Skip to content

Commit 95c8584

Browse files
mtorpjdalton
andauthored
Socket fix and repo name adjustments (#742)
* Rename onlyCompute to dontApplyFixes and add alias to old option name * add repository name sanitization to ensure the API doesn't complain about invalid repository names * update CHANGELOG * fix rename of --only-compute flag * fix lint errors --------- Co-authored-by: jdalton <john.david.dalton@gmail.com> Co-authored-by: John-David Dalton <jdalton@users.noreply.github.com>
1 parent ad2d0b4 commit 95c8584

11 files changed

Lines changed: 209 additions & 31 deletions

CHANGELOG.md

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,13 @@
33
All notable changes to this project will be documented in this file.
44

55
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
6+
## [1.1.22](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.22) - 2025-09-20
7+
8+
### Changed
9+
- Rename `--only-compute` flag to `--dont-apply-fixes` for `socket fix`, but keep old flag as an alias.
10+
11+
### Fixed
12+
- Sanitize extracted git repository names to be compatible with the Socket API.
613

714
## [1.1.21](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.22) - 2025-09-20
815

package.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "socket",
3-
"version": "1.1.21",
3+
"version": "1.1.22",
44
"description": "CLI for Socket.dev",
55
"homepage": "https://github.com/SocketDev/socket-cli",
66
"license": "MIT AND OFL-1.1",

src/commands/fix/cmd-fix.mts

Lines changed: 10 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,13 @@ const generalFlags: MeowFlags = {
5252
'https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/configuring-pull-request-merges/managing-auto-merge-for-pull-requests-in-your-repository',
5353
)} for managing auto-merge for pull requests in your repository.`,
5454
},
55+
dontApplyFixes: {
56+
aliases: ['onlyCompute'],
57+
type: 'boolean',
58+
default: false,
59+
description:
60+
'Compute fixes only, do not apply them. Logs what upgrades would be applied. If combined with --output-file, the output file will contain the upgrades that would be applied.',
61+
},
5562
id: {
5663
type: 'string',
5764
default: [],
@@ -86,12 +93,6 @@ Available styles:
8693
* preserve - Retain the existing version range style as-is
8794
`.trim(),
8895
},
89-
onlyCompute: {
90-
type: 'boolean',
91-
default: false,
92-
description:
93-
'Compute fixes only, do not apply them. Logs what upgrades would be applied. If combined with --output-file, the output file will contain the upgrades that would be applied.',
94-
},
9596
outputFile: {
9697
type: 'string',
9798
default: '',
@@ -208,12 +209,12 @@ async function run(
208209

209210
const {
210211
autopilot,
212+
dontApplyFixes,
211213
glob,
212214
json,
213215
limit,
214216
markdown,
215217
maxSatisfying,
216-
onlyCompute,
217218
outputFile,
218219
prCheck,
219220
rangeStyle,
@@ -222,6 +223,7 @@ async function run(
222223
unknownFlags = [],
223224
} = cli.flags as {
224225
autopilot: boolean
226+
dontApplyFixes: boolean
225227
glob: string
226228
limit: number
227229
json: boolean
@@ -232,7 +234,6 @@ async function run(
232234
rangeStyle: RangeStyle
233235
unknownFlags?: string[]
234236
outputFile: string
235-
onlyCompute: boolean
236237
}
237238

238239
const dryRun = !!cli.flags['dryRun']
@@ -291,6 +292,7 @@ async function run(
291292

292293
await handleFix({
293294
autopilot,
295+
dontApplyFixes,
294296
cwd,
295297
ghsas,
296298
glob,
@@ -302,7 +304,6 @@ async function run(
302304
rangeStyle,
303305
spinner,
304306
unknownFlags,
305-
onlyCompute,
306307
outputFile,
307308
})
308309
}

src/commands/fix/cmd-fix.test.mts

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -172,6 +172,7 @@ describe('socket fix', async () => {
172172
Options
173173
--autopilot Enable auto-merge for pull requests that Socket opens.
174174
See GitHub documentation (https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/configuring-pull-request-merges/managing-auto-merge-for-pull-requests-in-your-repository) for managing auto-merge for pull requests in your repository.
175+
--dont-apply-fixes Compute fixes only, do not apply them. Logs what upgrades would be applied. If combined with --output-file, the output file will contain the upgrades that would be applied.
175176
--id Provide a list of vulnerability identifiers to compute fixes for:
176177
- GHSA IDs (https://docs.github.com/en/code-security/security-advisories/working-with-global-security-advisories-from-the-github-advisory-database/about-the-github-advisory-database#about-ghsa-ids) (e.g., GHSA-xxxx-xxxx-xxxx)
177178
- CVE IDs (https://cve.mitre.org/cve/identifiers/) (e.g., CVE-2025-1234) - automatically converted to GHSA
@@ -180,7 +181,6 @@ describe('socket fix', async () => {
180181
--json Output result as json
181182
--limit The number of fixes to attempt at a time (default 10)
182183
--markdown Output result as markdown
183-
--only-compute Compute fixes only, do not apply them. Logs what upgrades would be applied. If combined with --output-file, the output file will contain the upgrades that would be applied.
184184
--output-file Path to store upgrades as a JSON file at this path.
185185
--range-style Define how dependency version ranges are updated in package.json (default 'preserve').
186186
Available styles:

src/commands/fix/coana-fix.mts

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -45,10 +45,10 @@ export async function coanaFix(
4545
const {
4646
autopilot,
4747
cwd,
48+
dontApplyFixes,
4849
ghsas,
4950
glob,
5051
limit,
51-
onlyCompute,
5252
orgSlug,
5353
outputFile,
5454
spinner,
@@ -106,7 +106,7 @@ export async function coanaFix(
106106

107107
if (!shouldOpenPrs) {
108108
// Inform user about local mode when fixes will be applied.
109-
if (!onlyCompute && ghsas.length) {
109+
if (!dontApplyFixes && ghsas.length) {
110110
const envCheck = checkCiEnvVars()
111111
if (envCheck.present.length) {
112112
// Some CI vars are set but not all - show what's missing.
@@ -143,7 +143,7 @@ export async function coanaFix(
143143
? ['--range-style', fixConfig.rangeStyle]
144144
: []),
145145
...(glob ? ['--glob', glob] : []),
146-
...(onlyCompute ? [FLAG_DRY_RUN] : []),
146+
...(dontApplyFixes ? [FLAG_DRY_RUN] : []),
147147
...(outputFile ? ['--output-file', outputFile] : []),
148148
...fixConfig.unknownFlags,
149149
],

src/commands/fix/handle-fix.mts

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -16,12 +16,12 @@ const CVE_FORMAT_REGEXP = /^CVE-\d{4}-\d{4,}$/
1616

1717
export type HandleFixConfig = Remap<
1818
FixConfig & {
19+
dontApplyFixes: boolean
1920
ghsas: string[]
2021
glob: string
2122
orgSlug: string
2223
outputKind: OutputKind
2324
unknownFlags: string[]
24-
onlyCompute: boolean
2525
outputFile: string
2626
}
2727
>
@@ -100,11 +100,11 @@ export async function convertIdsToGhsas(ids: string[]): Promise<string[]> {
100100
export async function handleFix({
101101
autopilot,
102102
cwd,
103+
dontApplyFixes,
103104
ghsas,
104105
glob,
105106
limit,
106107
minSatisfying,
107-
onlyCompute,
108108
orgSlug,
109109
outputFile,
110110
outputKind,
@@ -121,7 +121,7 @@ export async function handleFix({
121121
glob,
122122
limit,
123123
minSatisfying,
124-
onlyCompute,
124+
dontApplyFixes,
125125
outputFile,
126126
outputKind,
127127
prCheck,
@@ -132,6 +132,7 @@ export async function handleFix({
132132
await outputFixResult(
133133
await coanaFix({
134134
autopilot,
135+
dontApplyFixes,
135136
cwd,
136137
// Convert mixed CVE/GHSA/PURL inputs to GHSA IDs only
137138
ghsas: await convertIdsToGhsas(ghsas),
@@ -143,7 +144,6 @@ export async function handleFix({
143144
rangeStyle,
144145
spinner,
145146
unknownFlags,
146-
onlyCompute,
147147
outputFile,
148148
}),
149149
outputKind,

src/commands/fix/types.mts

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ import type { Spinner } from '@socketsecurity/registry/lib/spinner'
33

44
export type FixConfig = {
55
autopilot: boolean
6+
dontApplyFixes: boolean
67
cwd: string
78
ghsas: string[]
89
glob: string
@@ -13,6 +14,5 @@ export type FixConfig = {
1314
rangeStyle: RangeStyle
1415
spinner: Spinner | undefined
1516
unknownFlags: string[]
16-
onlyCompute: boolean
1717
outputFile: string
1818
}

src/commands/optimize/cmd-optimize-pnpm-versions.test.mts

Lines changed: 2 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,7 @@
1-
import { existsSync, promises as fs } from 'node:fs'
1+
import { existsSync } from 'node:fs'
22
import path from 'node:path'
33

4-
import {
5-
afterAll,
6-
afterEach,
7-
beforeAll,
8-
beforeEach,
9-
describe,
10-
expect,
11-
it,
12-
} from 'vitest'
4+
import { afterEach, beforeEach, describe, expect, it } from 'vitest'
135

146
import { readPackageJson } from '@socketsecurity/registry/lib/packages'
157
import { spawnSync } from '@socketsecurity/registry/lib/spawn'

src/utils/extract-names.mts

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
import constants from '../constants.mts'
2+
3+
/**
4+
* Sanitizes a name to comply with repository naming constraints.
5+
* Constraints: 100 or less A-Za-z0-9 characters only with non-repeating,
6+
* non-leading or trailing ., _ or - only.
7+
*
8+
* @param name - The name to sanitize
9+
* @returns Sanitized name that complies with repository naming rules, or empty string if no valid characters
10+
*/
11+
function sanitizeName(name: string): string {
12+
if (!name) {
13+
return ''
14+
}
15+
16+
// Replace sequences of illegal characters with underscores.
17+
const sanitized = name
18+
// Replace any sequence of non-alphanumeric characters (except ., _, -) with underscore.
19+
.replace(/[^A-Za-z0-9._-]+/g, '_')
20+
// Replace sequences of multiple allowed special chars with single underscore.
21+
.replace(/[._-]{2,}/g, '_')
22+
// Remove leading special characters.
23+
.replace(/^[._-]+/, '')
24+
// Remove trailing special characters.
25+
.replace(/[._-]+$/, '')
26+
// Truncate to 100 characters max.
27+
.slice(0, 100)
28+
29+
return sanitized
30+
}
31+
32+
/**
33+
* Extracts and sanitizes a repository name.
34+
*
35+
* @param name - The repository name to extract and sanitize
36+
* @returns Sanitized repository name, or default repository name if empty
37+
*/
38+
export function extractName(name: string): string {
39+
const sanitized = sanitizeName(name)
40+
return sanitized || constants.SOCKET_DEFAULT_REPOSITORY
41+
}
42+
43+
/**
44+
* Extracts and sanitizes a repository owner name.
45+
*
46+
* @param owner - The repository owner name to extract and sanitize
47+
* @returns Sanitized repository owner name, or undefined if input is empty
48+
*/
49+
export function extractOwner(owner: string): string | undefined {
50+
if (!owner) {
51+
return undefined
52+
}
53+
const sanitized = sanitizeName(owner)
54+
return sanitized || undefined
55+
}

0 commit comments

Comments
 (0)