Repository navigation
feat(scan): add --reach-disable-dependency-downloads - #1668
Merged
Oskar Haarklou Veileborg (BarrensZeppelin) merged 1 commit intoOct 29, 2026
Merged
Oskar Haarklou Veileborg (BarrensZeppelin) merged 1 commit into
Oskar Haarklou Veileborg (BarrensZeppelin) merged 1 commit into
Conversation
Passes Coana's --disable-dependency-downloads, which limits reachability analysis to dependencies that are already installed.
Oskar Haarklou Veileborg (BarrensZeppelin)
requested a review
from Martin Torp (mtorp)
October 29, 2026 09:29
Oskar Haarklou Veileborg (BarrensZeppelin)
enabled auto-merge (squash)
October 29, 2026 09:30
Martin Torp (mtorp)
approved these changes
Oct 29, 2026
Oskar Haarklou Veileborg (BarrensZeppelin)
merged commit Oct 29, 2026
783f875
into
v1.x
11 checks passed
Oskar Haarklou Veileborg (BarrensZeppelin)
deleted the
reach-disable-dependency-downloads
branch
October 29, 2026 09:32
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds
--reach-disable-dependency-downloadstosocket scan create --reachandsocket scan reach. It passes Coana's--disable-dependency-downloads(added in Coana 15.13.1; the CLI pins 15.13.2), so reachability analysis only uses dependencies that are already installed, and missing ones count as installation failures.Expected reviewer effort: Stamp
Note
Low Risk
Opt-in flag with default off; changes are CLI wiring and Coana argument forwarding with no change to default reachability behavior.
Overview
Adds
--reach-disable-dependency-downloadsforsocket scan create --reachandsocket scan reach, following the same pattern as other--reach-*options (declared inreachability-flags.mts, validated to require--reachon scan create, documented in help and CHANGELOG).When set, the CLI forwards Coana’s
--disable-dependency-downloads, so reachability analysis uses only dependencies already on disk (e.g..venv, vendor dirs, module caches) and treats anything missing as an installation failure instead of fetching it.Reach options structs and CI/GitHub scan defaults include
reachDisableDependencyDownloads: false; tests and help snapshots were updated accordingly.Reviewed by Cursor Bugbot for commit de2cb9a. Configure here.