Unbeta license features by ammkrn · Pull Request #1085 · SocketDev/socket-cli

ammkrn · 2026-02-21T22:51:03Z

License related alerts are no longer experimental

Note

Medium Risk
Touches core build/packaging, bin entrypoints, and CI publishing flows, so regressions could break installs or runtime startup despite limited direct feature logic changes.

Overview
This PR overhauls packaging/build and developer tooling: introduces shared Rollup configs (.config/rollup.*) + Babel config to bundle the TypeScript .mts sources, inline build-time process.env constants, and post-process bundles to normalize node: builtins, dedupe requires, and vendor/copy selected external packages into external/.

It repackages the npm artifact by renaming to socket (v1.1.57), adding multiple bin entrypoints (socket, socket-npm, socket-npx, socket-pnpm, socket-yarn) and new scripts for building dist/types/SEA, linting (ESLint flat config + oxlint + Biome), tests/e2e, and pre-commit hooks; legacy JS CLI/lib/ command implementations and old CI configs are removed.

CI/CD is updated with new GitHub workflows (lint/types/tests/e2e, provenance publish, auto PRs, Claude workflows), and dependency behavior is stabilized via pnpm overrides and a large set of patch files (notably for blessed/blessed-contrib, meow, tiny-updater, Rollup plugins) to improve CJS/ESM compatibility and runtime behavior in the bundled distribution.

^{Written by Cursor Bugbot for commit 600799b. This will update automatically on new commits. Configure here.}

- Remove unsupported --no-update-notifier flag from pnpm wrapper - Add test for pnpm dlx usage scenario - Update CLAUDE.md to forbid dynamic imports - Revert setup action to use pnpm dlx approach

#967) implicitly use `--all` if no `--id` but warn that this is deprecated in local mode

* use proper tmp directory in fix e2e tests * rename fixture to simple-npm * create e2e tests for the socket scan reach and socket scan reach --reach-exclude-paths commands * e2e test --reach-ecosystems * add requirements.txt fixture * assert correct recahability structure in one of the e2e tests * fix lint issues * add reachability e2e tests to test the --cwd option and target argument * upgrade @coana-tech/cli to v14.12.117 * fix typo * ignore all fixtures * upgrade coana to version 14.12.118 * increase e2e test timeout

* add flag --reach-use-only-pregenerated-sboms * prepare for 1.1.45 * update @coana-tech/cli to 14.12.122

* update coana to v14.12.126 * fix tags

* add `--debug` option to `socket fix` bump coana version for better logging when `pnpm install` fails during `socket fix` * updated descrition for `socket fix` option `--debug`

…ing npm fixes. (#980)

…#982)

) * feat(telemetry): adding initial telemetry functionality to the cli * feat(cr): cr --------- Co-authored-by: John-David Dalton <jdalton@users.noreply.github.com>

…pper (#985) Co-authored-by: John-David Dalton <jdalton@users.noreply.github.com>

…king alerts were found. (#986) This is the expected behaviour based on our docs: https://docs.socket.dev/docs/socket-ci#non-zero-exit-code Co-authored-by: Graydon Hope <graydonhope@mac.lan>

* Use @socketsecurity/socket-patch for patch command - Replace inline patch implementation with @socketsecurity/socket-patch@1.0.0 - Use runPatch() from socket-patch/run for programmatic invocation - Remove deleted handle-patch.mts, manifest-schema.mts, output-patch-result.mts - Add SOCKET_PATCH_PROXY_URL environment variable support - Forward socket-cli environment to socket-patch options * update lockfile --------- Co-authored-by: John-David Dalton <jdalton@users.noreply.github.com>

Co-authored-by: John-David Dalton <jdalton@users.noreply.github.com>

* feat(config): use EditableJson for non-destructive config saving Use EditableJson for preserving existing properties and key order when updating config values. This prevents overwriting unrelated config properties during partial updates. - Add standalone EditableJson implementation in src/utils/editable-json.mts - Update config.mts to use EditableJson for config file writes - Fix socketAppDataPath usage to include config.json filename - Add resetConfigForTesting() helper for test isolation - Update tests to use Node.js built-in fs functions * fix: address PR review feedback - Preserve JSON formatting by using editor's indent/newline symbols - Handle deleted config keys explicitly (editor.update only merges) - Capture config snapshot at write time, not schedule time - Fix load method create parameter to actually create empty state * fix: TypeScript compilation errors - Fix symbol index type errors with type assertions - Remove unused getDefaultFormatting function - Add null check for match[1] in detectIndent - Remove unused contentWithoutImport variable * fix: ESLint errors in config and editable-json - Fix import sort order in config.test.mts (promises as fs sorted by alias name) - Add no-await-in-loop eslint-disable comments for retry loops in editable-json.mts - Remove unused eslint-disable directive * chore: remove unused imports from config.test.mts

* add --reach-lazy-mode. update coana to v138 * add missing option validation --------- Co-authored-by: John-David Dalton <jdalton@users.noreply.github.com>

* add --silence flag to suppress non-output stdout/stderr when running socket fix * fix silence bug. debug output to e2e reachability tests * upgrade coana. fix formatting

…1014) * set scanType to socket_tier1 when creating reachability full scans * fix changelog link

* fix(glob): add dot:true to match dotfiles and dot directories Ensures fastGlob matches files and directories starting with a dot in gitIgnoreStream and globWorkspace functions. * fix(glob): add dot:true to micromatch for dot directory matching Adds { dot: true } option to micromatch.some() calls in filterBySupportedScanFiles() and isReportSupportedFile() to ensure patterns like **/poetry.lock match files in dot directories such as .mcp-servers/neo4j/poetry.lock. * style: fix linting issues

…1006) Removes the semver-based Node version check that was filtering manifest entries, allowing all Socket registry overrides to be applied regardless of the Node version specified in package engines.

* fix: prevent heap overflow in large monorepo scans Add streaming-based filtering to globWithGitIgnore to prevent heap overflow when scanning large monorepos with 100k+ files. Instead of accumulating all file paths and filtering afterwards, files are now filtered during streaming which dramatically reduces memory usage. Changes: - Add `filter` option to globWithGitIgnore for early filtering during streaming - Add createSupportedFilesFilter helper to create filter from supported files - Update getPackageFilesForScan to use streaming filter - Add comprehensive tests for the new filter functionality Fixes SMO-522 * Update src/utils/glob.mts Signed-off-by: John-David Dalton <jdalton@users.noreply.github.com> --------- Signed-off-by: John-David Dalton <jdalton@users.noreply.github.com> Co-authored-by: John-David Dalton <jdalton@users.noreply.github.com>

Update socket-patch dependency from v1.0.0 to v1.2.0, which includes: - Progress spinner for scan command - Improved test coverage This update addresses reviewer feedback in depscan PR #16387 regarding the socket-patch version mismatch. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

License related alerts are no longer experimental

cursor

Cursor Bugbot has reviewed your changes and found 3 potential issues.

^{Bugbot Autofix is ON. A Cloud Agent has been kicked off to fix the reported issues.}

cursor · 2026-02-21T22:58:28Z

.gitattributes

@@ -0,0 +1 @@
+* text=auto eol=lfs


Typo eol=lfs instead of eol=lf in gitattributes

Medium Severity

The .gitattributes file sets eol=lfs, but lfs is not a valid value for the eol attribute. Git only recognizes eol=lf and eol=crlf. This likely means line-ending normalization won't work as intended, potentially causing inconsistent line endings across platforms.

cursor · 2026-02-21T22:58:28Z

.config/rollup.dist.config.mjs

+  }
+  const newBin = {
+    ...(tmpBin[SOCKET_CLI_BIN_NAME]
+      ? { [SOCKET_CLI_BIN_NAME]: tmpBin.socket }


Hardcoded tmpBin.socket instead of using constant

Low Severity

In resetBin, the value for SOCKET_CLI_BIN_NAME uses tmpBin.socket (hardcoded property access) while every other entry consistently uses tmpBin[SOCKET_CLI_*_BIN_NAME] (computed property access via constants). This works only because SOCKET_CLI_BIN_NAME happens to equal 'socket', but breaks the pattern and would silently produce undefined if the constant ever changed.

cursor · 2026-02-21T22:58:28Z

.config/rollup.dist.config.mjs

+      `${blessedContribNmPath}/${LICENSE_MD}`,
+      `${blessedContribPath}/${LICENSE_MD}`,
+      { dereference: true },
+    ),


Misplaced await inside Promise.all array literal

Low Severity

The await fs.cp(...) inside the Promise.all array is eagerly awaited before Promise.all is invoked. This means fs.cp runs sequentially rather than concurrently with the copyPackage promises. More importantly, if fs.cp throws, the already-started copyPackage promises become orphaned since Promise.all is never reached, potentially causing unhandled promise rejections. Removing the inner await and passing the bare promise to Promise.all fixes both issues.

cursor · 2026-02-21T22:59:40Z

Bugbot Autofix prepared fixes for 1 of the 1 bugs found in the latest run.

✅ Fixed: Typo eol=lfs instead of eol=lf in gitattributes
- Changed eol=lfs to eol=lf in .gitattributes as lfs is not a valid eol value.

Or push these changes by commenting:

@cursor push 34dfc0c4cc

Preview (34dfc0c4cc)

diff --git a/.gitattributes b/.gitattributes
--- a/.gitattributes
+++ b/.gitattributes
@@ -1 +1 @@
-* text=auto eol=lfs
+* text=auto eol=lf

jdalton added 30 commits September 16, 2025 10:47

Add dlx helper

7eecbf5

Remove fallbacks for invalid pnpm-workspace.yml name

b9dcf3f

Flatten spawnCoana into spanCoanaDlx

76491b4

Add more constants

808f26a

Lint nits

149e7d0

Add more constants

51c6405

Update changelog

c2dbbe2

Bump to v1.1.14

55a7376

Update tests

cd02505

Fix cmdFlagsToString bug detecting next arg

ff3ff6c

Don't use dynamic import in rollup config

f75093f

Add better usage example to socket fix

3c862f9

Use more joinAnd

136fd80

Minor logic flips

9e60015

Add better ux around missing env vars

05cdbca

Lint nits

f6ef306

Add trash note to run-cdxgen

f752a22

Pass runAgentInstall to runAgentInstall

622c82d

Bump to v1.1.15

45ad19c

Add fix command env tests

ae08848

Update claude.md

7c3ec15

Update pnpm action with socket pnpm use

9b422b3

Use pnpm dlx for pnpm workflow

3f68455

Update workflow shas

8793f40

Fix pnpm wrapper for dlx usage and add test

0c85621

- Remove unsupported --no-update-notifier flag from pnpm wrapper - Add test for pnpm dlx usage scenario - Update CLAUDE.md to forbid dynamic imports - Revert setup action to use pnpm dlx approach

Lint nits

9cf8b35

Update pnpm9 fixture

d52ac2d

Update snapshots

b9e508f

Update tests

80901f0

Make each patched file an override to use the patched version

81d97cf

jdalton and others added 27 commits December 4, 2025 20:34

fix test failures by ensuring unauthenticated test environment

361afe8

add --all flag for socket fix and make it incompatible with --id (

da83fa1

#967) implicitly use `--all` if no `--id` but warn that this is deprecated in local mode

Add flag --reach-use-only-pregenerated-sboms (#969)

b29c1f3

* add flag --reach-use-only-pregenerated-sboms * prepare for 1.1.45 * update @coana-tech/cli to 14.12.122

update coana to v14.12.126 (#970)

651f706

* update coana to v14.12.126 * fix tags

add --debug option to socket fix (#979)

67ef556

* add `--debug` option to `socket fix` bump coana version for better logging when `pnpm install` fails during `socket fix` * updated descrition for `socket fix` option `--debug`

update coana to 14.12.130: Avoid full dependency install when finaliz…

627611e

…ing npm fixes. (#980)

fix error being rethrown when npm finalize fix failed in socket fix (…

486f1af

…#982)

feat(telemetry): adding initial telemetry functionality to the cli (#956

b40531e

) * feat(telemetry): adding initial telemetry functionality to the cli * feat(cr): cr --------- Co-authored-by: John-David Dalton <jdalton@users.noreply.github.com>

Bump to v1.1.49 (#984)

95c7d8a

fix(socket-npm): fixing a bug on how the cli bin is passed to the wra…

abeeb18

…pper (#985) Co-authored-by: John-David Dalton <jdalton@users.noreply.github.com>

Fixes the issue where socket ci would exit with code 0 even when bloc…

95aa4fc

…king alerts were found. (#986) This is the expected behaviour based on our docs: https://docs.socket.dev/docs/socket-ci#non-zero-exit-code Co-authored-by: Graydon Hope <graydonhope@mac.lan>

Bump to v1.1.50 (#988)

ac9fc49

fix(package-env): improve Windows npm version detection (#983)

1de47a9

Co-authored-by: John-David Dalton <jdalton@users.noreply.github.com>

add --reach-lazy-mode. update coana to v138 (#998)

4761498

* add --reach-lazy-mode. update coana to v138 * add missing option validation --------- Co-authored-by: John-David Dalton <jdalton@users.noreply.github.com>

add --silence flag to socket fix (#1008)

1d9688c

* add --silence flag to suppress non-output stdout/stderr when running socket fix * fix silence bug. debug output to e2e reachability tests * upgrade coana. fix formatting

set scanType to socket_tier1 when creating reachability full scans (#…

d0e383b

…1014) * set scanType to socket_tier1 when creating reachability full scans * fix changelog link

fix(optimize): remove Node.js version filter from manifest entries (#…

35d4d84

…1006) Removes the semver-based Node version check that was filtering manifest entries, allowing all Socket registry overrides to be applied regardless of the Node version specified in package engines.

bump coana version (#1017)

b66490a

upgrade Coana (#1024)

f91f262

Bump to v1.1.56 (#1028)

c10ba4b

chore: remove (Experimental) tag from some alerts

600799b

License related alerts are no longer experimental

ammkrn closed this Feb 21, 2026

cursor bot reviewed Feb 21, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Comments

Unbeta license features#1085

Unbeta license features#1085
ammkrn wants to merge 3098 commits intomainfrom
unbeta_license_features

ammkrn commented Feb 21, 2026 •

edited by cursor bot

Loading

Uh oh!

cursor bot left a comment

Uh oh!

cursor bot Feb 21, 2026

Uh oh!

cursor bot Feb 21, 2026

Uh oh!

cursor bot Feb 21, 2026

Uh oh!

cursor bot commented Feb 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

12 participants

Comments

Conversation

ammkrn commented Feb 21, 2026 • edited by cursor bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor bot left a comment

Choose a reason for hiding this comment

Uh oh!

cursor bot Feb 21, 2026

Choose a reason for hiding this comment

Typo eol=lfs instead of eol=lf in gitattributes

Uh oh!

cursor bot Feb 21, 2026

Choose a reason for hiding this comment

Hardcoded tmpBin.socket instead of using constant

Uh oh!

cursor bot Feb 21, 2026

Choose a reason for hiding this comment

Misplaced await inside Promise.all array literal

Uh oh!

cursor bot commented Feb 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

12 participants

ammkrn commented Feb 21, 2026 •

edited by cursor bot

Loading

Typo `eol=lfs` instead of `eol=lf` in gitattributes

Hardcoded `tmpBin.socket` instead of using constant

Misplaced `await` inside `Promise.all` array literal