Skip to content

Repository navigation

feat(scan): add --reach-disable-dependency-downloads #1668

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Oskar Haarklou Veileborg (BarrensZeppelin) merged 1 commit into from
Oct 29, 2026
Merged

feat(scan): add --reach-disable-dependency-downloads #1668

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,11 @@ All notable changes to this project will be documented in this file.

The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).

## [Unreleased]

### Added
- `--reach-disable-dependency-downloads` limits reachability analysis to already-installed dependencies.

## [1.11.2](https://github.com/SocketDev/socket-cli/releases/tag/v1.11.2) - 2026-10-29

### Changed
Expand Down
1 change: 1 addition & 0 deletions src/commands/ci/handle-ci.mts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -78,6 +78,7 @@ export async function handleCi(autoManifest: boolean): Promise<void> {
reachDebug: false,
reachDetailedAnalysisLogFile: false,
reachDisableAnalytics: false,
reachDisableDependencyDownloads: false,
reachDisableExternalToolChecks: false,
reachEcosystems: [],
reachEnableAnalysisSplitting: false,
Expand Down
3 changes: 3 additions & 0 deletions src/commands/scan/cmd-scan-create.mts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -297,6 +297,7 @@ async function run(
reachDetailedAnalysisLogFile,
reachDisableAnalysisSplitting: _reachDisableAnalysisSplitting,
reachDisableAnalytics,
reachDisableDependencyDownloads,
reachDisableExternalToolChecks,
reachEnableAnalysisSplitting,
reachFallbackToRegularScan,
Expand Down Expand Up @@ -338,6 +339,7 @@ async function run(
reachDetailedAnalysisLogFile: boolean
reachDisableAnalysisSplitting: boolean
reachDisableAnalytics: boolean
reachDisableDependencyDownloads: boolean
reachDisableExternalToolChecks: boolean
reachEnableAnalysisSplitting: boolean
reachFallbackToRegularScan: boolean
Expand Down Expand Up @@ -704,6 +706,7 @@ async function run(
reachDebug: Boolean(reachDebug),
reachDetailedAnalysisLogFile: Boolean(reachDetailedAnalysisLogFile),
reachDisableAnalytics: Boolean(reachDisableAnalytics),
reachDisableDependencyDownloads: Boolean(reachDisableDependencyDownloads),
reachDisableExternalToolChecks: Boolean(reachDisableExternalToolChecks),
reachEcosystems,
reachEnableAnalysisSplitting: Boolean(reachEnableAnalysisSplitting),
Expand Down
1 change: 1 addition & 0 deletions src/commands/scan/cmd-scan-create.test.mts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -133,6 +133,7 @@ describe('socket scan create', async () => {
--reach-debug Enable debug mode for reachability analysis. Provides verbose logging from the reachability CLI.
--reach-detailed-analysis-log-file A log file with detailed analysis logs is written to root of each analyzed workspace.
--reach-disable-analytics Disable reachability analytics sharing with Socket. Also disables caching-based optimizations.
--reach-disable-dependency-downloads Only analyze dependencies that are already installed (e.g. in the project's .venv, vendor directory or module cache). Missing dependencies count as installation failures.
--reach-disable-external-tool-checks Disable external tool checks during reachability analysis.
--reach-ecosystems List of ecosystems to conduct reachability analysis on, as either a comma separated value or as multiple flags. Supported: cargo, composer, gem, golang, maven, npm, nuget, pypi. Defaults to all supported ecosystems.
--reach-enable-analysis-splitting Allow the reachability analysis to partition CVEs into buckets that are processed in separate analysis runs. May improve accuracy, but not recommended by default.
Expand Down
3 changes: 3 additions & 0 deletions src/commands/scan/cmd-scan-reach.mts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -162,6 +162,7 @@ async function run(
reachDetailedAnalysisLogFile,
reachDisableAnalysisSplitting: _reachDisableAnalysisSplitting,
reachDisableAnalytics,
reachDisableDependencyDownloads,
reachDisableExternalToolChecks,
reachEnableAnalysisSplitting,
reachLazyMode: _reachLazyMode,
Expand All @@ -188,6 +189,7 @@ async function run(
reachDetailedAnalysisLogFile: boolean
reachDisableAnalysisSplitting: boolean
reachDisableAnalytics: boolean
reachDisableDependencyDownloads: boolean
reachDisableExternalToolChecks: boolean
reachEnableAnalysisSplitting: boolean
reachLazyMode: boolean
Expand Down Expand Up @@ -314,6 +316,7 @@ async function run(
reachDebug: Boolean(reachDebug),
reachDetailedAnalysisLogFile: Boolean(reachDetailedAnalysisLogFile),
reachDisableAnalytics: Boolean(reachDisableAnalytics),
reachDisableDependencyDownloads: Boolean(reachDisableDependencyDownloads),
reachDisableExternalToolChecks: Boolean(reachDisableExternalToolChecks),
reachEcosystems,
reachEnableAnalysisSplitting: Boolean(reachEnableAnalysisSplitting),
Expand Down
1 change: 1 addition & 0 deletions src/commands/scan/cmd-scan-reach.test.mts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,6 +50,7 @@ describe('socket scan reach', async () => {
--reach-debug Enable debug mode for reachability analysis. Provides verbose logging from the reachability CLI.
--reach-detailed-analysis-log-file A log file with detailed analysis logs is written to root of each analyzed workspace.
--reach-disable-analytics Disable reachability analytics sharing with Socket. Also disables caching-based optimizations.
--reach-disable-dependency-downloads Only analyze dependencies that are already installed (e.g. in the project's .venv, vendor directory or module cache). Missing dependencies count as installation failures.
--reach-disable-external-tool-checks Disable external tool checks during reachability analysis.
--reach-ecosystems List of ecosystems to conduct reachability analysis on, as either a comma separated value or as multiple flags. Supported: cargo, composer, gem, golang, maven, npm, nuget, pypi. Defaults to all supported ecosystems.
--reach-enable-analysis-splitting Allow the reachability analysis to partition CVEs into buckets that are processed in separate analysis runs. May improve accuracy, but not recommended by default.
Expand Down
1 change: 1 addition & 0 deletions src/commands/scan/create-scan-from-github.mts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -336,6 +336,7 @@ async function scanOneRepo(
reachDebug: false,
reachDetailedAnalysisLogFile: false,
reachDisableAnalytics: false,
reachDisableDependencyDownloads: false,
reachDisableExternalToolChecks: false,
reachEcosystems: [],
reachEnableAnalysisSplitting: false,
Expand Down
1 change: 1 addition & 0 deletions src/commands/scan/exclude-paths.test.mts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,7 @@ function makeReachOptions(
reachDebug: false,
reachDetailedAnalysisLogFile: false,
reachDisableAnalytics: false,
reachDisableDependencyDownloads: false,
reachDisableExternalToolChecks: false,
reachEcosystems: [],
reachEnableAnalysisSplitting: false,
Expand Down
1 change: 1 addition & 0 deletions src/commands/scan/generate-uv-member-sboms.e2e.test.mts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -243,6 +243,7 @@ describe('uv member scans with the real uv binary', { timeout: 30_000 }, () => {
reachDebug: false,
reachDetailedAnalysisLogFile: false,
reachDisableAnalytics: false,
reachDisableDependencyDownloads: false,
reachDisableExternalToolChecks: false,
reachEcosystems: [],
reachEnableAnalysisSplitting: false,
Expand Down
6 changes: 6 additions & 0 deletions src/commands/scan/handle-create-new-scan.test.mts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -116,6 +116,7 @@ function createConfig(
reachDebug: false,
reachDetailedAnalysisLogFile: false,
reachDisableAnalytics: false,
reachDisableDependencyDownloads: false,
reachDisableExternalToolChecks: false,
reachEcosystems: [],
reachEnableAnalysisSplitting: false,
Expand Down Expand Up @@ -580,6 +581,7 @@ describe('handleCreateNewScan excludePaths', () => {
reachDebug: false,
reachDetailedAnalysisLogFile: false,
reachDisableAnalytics: false,
reachDisableDependencyDownloads: false,
reachDisableExternalToolChecks: false,
reachEcosystems: [],
reachEnableAnalysisSplitting: false,
Expand Down Expand Up @@ -645,6 +647,7 @@ describe('handleCreateNewScan excludePaths', () => {
reachDebug: false,
reachDetailedAnalysisLogFile: false,
reachDisableAnalytics: false,
reachDisableDependencyDownloads: false,
reachDisableExternalToolChecks: false,
reachEcosystems: [],
reachEnableAnalysisSplitting: false,
Expand Down Expand Up @@ -716,6 +719,7 @@ describe('handleCreateNewScan excludePaths', () => {
reachDebug: false,
reachDetailedAnalysisLogFile: false,
reachDisableAnalytics: false,
reachDisableDependencyDownloads: false,
reachDisableExternalToolChecks: false,
reachEcosystems: [],
reachEnableAnalysisSplitting: false,
Expand Down Expand Up @@ -777,6 +781,7 @@ describe('handleCreateNewScan excludePaths', () => {
reachDebug: false,
reachDetailedAnalysisLogFile: false,
reachDisableAnalytics: false,
reachDisableDependencyDownloads: false,
reachDisableExternalToolChecks: false,
reachEcosystems: [],
reachEnableAnalysisSplitting: false,
Expand Down Expand Up @@ -838,6 +843,7 @@ describe('handleCreateNewScan excludePaths', () => {
reachDebug: false,
reachDetailedAnalysisLogFile: false,
reachDisableAnalytics: false,
reachDisableDependencyDownloads: false,
reachDisableExternalToolChecks: false,
reachEcosystems: [],
reachEnableAnalysisSplitting: false,
Expand Down
8 changes: 8 additions & 0 deletions src/commands/scan/handle-scan-reach.test.mts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -130,6 +130,7 @@ describe('handleScanReach', () => {
reachDebug: false,
reachDetailedAnalysisLogFile: false,
reachDisableAnalytics: false,
reachDisableDependencyDownloads: false,
reachDisableExternalToolChecks: false,
reachEcosystems: [],
reachEnableAnalysisSplitting: false,
Expand Down Expand Up @@ -183,6 +184,7 @@ describe('handleScanReach', () => {
reachDebug: false,
reachDetailedAnalysisLogFile: false,
reachDisableAnalytics: false,
reachDisableDependencyDownloads: false,
reachDisableExternalToolChecks: false,
reachEcosystems: [],
reachEnableAnalysisSplitting: false,
Expand Down Expand Up @@ -246,6 +248,7 @@ describe('handleScanReach', () => {
reachDebug: false,
reachDetailedAnalysisLogFile: false,
reachDisableAnalytics: false,
reachDisableDependencyDownloads: false,
reachDisableExternalToolChecks: false,
reachEcosystems: [],
reachEnableAnalysisSplitting: false,
Expand Down Expand Up @@ -295,6 +298,7 @@ describe('handleScanReach', () => {
reachDebug: false,
reachDetailedAnalysisLogFile: false,
reachDisableAnalytics: false,
reachDisableDependencyDownloads: false,
reachDisableExternalToolChecks: false,
reachEcosystems: [],
reachEnableAnalysisSplitting: false,
Expand Down Expand Up @@ -348,6 +352,7 @@ describe('handleScanReach', () => {
reachDebug: false,
reachDetailedAnalysisLogFile: false,
reachDisableAnalytics: false,
reachDisableDependencyDownloads: false,
reachDisableExternalToolChecks: false,
reachEcosystems: [],
reachEnableAnalysisSplitting: false,
Expand Down Expand Up @@ -386,6 +391,7 @@ describe('handleScanReach', () => {
reachDebug: false,
reachDetailedAnalysisLogFile: false,
reachDisableAnalytics: false,
reachDisableDependencyDownloads: false,
reachDisableExternalToolChecks: false,
reachEcosystems: [],
reachEnableAnalysisSplitting: false,
Expand Down Expand Up @@ -437,6 +443,7 @@ describe('handleScanReach', () => {
reachDebug: false,
reachDetailedAnalysisLogFile: false,
reachDisableAnalytics: false,
reachDisableDependencyDownloads: false,
reachDisableExternalToolChecks: false,
reachEcosystems: [],
reachEnableAnalysisSplitting: false,
Expand Down Expand Up @@ -491,6 +498,7 @@ describe('handleScanReach', () => {
reachDebug: false,
reachDetailedAnalysisLogFile: false,
reachDisableAnalytics: false,
reachDisableDependencyDownloads: false,
reachDisableExternalToolChecks: false,
reachEcosystems: [],
reachEnableAnalysisSplitting: false,
Expand Down
4 changes: 4 additions & 0 deletions src/commands/scan/perform-reachability-analysis.mts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,6 +39,7 @@ export type ReachabilityOptions = {
reachContinueOnNoSourceFiles: boolean
reachDebug: boolean
reachDetailedAnalysisLogFile: boolean
reachDisableDependencyDownloads: boolean
reachDisableExternalToolChecks: boolean
reachDisableAnalytics: boolean
reachEcosystems: PURL_Type[]
Expand Down Expand Up @@ -243,6 +244,9 @@ export async function performReachabilityAnalysis(
...(reachabilityOptions.reachDisableAnalytics
? ['--disable-analytics-sharing']
: []),
...(reachabilityOptions.reachDisableDependencyDownloads
? ['--disable-dependency-downloads']
: []),
...(reachabilityOptions.reachDisableExternalToolChecks
? ['--disable-external-tool-checks']
: []),
Expand Down
1 change: 1 addition & 0 deletions src/commands/scan/perform-reachability-analysis.test.mts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -107,6 +107,7 @@ function makeReachabilityOptions(): ReachabilityOptions {
reachContinueOnNoSourceFiles: false,
reachDebug: false,
reachDetailedAnalysisLogFile: false,
reachDisableDependencyDownloads: false,
reachDisableExternalToolChecks: false,
reachDisableAnalytics: false,
reachEcosystems: [],
Expand Down
6 changes: 6 additions & 0 deletions src/commands/scan/reachability-flags.mts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -92,6 +92,12 @@ export const reachabilityFlags: MeowFlags = {
description:
'Deprecated: Analysis splitting is now disabled by default. This flag is a no-op.',
},
reachDisableDependencyDownloads: {
type: 'boolean',
default: false,
description:
"Only analyze dependencies that are already installed (e.g. in the project's .venv, vendor directory or module cache). Missing dependencies count as installation failures.",
},
reachEnableAnalysisSplitting: {
type: 'boolean',
default: false,
Expand Down
Loading