enable auto-merge for pull requests that Socket opens.
168168
See GitHub documentation (https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/configuring-pull-request-merges/managing-auto-merge-for-pull-requests-in-your-repository) for managing auto-merge for pull requests in your repository.
169+
--ecosystems Limit fix analysis to specific ecosystems. Can be provided as comma separated values or as multiple flags. Defaults to all ecosystems.
169170
--exclude Exclude workspaces matching these glob patterns. Can be provided as comma separated values or as multiple flags
170171
--fix-version Override the version of @coana-tech/cli used for fix analysis. Default: <coana-version>.
171172
--id Provide a list of vulnerability identifiers to compute fixes for:
@@ -175,12 +176,12 @@ describe('socket fix', async () => {
175176
Can be provided as comma separated values or as multiple flags
176177
--include Include workspaces matching these glob patterns. Can be provided as comma separated values or as multiple flags
177178
--json Output as JSON
178-
--limit The number of fixes to attempt at a time (default 10)
179179
--markdown Output as Markdown
180180
--minimum-release-age Set a minimum age requirement for suggested upgrade versions (e.g., 1h, 2d, 3w). A higher age requirement reduces the risk of upgrading to malicious versions. For example, setting the value to 1 week (1w) gives ecosystem maintainers one week to remove potentially malicious versions.
181181
--no-apply-fixes Compute fixes only, do not apply them. Logs what upgrades would be applied. If combined with --output-file, the output file will contain the upgrades that would be applied.
182182
--no-major-updates Do not suggest or apply fixes that require major version updates of direct or transitive dependencies
183183
--output-file Path to store upgrades as a JSON file at this path.
184+
--pr-limit Maximum number of pull requests to create in CI mode (default 10). Has no effect in local mode.
184185
--range-style Define how dependency version ranges are updated in package.json (default 'preserve').
185186
Available styles:
186187
* pin - Use the exact version (e.g. 1.2.3)
@@ -921,17 +922,17 @@ describe('socket fix', async () => {
921922
)
922923
})
923924

924-
describe('--limit flag behavior', () => {
925+
describe('--pr-limit flag behavior', () => {
925926
cmdit(
926927
[
927928
'fix',
928929
FLAG_DRY_RUN,
929-
'--limit',
930+
'--pr-limit',
930931
'0',
931932
FLAG_CONFIG,
932933
'{"apiToken":"fakeToken"}',
933934
],
934-
'should accept --limit with value 0',
935+
'should accept --pr-limit with value 0',
935936
async cmd => {
936937
const { code, stdout } = await spawnSocketCli(binCliPath, cmd)
937938
expect(stdout).toMatchInlineSnapshot(`"[DryRun]: Not saving"`)
@@ -943,12 +944,12 @@ describe('socket fix', async () => {
943944
[
944945
'fix',
945946
FLAG_DRY_RUN,
946-
'--limit',
947+
'--pr-limit',
947948
'1',
948949
FLAG_CONFIG,
949950
'{"apiToken":"fakeToken"}',
950951
],
951-
'should accept --limit with value 1',
952+
'should accept --pr-limit with value 1',
952953
async cmd => {
953954
const { code, stdout } = await spawnSocketCli(binCliPath, cmd)
954955
expect(stdout).toMatchInlineSnapshot(`"[DryRun]: Not saving"`)
@@ -960,12 +961,12 @@ describe('socket fix', async () => {
960961
[
961962
'fix',
962963
FLAG_DRY_RUN,
963-
'--limit',
964+
'--pr-limit',
964965
'100',
965966
FLAG_CONFIG,
966967
'{"apiToken":"fakeToken"}',
967968
],
968-
'should accept --limit with large value',
969+
'should accept --pr-limit with large value',
969970
async cmd => {
970971
const { code, stdout } = await spawnSocketCli(binCliPath, cmd)
971972
expect(stdout).toMatchInlineSnapshot(`"[DryRun]: Not saving"`)
@@ -975,7 +976,7 @@ describe('socket fix', async () => {
975976

976977
cmdit(
977978
['fix', FLAG_DRY_RUN, FLAG_CONFIG, '{"apiToken":"fakeToken"}'],
978-
'should use default limit of 10 when --limit is not specified',
979+
'should use default pr-limit of 10 when --pr-limit is not specified',
979980
async cmd => {
980981
const { code, stdout } = await spawnSocketCli(binCliPath, cmd)
981982
expect(stdout).toMatchInlineSnapshot(`"[DryRun]: Not saving"`)
@@ -984,8 +985,8 @@ describe('socket fix', async () => {
984985
)
985986

986987
cmdit(
987-
['fix', '--limit', '0', FLAG_CONFIG, '{"apiToken":"fake-token"}'],
988-
'should handle --limit 0 in non-dry-run mode',
988+
['fix', '--pr-limit', '0', FLAG_CONFIG, '{"apiToken":"fake-token"}'],
989+
'should handle --pr-limit 0 in non-dry-run mode',
989990
async cmd => {
990991
const { code, stderr, stdout } = await spawnSocketCli(binCliPath, cmd)
991992
const output = stdout + stderr
@@ -995,6 +996,96 @@ describe('socket fix', async () => {
995996
expect(code, 'should exit with non-zero code').not.toBe(0)
996997
},
997998
)
999+
1000+
cmdit(
1001+
[
1002+
'fix',
1003+
FLAG_DRY_RUN,
1004+
'--limit',
1005+
'5',
1006+
FLAG_CONFIG,
1007+
'{"apiToken":"fakeToken"}',
1008+
],
1009+
'should accept --limit as hidden alias for --pr-limit',
1010+
async cmd => {
1011+
const { code, stdout } = await spawnSocketCli(binCliPath, cmd)
1012+
expect(stdout).toMatchInlineSnapshot(`"[DryRun]: Not saving"`)
1013+
expect(code, 'should exit with code 0').toBe(0)
1014+
},
1015+
)
1016+
})
1017+
1018+
describe('--ecosystems flag behavior', () => {
1019+
cmdit(
1020+
[
1021+
'fix',
1022+
FLAG_DRY_RUN,
1023+
'--ecosystems',
1024+
'npm',
1025+
FLAG_CONFIG,
1026+
'{"apiToken":"fakeToken"}',
1027+
],
1028+
'should accept --ecosystems with single ecosystem',
1029+
async cmd => {
1030+
const { code, stdout } = await spawnSocketCli(binCliPath, cmd)
1031+
expect(stdout).toMatchInlineSnapshot(`"[DryRun]: Not saving"`)
1032+
expect(code, 'should exit with code 0').toBe(0)
1033+
},
1034+
)
1035+
1036+
cmdit(
1037+
[
1038+
'fix',
1039+
FLAG_DRY_RUN,
1040+
'--ecosystems',
1041+
'npm,pypi',
1042+
FLAG_CONFIG,
1043+
'{"apiToken":"fakeToken"}',
1044+
],
1045+
'should accept --ecosystems with comma-separated values',
1046+
async cmd => {
1047+
const { code, stdout } = await spawnSocketCli(binCliPath, cmd)
1048+
expect(stdout).toMatchInlineSnapshot(`"[DryRun]: Not saving"`)
1049+
expect(code, 'should exit with code 0').toBe(0)
1050+
},
1051+
)
1052+
1053+
cmdit(
1054+
[
1055+
'fix',
1056+
FLAG_DRY_RUN,
1057+
'--ecosystems',
1058+
'npm',
1059+
'--ecosystems',
1060+
'pypi',
1061+
FLAG_CONFIG,
1062+
'{"apiToken":"fakeToken"}',
1063+
],
1064+
'should accept multiple --ecosystems flags',
1065+
async cmd => {
1066+
const { code, stdout } = await spawnSocketCli(binCliPath, cmd)
1067+
expect(stdout).toMatchInlineSnapshot(`"[DryRun]: Not saving"`)
1068+
expect(code, 'should exit with code 0').toBe(0)
1069+
},
1070+
)
1071+
1072+
cmdit(
1073+
[
1074+
'fix',
1075+
FLAG_DRY_RUN,
1076+
'--ecosystems',
1077+
'invalid-ecosystem',
1078+
FLAG_CONFIG,
1079+
'{"apiToken":"fakeToken"}',
1080+
],
1081+
'should fail with invalid ecosystem value',
1082+
async cmd => {
1083+
const { code, stderr, stdout } = await spawnSocketCli(binCliPath, cmd)
1084+
const output = stdout + stderr
1085+
expect(output).toContain('Invalid ecosystem')
1086+
expect(code, 'should exit with non-zero code').not.toBe(0)
1087+
},
1088+
)
9981089
})
9991090

10001091
describe('--id flag behavior', () => {
@@ -1086,19 +1177,19 @@ describe('socket fix', async () => {
10861177
)
10871178
})
10881179

1089-
describe('--limit and --id combination', () => {
1180+
describe('--pr-limit and --id combination', () => {
10901181
cmdit(
10911182
[
10921183
'fix',
10931184
FLAG_DRY_RUN,
1094-
'--limit',
1185+
'--pr-limit',
10951186
'1',
10961187
FLAG_ID,
10971188
'GHSA-1234-5678-9abc',
10981189
FLAG_CONFIG,
10991190
'{"apiToken":"fakeToken"}',
11001191
],
1101-
'should accept both --limit and --id flags together',
1192+
'should accept both --pr-limit and --id flags together',
11021193
async cmd => {
11031194
const { code, stdout } = await spawnSocketCli(binCliPath, cmd)
11041195
expect(stdout).toMatchInlineSnapshot(`"[DryRun]: Not saving"`)
@@ -1110,14 +1201,14 @@ describe('socket fix', async () => {
11101201
[
11111202
'fix',
11121203
FLAG_DRY_RUN,
1113-
'--limit',
1204+
'--pr-limit',
11141205
'5',
11151206
FLAG_ID,
11161207
'GHSA-1234-5678-9abc,CVE-2021-12345,pkg:npm/lodash@4.17.20',
11171208
FLAG_CONFIG,
11181209
'{"apiToken":"fakeToken"}',
11191210
],
1120-
'should accept --limit with multiple vulnerability IDs',
1211+
'should accept --pr-limit with multiple vulnerability IDs',
11211212
async cmd => {
11221213
const { code, stdout } = await spawnSocketCli(binCliPath, cmd)
11231214
expect(stdout).toMatchInlineSnapshot(`"[DryRun]: Not saving"`)
@@ -1129,15 +1220,15 @@ describe('socket fix', async () => {
11291220
[
11301221
'fix',
11311222
FLAG_DRY_RUN,
1132-
'--limit',
1223+
'--pr-limit',
11331224
'1',
11341225
FLAG_ID,
11351226
'GHSA-1234-5678-9abc',
11361227
'--autopilot',
11371228
FLAG_CONFIG,
11381229
'{"apiToken":"fakeToken"}',
11391230
],
1140-
'should accept --limit, --id, and --autopilot together',
1231+
'should accept --pr-limit, --id, and --autopilot together',
11411232
async cmd => {
11421233
const { code, stdout } = await spawnSocketCli(binCliPath, cmd)
11431234
expect(stdout).toMatchInlineSnapshot(`"[DryRun]: Not saving"`)
@@ -1148,14 +1239,14 @@ describe('socket fix', async () => {
11481239
cmdit(
11491240
[
11501241
'fix',
1151-
'--limit',
1242+
'--pr-limit',
11521243
'2',
11531244
FLAG_ID,
11541245
'GHSA-1234-5678-9abc,GHSA-abcd-efgh-ijkl',
11551246
FLAG_CONFIG,
11561247
'{"apiToken":"fake-token"}',
11571248
],
1158-
'should handle --limit and --id in non-dry-run mode',
1249+
'should handle --pr-limit and --id in non-dry-run mode',
11591250
async cmd => {
11601251
const { code, stderr, stdout } = await spawnSocketCli(binCliPath, cmd)
11611252
const output = stdout + stderr
@@ -1170,15 +1261,15 @@ describe('socket fix', async () => {
11701261
[
11711262
'fix',
11721263
FLAG_DRY_RUN,
1173-
'--limit',
1264+
'--pr-limit',
11741265
'3',
11751266
FLAG_ID,
11761267
'GHSA-1234-5678-9abc',
11771268
FLAG_JSON,
11781269
FLAG_CONFIG,
11791270
'{"apiToken":"fakeToken"}',
11801271
],
1181-
'should accept --limit, --id, and --json output format together',
1272+
'should accept --pr-limit, --id, and --json output format together',
11821273
async cmd => {
11831274
const { code, stdout } = await spawnSocketCli(binCliPath, cmd)
11841275
expect(stdout).toMatchInlineSnapshot(`"[DryRun]: Not saving"`)
@@ -1190,15 +1281,15 @@ describe('socket fix', async () => {
11901281
[
11911282
'fix',
11921283
FLAG_DRY_RUN,
1193-
'--limit',
1284+
'--pr-limit',
11941285
'10',
11951286
FLAG_ID,
11961287
'CVE-2021-12345',
11971288
FLAG_MARKDOWN,
11981289
FLAG_CONFIG,
11991290
'{"apiToken":"fakeToken"}',
12001291
],
1201-
'should accept --limit, --id, and --markdown output format together',
1292+
'should accept --pr-limit, --id, and --markdown output format together',
12021293
async cmd => {
12031294
const { code, stdout } = await spawnSocketCli(binCliPath, cmd)
12041295
expect(stdout).toMatchInlineSnapshot(`"[DryRun]: Not saving"`)

0 commit comments

Comments
 (0)