diff --git a/CHANGELOG.md b/CHANGELOG.md index 57a8c2110..7aee6d1ab 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,6 +4,11 @@ All notable changes to this project will be documented in this file. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). +## [Unreleased] + +### Added +- `--reach-disable-dependency-downloads` limits reachability analysis to already-installed dependencies. + ## [1.11.2](https://github.com/SocketDev/socket-cli/releases/tag/v1.11.2) - 2026-10-29 ### Changed diff --git a/src/commands/ci/handle-ci.mts b/src/commands/ci/handle-ci.mts index 304a9bf0b..62487d0b9 100644 --- a/src/commands/ci/handle-ci.mts +++ b/src/commands/ci/handle-ci.mts @@ -78,6 +78,7 @@ export async function handleCi(autoManifest: boolean): Promise { reachDebug: false, reachDetailedAnalysisLogFile: false, reachDisableAnalytics: false, + reachDisableDependencyDownloads: false, reachDisableExternalToolChecks: false, reachEcosystems: [], reachEnableAnalysisSplitting: false, diff --git a/src/commands/scan/cmd-scan-create.mts b/src/commands/scan/cmd-scan-create.mts index 336079245..aa5ac4bab 100644 --- a/src/commands/scan/cmd-scan-create.mts +++ b/src/commands/scan/cmd-scan-create.mts @@ -297,6 +297,7 @@ async function run( reachDetailedAnalysisLogFile, reachDisableAnalysisSplitting: _reachDisableAnalysisSplitting, reachDisableAnalytics, + reachDisableDependencyDownloads, reachDisableExternalToolChecks, reachEnableAnalysisSplitting, reachFallbackToRegularScan, @@ -338,6 +339,7 @@ async function run( reachDetailedAnalysisLogFile: boolean reachDisableAnalysisSplitting: boolean reachDisableAnalytics: boolean + reachDisableDependencyDownloads: boolean reachDisableExternalToolChecks: boolean reachEnableAnalysisSplitting: boolean reachFallbackToRegularScan: boolean @@ -704,6 +706,7 @@ async function run( reachDebug: Boolean(reachDebug), reachDetailedAnalysisLogFile: Boolean(reachDetailedAnalysisLogFile), reachDisableAnalytics: Boolean(reachDisableAnalytics), + reachDisableDependencyDownloads: Boolean(reachDisableDependencyDownloads), reachDisableExternalToolChecks: Boolean(reachDisableExternalToolChecks), reachEcosystems, reachEnableAnalysisSplitting: Boolean(reachEnableAnalysisSplitting), diff --git a/src/commands/scan/cmd-scan-create.test.mts b/src/commands/scan/cmd-scan-create.test.mts index b1ff158ce..95333b75d 100644 --- a/src/commands/scan/cmd-scan-create.test.mts +++ b/src/commands/scan/cmd-scan-create.test.mts @@ -133,6 +133,7 @@ describe('socket scan create', async () => { --reach-debug Enable debug mode for reachability analysis. Provides verbose logging from the reachability CLI. --reach-detailed-analysis-log-file A log file with detailed analysis logs is written to root of each analyzed workspace. --reach-disable-analytics Disable reachability analytics sharing with Socket. Also disables caching-based optimizations. + --reach-disable-dependency-downloads Only analyze dependencies that are already installed (e.g. in the project's .venv, vendor directory or module cache). Missing dependencies count as installation failures. --reach-disable-external-tool-checks Disable external tool checks during reachability analysis. --reach-ecosystems List of ecosystems to conduct reachability analysis on, as either a comma separated value or as multiple flags. Supported: cargo, composer, gem, golang, maven, npm, nuget, pypi. Defaults to all supported ecosystems. --reach-enable-analysis-splitting Allow the reachability analysis to partition CVEs into buckets that are processed in separate analysis runs. May improve accuracy, but not recommended by default. diff --git a/src/commands/scan/cmd-scan-reach.mts b/src/commands/scan/cmd-scan-reach.mts index 52383c848..d3fd778af 100644 --- a/src/commands/scan/cmd-scan-reach.mts +++ b/src/commands/scan/cmd-scan-reach.mts @@ -162,6 +162,7 @@ async function run( reachDetailedAnalysisLogFile, reachDisableAnalysisSplitting: _reachDisableAnalysisSplitting, reachDisableAnalytics, + reachDisableDependencyDownloads, reachDisableExternalToolChecks, reachEnableAnalysisSplitting, reachLazyMode: _reachLazyMode, @@ -188,6 +189,7 @@ async function run( reachDetailedAnalysisLogFile: boolean reachDisableAnalysisSplitting: boolean reachDisableAnalytics: boolean + reachDisableDependencyDownloads: boolean reachDisableExternalToolChecks: boolean reachEnableAnalysisSplitting: boolean reachLazyMode: boolean @@ -314,6 +316,7 @@ async function run( reachDebug: Boolean(reachDebug), reachDetailedAnalysisLogFile: Boolean(reachDetailedAnalysisLogFile), reachDisableAnalytics: Boolean(reachDisableAnalytics), + reachDisableDependencyDownloads: Boolean(reachDisableDependencyDownloads), reachDisableExternalToolChecks: Boolean(reachDisableExternalToolChecks), reachEcosystems, reachEnableAnalysisSplitting: Boolean(reachEnableAnalysisSplitting), diff --git a/src/commands/scan/cmd-scan-reach.test.mts b/src/commands/scan/cmd-scan-reach.test.mts index 3ee81f542..14a1c7daf 100644 --- a/src/commands/scan/cmd-scan-reach.test.mts +++ b/src/commands/scan/cmd-scan-reach.test.mts @@ -50,6 +50,7 @@ describe('socket scan reach', async () => { --reach-debug Enable debug mode for reachability analysis. Provides verbose logging from the reachability CLI. --reach-detailed-analysis-log-file A log file with detailed analysis logs is written to root of each analyzed workspace. --reach-disable-analytics Disable reachability analytics sharing with Socket. Also disables caching-based optimizations. + --reach-disable-dependency-downloads Only analyze dependencies that are already installed (e.g. in the project's .venv, vendor directory or module cache). Missing dependencies count as installation failures. --reach-disable-external-tool-checks Disable external tool checks during reachability analysis. --reach-ecosystems List of ecosystems to conduct reachability analysis on, as either a comma separated value or as multiple flags. Supported: cargo, composer, gem, golang, maven, npm, nuget, pypi. Defaults to all supported ecosystems. --reach-enable-analysis-splitting Allow the reachability analysis to partition CVEs into buckets that are processed in separate analysis runs. May improve accuracy, but not recommended by default. diff --git a/src/commands/scan/create-scan-from-github.mts b/src/commands/scan/create-scan-from-github.mts index c1df7c33a..9251d5990 100644 --- a/src/commands/scan/create-scan-from-github.mts +++ b/src/commands/scan/create-scan-from-github.mts @@ -336,6 +336,7 @@ async function scanOneRepo( reachDebug: false, reachDetailedAnalysisLogFile: false, reachDisableAnalytics: false, + reachDisableDependencyDownloads: false, reachDisableExternalToolChecks: false, reachEcosystems: [], reachEnableAnalysisSplitting: false, diff --git a/src/commands/scan/exclude-paths.test.mts b/src/commands/scan/exclude-paths.test.mts index 99bea030a..a29511ab6 100644 --- a/src/commands/scan/exclude-paths.test.mts +++ b/src/commands/scan/exclude-paths.test.mts @@ -27,6 +27,7 @@ function makeReachOptions( reachDebug: false, reachDetailedAnalysisLogFile: false, reachDisableAnalytics: false, + reachDisableDependencyDownloads: false, reachDisableExternalToolChecks: false, reachEcosystems: [], reachEnableAnalysisSplitting: false, diff --git a/src/commands/scan/generate-uv-member-sboms.e2e.test.mts b/src/commands/scan/generate-uv-member-sboms.e2e.test.mts index cdb7cf03a..e1e844112 100644 --- a/src/commands/scan/generate-uv-member-sboms.e2e.test.mts +++ b/src/commands/scan/generate-uv-member-sboms.e2e.test.mts @@ -243,6 +243,7 @@ describe('uv member scans with the real uv binary', { timeout: 30_000 }, () => { reachDebug: false, reachDetailedAnalysisLogFile: false, reachDisableAnalytics: false, + reachDisableDependencyDownloads: false, reachDisableExternalToolChecks: false, reachEcosystems: [], reachEnableAnalysisSplitting: false, diff --git a/src/commands/scan/handle-create-new-scan.test.mts b/src/commands/scan/handle-create-new-scan.test.mts index d050f62eb..a14a79c53 100644 --- a/src/commands/scan/handle-create-new-scan.test.mts +++ b/src/commands/scan/handle-create-new-scan.test.mts @@ -116,6 +116,7 @@ function createConfig( reachDebug: false, reachDetailedAnalysisLogFile: false, reachDisableAnalytics: false, + reachDisableDependencyDownloads: false, reachDisableExternalToolChecks: false, reachEcosystems: [], reachEnableAnalysisSplitting: false, @@ -580,6 +581,7 @@ describe('handleCreateNewScan excludePaths', () => { reachDebug: false, reachDetailedAnalysisLogFile: false, reachDisableAnalytics: false, + reachDisableDependencyDownloads: false, reachDisableExternalToolChecks: false, reachEcosystems: [], reachEnableAnalysisSplitting: false, @@ -645,6 +647,7 @@ describe('handleCreateNewScan excludePaths', () => { reachDebug: false, reachDetailedAnalysisLogFile: false, reachDisableAnalytics: false, + reachDisableDependencyDownloads: false, reachDisableExternalToolChecks: false, reachEcosystems: [], reachEnableAnalysisSplitting: false, @@ -716,6 +719,7 @@ describe('handleCreateNewScan excludePaths', () => { reachDebug: false, reachDetailedAnalysisLogFile: false, reachDisableAnalytics: false, + reachDisableDependencyDownloads: false, reachDisableExternalToolChecks: false, reachEcosystems: [], reachEnableAnalysisSplitting: false, @@ -777,6 +781,7 @@ describe('handleCreateNewScan excludePaths', () => { reachDebug: false, reachDetailedAnalysisLogFile: false, reachDisableAnalytics: false, + reachDisableDependencyDownloads: false, reachDisableExternalToolChecks: false, reachEcosystems: [], reachEnableAnalysisSplitting: false, @@ -838,6 +843,7 @@ describe('handleCreateNewScan excludePaths', () => { reachDebug: false, reachDetailedAnalysisLogFile: false, reachDisableAnalytics: false, + reachDisableDependencyDownloads: false, reachDisableExternalToolChecks: false, reachEcosystems: [], reachEnableAnalysisSplitting: false, diff --git a/src/commands/scan/handle-scan-reach.test.mts b/src/commands/scan/handle-scan-reach.test.mts index cb32a170a..8feab61ea 100644 --- a/src/commands/scan/handle-scan-reach.test.mts +++ b/src/commands/scan/handle-scan-reach.test.mts @@ -130,6 +130,7 @@ describe('handleScanReach', () => { reachDebug: false, reachDetailedAnalysisLogFile: false, reachDisableAnalytics: false, + reachDisableDependencyDownloads: false, reachDisableExternalToolChecks: false, reachEcosystems: [], reachEnableAnalysisSplitting: false, @@ -183,6 +184,7 @@ describe('handleScanReach', () => { reachDebug: false, reachDetailedAnalysisLogFile: false, reachDisableAnalytics: false, + reachDisableDependencyDownloads: false, reachDisableExternalToolChecks: false, reachEcosystems: [], reachEnableAnalysisSplitting: false, @@ -246,6 +248,7 @@ describe('handleScanReach', () => { reachDebug: false, reachDetailedAnalysisLogFile: false, reachDisableAnalytics: false, + reachDisableDependencyDownloads: false, reachDisableExternalToolChecks: false, reachEcosystems: [], reachEnableAnalysisSplitting: false, @@ -295,6 +298,7 @@ describe('handleScanReach', () => { reachDebug: false, reachDetailedAnalysisLogFile: false, reachDisableAnalytics: false, + reachDisableDependencyDownloads: false, reachDisableExternalToolChecks: false, reachEcosystems: [], reachEnableAnalysisSplitting: false, @@ -348,6 +352,7 @@ describe('handleScanReach', () => { reachDebug: false, reachDetailedAnalysisLogFile: false, reachDisableAnalytics: false, + reachDisableDependencyDownloads: false, reachDisableExternalToolChecks: false, reachEcosystems: [], reachEnableAnalysisSplitting: false, @@ -386,6 +391,7 @@ describe('handleScanReach', () => { reachDebug: false, reachDetailedAnalysisLogFile: false, reachDisableAnalytics: false, + reachDisableDependencyDownloads: false, reachDisableExternalToolChecks: false, reachEcosystems: [], reachEnableAnalysisSplitting: false, @@ -437,6 +443,7 @@ describe('handleScanReach', () => { reachDebug: false, reachDetailedAnalysisLogFile: false, reachDisableAnalytics: false, + reachDisableDependencyDownloads: false, reachDisableExternalToolChecks: false, reachEcosystems: [], reachEnableAnalysisSplitting: false, @@ -491,6 +498,7 @@ describe('handleScanReach', () => { reachDebug: false, reachDetailedAnalysisLogFile: false, reachDisableAnalytics: false, + reachDisableDependencyDownloads: false, reachDisableExternalToolChecks: false, reachEcosystems: [], reachEnableAnalysisSplitting: false, diff --git a/src/commands/scan/perform-reachability-analysis.mts b/src/commands/scan/perform-reachability-analysis.mts index bbb8a4009..a8b72f6f6 100644 --- a/src/commands/scan/perform-reachability-analysis.mts +++ b/src/commands/scan/perform-reachability-analysis.mts @@ -39,6 +39,7 @@ export type ReachabilityOptions = { reachContinueOnNoSourceFiles: boolean reachDebug: boolean reachDetailedAnalysisLogFile: boolean + reachDisableDependencyDownloads: boolean reachDisableExternalToolChecks: boolean reachDisableAnalytics: boolean reachEcosystems: PURL_Type[] @@ -243,6 +244,9 @@ export async function performReachabilityAnalysis( ...(reachabilityOptions.reachDisableAnalytics ? ['--disable-analytics-sharing'] : []), + ...(reachabilityOptions.reachDisableDependencyDownloads + ? ['--disable-dependency-downloads'] + : []), ...(reachabilityOptions.reachDisableExternalToolChecks ? ['--disable-external-tool-checks'] : []), diff --git a/src/commands/scan/perform-reachability-analysis.test.mts b/src/commands/scan/perform-reachability-analysis.test.mts index e9d87734c..beabe6612 100644 --- a/src/commands/scan/perform-reachability-analysis.test.mts +++ b/src/commands/scan/perform-reachability-analysis.test.mts @@ -107,6 +107,7 @@ function makeReachabilityOptions(): ReachabilityOptions { reachContinueOnNoSourceFiles: false, reachDebug: false, reachDetailedAnalysisLogFile: false, + reachDisableDependencyDownloads: false, reachDisableExternalToolChecks: false, reachDisableAnalytics: false, reachEcosystems: [], diff --git a/src/commands/scan/reachability-flags.mts b/src/commands/scan/reachability-flags.mts index 42f488ce2..01d3962a7 100644 --- a/src/commands/scan/reachability-flags.mts +++ b/src/commands/scan/reachability-flags.mts @@ -92,6 +92,12 @@ export const reachabilityFlags: MeowFlags = { description: 'Deprecated: Analysis splitting is now disabled by default. This flag is a no-op.', }, + reachDisableDependencyDownloads: { + type: 'boolean', + default: false, + description: + "Only analyze dependencies that are already installed (e.g. in the project's .venv, vendor directory or module cache). Missing dependencies count as installation failures.", + }, reachEnableAnalysisSplitting: { type: 'boolean', default: false,