From 68aeaf823c6d8f21bc72605c544fe0edf4720173 Mon Sep 17 00:00:00 2001 From: jdalton Date: Mon, 12 Oct 2026 13:50:21 -0400 Subject: [PATCH 1/2] fix(report): label package versions --- .../scan/output-scan-report-text.test.mts | 123 ++++++++++++++++-- src/commands/scan/output-scan-report.mts | 12 +- src/commands/scan/output-scan-report.test.mts | 12 +- 3 files changed, 124 insertions(+), 23 deletions(-) diff --git a/src/commands/scan/output-scan-report-text.test.mts b/src/commands/scan/output-scan-report-text.test.mts index 71410f75bd..082b68fad7 100644 --- a/src/commands/scan/output-scan-report-text.test.mts +++ b/src/commands/scan/output-scan-report-text.test.mts @@ -8,6 +8,7 @@ import { } from './output-scan-report.mts' import { FOLD_SETTING_NONE, + FOLD_SETTING_PKG, REPORT_LEVEL_DEFER, REPORT_LEVEL_ERROR, } from '../../constants.mts' @@ -49,6 +50,12 @@ function buildReport( } function buildAlerts(): ScanReport['alerts'] { + const leaf = alert( + 'error', + 'envVars', + 'package.json', + 'https://socket.dev/npm/package/acme-widget', + ) return new Map([ [ 'npm', @@ -58,12 +65,7 @@ function buildAlerts(): ScanReport['alerts'] { new Map([ [ '1.0.0', - alert( - 'error', - 'envVars', - 'package.json', - 'https://socket.dev/npm/package/acme-widget', - ), + new Map([['package.json', new Map([['envVars at 1:2', leaf]])]]), ], ]), ], @@ -100,6 +102,8 @@ describe('toPlainTextReport', () => { expect(text).toContain('1.0.0') expect(text).toContain('package.json') expect(text).toContain('https://socket.dev/npm/package/acme-widget') + expect(text).toContain('VERSION') + expect(text).not.toContain('INTRODUCED BY') }) it('aligns columns for one alert and keeps its URL on a separate line', () => { @@ -162,6 +166,7 @@ describe('toPlainTextReport', () => { expect(text).toContain('PASSES') expect(text).toContain('No alerts') expect(text).not.toContain('ALERT TYPE') + expect(text).not.toContain('VERSION') }) it('includes license, fold and deferred-level settings', () => { @@ -203,6 +208,95 @@ describe('toPlainTextReport', () => { expect(text).toContain('package-000000') expect(text).toContain('package-199999') }) + + it('keeps package versions accurate across fold modes', () => { + const leaf = alert('error', 'envVars', 'package.json', '') + const versionFoldAlerts: ScanReport['alerts'] = new Map([ + ['npm', new Map([['demo-transitive', new Map([['2.3.4', leaf]])]])], + ]) + const fileFoldAlerts: ScanReport['alerts'] = new Map([ + [ + 'npm', + new Map([ + [ + 'demo-transitive', + new Map([ + [ + '2.3.4', + new Map([ + ['package.json', leaf], + [ + 'src/index.js', + alert('warn', 'telemetry', 'package-lock.json', ''), + ], + ]), + ], + ]), + ], + ]), + ], + ]) + const packageFoldAlerts: ScanReport['alerts'] = new Map([ + ['npm', new Map([['demo-transitive', leaf]])], + ]) + const twoVersionAlerts: ScanReport['alerts'] = new Map([ + [ + 'npm', + new Map([ + [ + 'demo-transitive', + new Map([ + ['2.3.4', leaf], + ['2.3.5', alert('warn', 'telemetry', 'package.json', '')], + ]), + ], + ]), + ], + ]) + const versionFoldReport = buildReport({ + alerts: versionFoldAlerts, + fold: 'version', + healthy: false, + }) + const fileFoldReport = buildReport({ + alerts: fileFoldAlerts, + fold: 'file', + healthy: false, + }) + const packageFoldReport = buildReport({ + alerts: packageFoldAlerts, + fold: FOLD_SETTING_PKG, + healthy: false, + }) + + expect(flattenReportAlerts(versionFoldReport)[0]?.packageVersion).toBe( + '2.3.4', + ) + expect(toPlainTextReport(versionFoldReport)).toContain('VERSION') + expect(toPlainTextReport(versionFoldReport)).toContain('2.3.4') + expect(flattenReportAlerts(fileFoldReport)).toEqual([ + expect.objectContaining({ + manifest: 'package.json', + packageVersion: '2.3.4', + }), + expect.objectContaining({ + manifest: 'package-lock.json', + packageVersion: '2.3.4', + }), + ]) + expect(toPlainTextReport(fileFoldReport)).toContain('VERSION') + expect(toPlainTextReport(fileFoldReport)).toContain('2.3.4') + expect(toPlainTextReport(fileFoldReport)).toContain('package-lock.json') + expect(flattenReportAlerts(packageFoldReport)[0]?.packageVersion).toBe( + '', + ) + expect(toPlainTextReport(packageFoldReport)).toContain('') + expect( + flattenReportAlerts( + buildReport({ alerts: twoVersionAlerts, fold: 'version' }), + ).map(row => row.packageVersion), + ).toEqual(['2.3.4', '2.3.5']) + }) }) describe('structured scan reports', () => { @@ -216,10 +310,14 @@ describe('structured scan reports', () => { npm: { 'acme-widget-π': { '1.0.0': { - manifest: ['package.json'], - policy: 'error', - type: 'envVars', - url: 'https://socket.dev/npm/package/acme-widget', + 'package.json': { + 'envVars at 1:2': { + manifest: ['package.json'], + policy: 'error', + type: 'envVars', + url: 'https://socket.dev/npm/package/acme-widget', + }, + }, }, }, }, @@ -227,6 +325,9 @@ describe('structured scan reports', () => { includeLicensePolicy: true, }, }) + expect(JSON.parse(json)).not.toHaveProperty( + 'data.alerts.npm.acme-widget-π.1.0.0.packageVersion', + ) }) it('keeps alert fields and URLs in Markdown', () => { @@ -247,9 +348,9 @@ describe('structured scan reports', () => { [ { alertType: 'envVars', - introducedBy: '1.0.0', manifest: 'package.json', packageName: 'acme-widget-π', + packageVersion: '1.0.0', policy: 'error', url: 'https://socket.dev/npm/package/acme-widget', }, diff --git a/src/commands/scan/output-scan-report.mts b/src/commands/scan/output-scan-report.mts index e9c22048e7..18e9f7cb51 100644 --- a/src/commands/scan/output-scan-report.mts +++ b/src/commands/scan/output-scan-report.mts @@ -37,9 +37,9 @@ export type OutputScanReportConfig = { export type ReportAlertRow = { alertType: string - introducedBy: string manifest: string packageName: string + packageVersion: string policy: string url: string } @@ -50,9 +50,9 @@ export function flattenReportAlerts(report: ScanReport): ReportAlertRow[] { const { manifest, policy, type, url } = value return { alertType: type, - introducedBy: keys[2] || '', manifest: joinAnd(manifest), packageName: keys[1] || '', + packageVersion: keys[2] || '', policy, url, } @@ -65,14 +65,14 @@ export function formatAlertTable(rows: ReportAlertRow[]): string[] { 'POLICY', 'ALERT TYPE', 'PACKAGE', - 'INTRODUCED BY', + 'VERSION', 'MANIFEST FILE', ] const cells = rows.map(row => [ row.policy, row.alertType, row.packageName, - row.introducedBy, + row.packageVersion, row.manifest, ]) const widths = headers.map(header => header.length) @@ -248,7 +248,7 @@ export function toMarkdownReport( const flatData = flattenReportAlerts(report).map(row => ({ 'Alert Type': row.alertType, Package: row.packageName, - 'Introduced by': row.introducedBy, + Version: row.packageVersion, url: row.url, 'Manifest file': row.manifest, Policy: row.policy, @@ -297,7 +297,7 @@ ${ 'Policy', 'Alert Type', 'Package', - 'Introduced by', + 'Version', 'url', 'Manifest file', ]) diff --git a/src/commands/scan/output-scan-report.test.mts b/src/commands/scan/output-scan-report.test.mts index fba2735d53..181fb3deca 100644 --- a/src/commands/scan/output-scan-report.test.mts +++ b/src/commands/scan/output-scan-report.test.mts @@ -137,12 +137,12 @@ describe('output-scan-report', () => { All the alerts from the scan with a policy set to at least "warn". - | ------ | ---------- | ------- | ------------- | ------------------------------------------- | ----------------- | - | Policy | Alert Type | Package | Introduced by | url | Manifest file | - | ------ | ---------- | ------- | ------------- | ------------------------------------------- | ----------------- | - | error | envVars | tslib | 1.14.1 | https://socket.dev/npm/package/tslib/1.14.1 | package-lock.json | - | error | envVars | tslib | 1.14.1 | https://socket.dev/npm/package/tslib/1.14.1 | package-lock.json | - | ------ | ---------- | ------- | ------------- | ------------------------------------------- | ----------------- | + | ------ | ---------- | ------- | ------- | ------------------------------------------- | ----------------- | + | Policy | Alert Type | Package | Version | url | Manifest file | + | ------ | ---------- | ------- | ------- | ------------------------------------------- | ----------------- | + | error | envVars | tslib | 1.14.1 | https://socket.dev/npm/package/tslib/1.14.1 | package-lock.json | + | error | envVars | tslib | 1.14.1 | https://socket.dev/npm/package/tslib/1.14.1 | package-lock.json | + | ------ | ---------- | ------- | ------- | ------------------------------------------- | ----------------- | " `) }) From 380118b107bbf336f0b8db611c0398b31ac86092 Mon Sep 17 00:00:00 2001 From: jdalton Date: Tue, 27 Oct 2026 16:40:50 -0400 Subject: [PATCH 2/2] fix(ci): verify report version stack --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 57f9c45b06..f14fa02d8b 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -4,7 +4,7 @@ on: push: branches: [main, v1.x] pull_request: - branches: [main, v1.x] + branches: [main, v1.x, fix/scan-report-text-v1x] permissions: contents: read