Skip to content

Commit c55d324

Browse files
committed
Merge branch 'v1.x' into jfblaa/manifest-maven
2 parents dec47bf + 55c80a6 commit c55d324

16 files changed

Lines changed: 84 additions & 5 deletions

CHANGELOG.md

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,14 +4,21 @@ All notable changes to this project will be documented in this file.
44

55
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
66

7-
## [1.1.124](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.124) - 2026-06-19
7+
## [1.1.124](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.125) - 2026-06-19
88

99
### Added
1010
- New `socket manifest maven` command generates a Socket facts file (`.socket.facts.json`) directly from a Maven `pom.xml` project. Like the Gradle and sbt generators, it auto-detects your project, plugs into `socket manifest auto` and the `socket manifest setup` configurator, and accepts `--maven-opts` to pass options through to Maven (e.g. `--maven-opts="-P release -s settings.xml"`), plus `--bin` to point at a wrapper such as `./mvnw`.
1111

1212
### Changed
1313
- Updated the Coana CLI to v `15.5.5`.
1414

15+
## [1.1.124](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.124) - 2026-06-19
16+
17+
- `socket scan create --reach` accepts a new `--reach-retain-facts-file` flag. By default the CLI deletes the `.socket.facts.json` reachability report from the scan directory after a successful scan; pass this flag to keep it (e.g. for inspection or debugging). **Important:** you must delete the retained `.socket.facts.json` before running a fresh tier 1 reachability scan — a stale file left in place is picked up as a pre-generated input and silently overrides fresh analysis, so the new scan results will not be reliable.
18+
19+
### Changed
20+
- Updated the Coana CLI to v `15.5.4`.
21+
1522
## [1.1.123](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.123) - 2026-06-18
1623

1724
### Added

bin/cli.js

Lines changed: 33 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33

44
void (async () => {
55
const Module = require('node:module')
6+
const os = require('node:os')
67
const path = require('node:path')
78
const rootPath = path.join(__dirname, '..')
89
Module.enableCompileCache?.(path.join(rootPath, '.cache'))
@@ -38,10 +39,41 @@ void (async () => {
3839
},
3940
)
4041

42+
// The child shares our process group and handles the signal itself; wait briefly for it
43+
// to exit (so its final output isn't printed after the prompt returns) and mirror its
44+
// exit below. SIGKILL and leave if it outlasts the grace, or on a second signal.
45+
const SHUTDOWN_GRACE_MS = 3_000
46+
const hardAbort = signalName => {
47+
const child = spawnPromise.process
48+
if (child.exitCode === null && child.signalCode === null) {
49+
child.kill('SIGKILL')
50+
}
51+
// eslint-disable-next-line n/no-process-exit
52+
process.exit(signalName === 'SIGTERM' ? 143 : 130)
53+
}
54+
let sawSignal = false
55+
const onSignal = signalName => {
56+
if (sawSignal) {
57+
hardAbort(signalName)
58+
return
59+
}
60+
sawSignal = true
61+
setTimeout(() => hardAbort(signalName), SHUTDOWN_GRACE_MS).unref?.()
62+
}
63+
const onSigint = () => onSignal('SIGINT')
64+
const onSigterm = () => onSignal('SIGTERM')
65+
process.on('SIGINT', onSigint)
66+
process.on('SIGTERM', onSigterm)
67+
4168
// See https://nodejs.org/api/child_process.html#event-exit.
4269
spawnPromise.process.on('exit', (code, signalName) => {
4370
if (signalName) {
44-
process.kill(process.pid, signalName)
71+
// Mirror a signal death as the conventional 128 + signum exit code. Exit explicitly
72+
// rather than re-raising the signal: with our handlers installed the re-raise would
73+
// race `await spawnPromise` resolving and could leave the default exitCode of 1.
74+
const signum = os.constants.signals[signalName] ?? 0
75+
// eslint-disable-next-line n/no-process-exit
76+
process.exit(128 + signum)
4577
} else if (typeof code === 'number') {
4678
// eslint-disable-next-line n/no-process-exit
4779
process.exit(code)

package.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "socket",
3-
"version": "1.1.124",
3+
"version": "1.1.125",
44
"description": "CLI for Socket.dev",
55
"homepage": "https://github.com/SocketDev/socket-cli",
66
"license": "MIT",

src/commands/ci/handle-ci.mts

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -67,6 +67,7 @@ export async function handleCi(autoManifest: boolean): Promise<void> {
6767
reachEnableAnalysisSplitting: false,
6868
reachExcludePaths: [],
6969
reachLazyMode: false,
70+
reachRetainFactsFile: false,
7071
reachSkipCache: false,
7172
reachUseOnlyPregeneratedSboms: false,
7273
reachVersion: undefined,

src/commands/scan/cmd-scan-create.mts

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -264,6 +264,7 @@ async function run(
264264
reachDisableExternalToolChecks,
265265
reachEnableAnalysisSplitting,
266266
reachLazyMode,
267+
reachRetainFactsFile,
267268
reachSkipCache,
268269
reachUseOnlyPregeneratedSboms,
269270
reachVersion,
@@ -302,6 +303,7 @@ async function run(
302303
reachDisableExternalToolChecks: boolean
303304
reachEnableAnalysisSplitting: boolean
304305
reachLazyMode: boolean
306+
reachRetainFactsFile: boolean
305307
reachSkipCache: boolean
306308
reachUseOnlyPregeneratedSboms: boolean
307309
reachVersion: string | undefined
@@ -659,6 +661,7 @@ async function run(
659661
reachEnableAnalysisSplitting: Boolean(reachEnableAnalysisSplitting),
660662
reachExcludePaths,
661663
reachLazyMode: Boolean(reachLazyMode),
664+
reachRetainFactsFile: Boolean(reachRetainFactsFile),
662665
reachSkipCache: Boolean(reachSkipCache),
663666
reachUseOnlyPregeneratedSboms: Boolean(reachUseOnlyPregeneratedSboms),
664667
reachVersion,

src/commands/scan/cmd-scan-create.test.mts

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -69,6 +69,7 @@ describe('socket scan create', async () => {
6969
--reach-disable-external-tool-checks Disable external tool checks during reachability analysis.
7070
--reach-ecosystems List of ecosystems to conduct reachability analysis on, as either a comma separated value or as multiple flags. Defaults to all ecosystems.
7171
--reach-enable-analysis-splitting Allow the reachability analysis to partition CVEs into buckets that are processed in separate analysis runs. May improve accuracy, but not recommended by default.
72+
--reach-retain-facts-file Keep the \`.socket.facts.json\` reachability report that the analysis writes to the scan directory instead of deleting it after a successful scan. IMPORTANT: you must delete this file before running a fresh tier 1 reachability scan. A stale \`.socket.facts.json\` left in place is picked up as a pre-generated input and silently overrides fresh analysis, so the new scan results will not be reliable.
7273
--reach-skip-cache Skip caching-based optimizations. By default, the reachability analysis will use cached configurations from previous runs to speed up the analysis.
7374
--reach-use-only-pregenerated-sboms When using this option, the scan is created based only on pre-generated CDX and SPDX files in your project.
7475
--reach-version Override the version of @coana-tech/cli used for reachability analysis. Default: <coana-version>.

src/commands/scan/cmd-scan-reach.mts

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -137,6 +137,7 @@ async function run(
137137
reachDisableExternalToolChecks,
138138
reachEnableAnalysisSplitting,
139139
reachLazyMode,
140+
reachRetainFactsFile,
140141
reachSkipCache,
141142
reachUseOnlyPregeneratedSboms,
142143
reachVersion,
@@ -161,6 +162,7 @@ async function run(
161162
reachDisableExternalToolChecks: boolean
162163
reachEnableAnalysisSplitting: boolean
163164
reachLazyMode: boolean
165+
reachRetainFactsFile: boolean
164166
reachSkipCache: boolean
165167
reachUseOnlyPregeneratedSboms: boolean
166168
reachVersion: string | undefined
@@ -292,6 +294,7 @@ async function run(
292294
reachEnableAnalysisSplitting: Boolean(reachEnableAnalysisSplitting),
293295
reachExcludePaths,
294296
reachLazyMode: Boolean(reachLazyMode),
297+
reachRetainFactsFile: Boolean(reachRetainFactsFile),
295298
reachSkipCache: Boolean(reachSkipCache),
296299
reachUseOnlyPregeneratedSboms: Boolean(reachUseOnlyPregeneratedSboms),
297300
reachVersion,

src/commands/scan/cmd-scan-reach.test.mts

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,7 @@ describe('socket scan reach', async () => {
5151
--reach-disable-external-tool-checks Disable external tool checks during reachability analysis.
5252
--reach-ecosystems List of ecosystems to conduct reachability analysis on, as either a comma separated value or as multiple flags. Defaults to all ecosystems.
5353
--reach-enable-analysis-splitting Allow the reachability analysis to partition CVEs into buckets that are processed in separate analysis runs. May improve accuracy, but not recommended by default.
54+
--reach-retain-facts-file Keep the \`.socket.facts.json\` reachability report that the analysis writes to the scan directory instead of deleting it after a successful scan. IMPORTANT: you must delete this file before running a fresh tier 1 reachability scan. A stale \`.socket.facts.json\` left in place is picked up as a pre-generated input and silently overrides fresh analysis, so the new scan results will not be reliable.
5455
--reach-skip-cache Skip caching-based optimizations. By default, the reachability analysis will use cached configurations from previous runs to speed up the analysis.
5556
--reach-use-only-pregenerated-sboms When using this option, the scan is created based only on pre-generated CDX and SPDX files in your project.
5657
--reach-version Override the version of @coana-tech/cli used for reachability analysis. Default: <coana-version>.

src/commands/scan/create-scan-from-github.mts

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -266,6 +266,7 @@ async function scanOneRepo(
266266
reachEnableAnalysisSplitting: false,
267267
reachExcludePaths: [],
268268
reachLazyMode: false,
269+
reachRetainFactsFile: false,
269270
reachSkipCache: false,
270271
reachUseOnlyPregeneratedSboms: false,
271272
reachVersion: undefined,

src/commands/scan/exclude-paths.test.mts

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@ function makeReachOptions(
3030
reachEnableAnalysisSplitting: false,
3131
reachExcludePaths: [],
3232
reachLazyMode: false,
33+
reachRetainFactsFile: false,
3334
reachSkipCache: false,
3435
reachUseOnlyPregeneratedSboms: false,
3536
reachVersion: undefined,

0 commit comments

Comments
 (0)