fix(report): label package versions

.github/workflows/ci.yml

@@ -4,7 +4,7 @@ on:
   push:
     branches: [main, v1.x]
   pull_request:
-    branches: [main, v1.x]
+    branches: [main, v1.x, fix/scan-report-text-v1x]
 
 permissions:
   contents: read

src/commands/scan/output-scan-report-text.test.mts

@@ -8,6 +8,7 @@ import {
 } from './output-scan-report.mts'
 import {
   FOLD_SETTING_NONE,
+  FOLD_SETTING_PKG,
   REPORT_LEVEL_DEFER,
   REPORT_LEVEL_ERROR,
 } from '../../constants.mts'
@@ -49,6 +50,12 @@ function buildReport(
 }
 
 function buildAlerts(): ScanReport['alerts'] {
+  const leaf = alert(
+    'error',
+    'envVars',
+    'package.json',
+    'https://socket.dev/npm/package/acme-widget',
+  )
   return new Map([
     [
       'npm',
@@ -58,12 +65,7 @@ function buildAlerts(): ScanReport['alerts'] {
           new Map([
             [
               '1.0.0',
-              alert(
-                'error',
-                'envVars',
-                'package.json',
-                'https://socket.dev/npm/package/acme-widget',
-              ),
+              new Map([['package.json', new Map([['envVars at 1:2', leaf]])]]),
             ],
           ]),
         ],
@@ -100,6 +102,8 @@ describe('toPlainTextReport', () => {
     expect(text).toContain('1.0.0')
     expect(text).toContain('package.json')
     expect(text).toContain('https://socket.dev/npm/package/acme-widget')
+    expect(text).toContain('VERSION')
+    expect(text).not.toContain('INTRODUCED BY')
   })
 
   it('aligns columns for one alert and keeps its URL on a separate line', () => {
@@ -162,6 +166,7 @@ describe('toPlainTextReport', () => {
     expect(text).toContain('PASSES')
     expect(text).toContain('No alerts')
     expect(text).not.toContain('ALERT TYPE')
+    expect(text).not.toContain('VERSION')
   })
 
   it('includes license, fold and deferred-level settings', () => {
@@ -203,6 +208,95 @@ describe('toPlainTextReport', () => {
     expect(text).toContain('package-000000')
     expect(text).toContain('package-199999')
   })
+
+  it('keeps package versions accurate across fold modes', () => {
+    const leaf = alert('error', 'envVars', 'package.json', '')
+    const versionFoldAlerts: ScanReport['alerts'] = new Map([
+      ['npm', new Map([['demo-transitive', new Map([['2.3.4', leaf]])]])],
+    ])
+    const fileFoldAlerts: ScanReport['alerts'] = new Map([
+      [
+        'npm',
+        new Map([
+          [
+            'demo-transitive',
+            new Map([
+              [
+                '2.3.4',
+                new Map([
+                  ['package.json', leaf],
+                  [
+                    'src/index.js',
+                    alert('warn', 'telemetry', 'package-lock.json', ''),
+                  ],
+                ]),
+              ],
+            ]),
+          ],
+        ]),
+      ],
+    ])
+    const packageFoldAlerts: ScanReport['alerts'] = new Map([
+      ['npm', new Map([['demo-transitive', leaf]])],
+    ])
+    const twoVersionAlerts: ScanReport['alerts'] = new Map([
+      [
+        'npm',
+        new Map([
+          [
+            'demo-transitive',
+            new Map([
+              ['2.3.4', leaf],
+              ['2.3.5', alert('warn', 'telemetry', 'package.json', '')],
+            ]),
+          ],
+        ]),
+      ],
+    ])
+    const versionFoldReport = buildReport({
+      alerts: versionFoldAlerts,
+      fold: 'version',
+      healthy: false,
+    })
+    const fileFoldReport = buildReport({
+      alerts: fileFoldAlerts,
+      fold: 'file',
+      healthy: false,
+    })
+    const packageFoldReport = buildReport({
+      alerts: packageFoldAlerts,
+      fold: FOLD_SETTING_PKG,
+      healthy: false,
+    })
+
+    expect(flattenReportAlerts(versionFoldReport)[0]?.packageVersion).toBe(
+      '2.3.4',
+    )
+    expect(toPlainTextReport(versionFoldReport)).toContain('VERSION')
+    expect(toPlainTextReport(versionFoldReport)).toContain('2.3.4')
+    expect(flattenReportAlerts(fileFoldReport)).toEqual([
+      expect.objectContaining({
+        manifest: 'package.json',
+        packageVersion: '2.3.4',
+      }),
+      expect.objectContaining({
+        manifest: 'package-lock.json',
+        packageVersion: '2.3.4',
+      }),
+    ])
+    expect(toPlainTextReport(fileFoldReport)).toContain('VERSION')
+    expect(toPlainTextReport(fileFoldReport)).toContain('2.3.4')
+    expect(toPlainTextReport(fileFoldReport)).toContain('package-lock.json')
+    expect(flattenReportAlerts(packageFoldReport)[0]?.packageVersion).toBe(
+      '<unknown>',
+    )
+    expect(toPlainTextReport(packageFoldReport)).toContain('<unknown>')
+    expect(
+      flattenReportAlerts(
+        buildReport({ alerts: twoVersionAlerts, fold: 'version' }),
+      ).map(row => row.packageVersion),
+    ).toEqual(['2.3.4', '2.3.5'])
+  })
 })
 
 describe('structured scan reports', () => {
@@ -216,17 +310,24 @@ describe('structured scan reports', () => {
           npm: {
             'acme-widget-π': {
               '1.0.0': {
-                manifest: ['package.json'],
-                policy: 'error',
-                type: 'envVars',
-                url: 'https://socket.dev/npm/package/acme-widget',
+                'package.json': {
+                  'envVars at 1:2': {
+                    manifest: ['package.json'],
+                    policy: 'error',
+                    type: 'envVars',
+                    url: 'https://socket.dev/npm/package/acme-widget',
+                  },
+                },
               },
             },
           },
         },
         includeLicensePolicy: true,
       },
     })
+    expect(JSON.parse(json)).not.toHaveProperty(
+      'data.alerts.npm.acme-widget-π.1.0.0.packageVersion',
+    )
   })
 
   it('keeps alert fields and URLs in Markdown', () => {
@@ -247,9 +348,9 @@ describe('structured scan reports', () => {
       [
         {
           alertType: 'envVars',
-          introducedBy: '1.0.0',
           manifest: 'package.json',
           packageName: 'acme-widget-π',
+          packageVersion: '1.0.0',
           policy: 'error',
           url: 'https://socket.dev/npm/package/acme-widget',
         },

src/commands/scan/output-scan-report.mts

@@ -37,9 +37,9 @@ export type OutputScanReportConfig = {
 
 export type ReportAlertRow = {
   alertType: string
-  introducedBy: string
   manifest: string
   packageName: string
+  packageVersion: string
   policy: string
   url: string
 }
@@ -50,9 +50,9 @@ export function flattenReportAlerts(report: ScanReport): ReportAlertRow[] {
       const { manifest, policy, type, url } = value
       return {
         alertType: type,
-        introducedBy: keys[2] || '<unknown>',
         manifest: joinAnd(manifest),
         packageName: keys[1] || '<unknown>',
+        packageVersion: keys[2] || '<unknown>',
         policy,
         url,
       }
@@ -65,14 +65,14 @@ export function formatAlertTable(rows: ReportAlertRow[]): string[] {
     'POLICY',
     'ALERT TYPE',
     'PACKAGE',
-    'INTRODUCED BY',
+    'VERSION',
     'MANIFEST FILE',
   ]
   const cells = rows.map(row => [
     row.policy,
     row.alertType,
     row.packageName,
-    row.introducedBy,
+    row.packageVersion,
     row.manifest,
   ])
   const widths = headers.map(header => header.length)
@@ -248,7 +248,7 @@ export function toMarkdownReport(
   const flatData = flattenReportAlerts(report).map(row => ({
     'Alert Type': row.alertType,
     Package: row.packageName,
-    'Introduced by': row.introducedBy,
+    Version: row.packageVersion,
     url: row.url,
     'Manifest file': row.manifest,
     Policy: row.policy,
@@ -297,7 +297,7 @@ ${
         'Policy',
         'Alert Type',
         'Package',
-        'Introduced by',
+        'Version',
         'url',
         'Manifest file',
       ])

src/commands/scan/output-scan-report.test.mts

@@ -137,12 +137,12 @@ describe('output-scan-report', () => {
 
         All the alerts from the scan with a policy set to at least "warn".
 
-        | ------ | ---------- | ------- | ------------- | ------------------------------------------- | ----------------- |
-        | Policy | Alert Type | Package | Introduced by | url                                         | Manifest file     |
-        | ------ | ---------- | ------- | ------------- | ------------------------------------------- | ----------------- |
-        | error  | envVars    | tslib   | 1.14.1        | https://socket.dev/npm/package/tslib/1.14.1 | package-lock.json |
-        | error  | envVars    | tslib   | 1.14.1        | https://socket.dev/npm/package/tslib/1.14.1 | package-lock.json |
-        | ------ | ---------- | ------- | ------------- | ------------------------------------------- | ----------------- |
+        | ------ | ---------- | ------- | ------- | ------------------------------------------- | ----------------- |
+        | Policy | Alert Type | Package | Version | url                                         | Manifest file     |
+        | ------ | ---------- | ------- | ------- | ------------------------------------------- | ----------------- |
+        | error  | envVars    | tslib   | 1.14.1  | https://socket.dev/npm/package/tslib/1.14.1 | package-lock.json |
+        | error  | envVars    | tslib   | 1.14.1  | https://socket.dev/npm/package/tslib/1.14.1 | package-lock.json |
+        | ------ | ---------- | ------- | ------- | ------------------------------------------- | ----------------- |
         "
       `)
     })