Merge branch 'v1.x' into lelia/add-workspace-support-v1x

Author: lelia

CHANGELOG.md

@@ -4,6 +4,18 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## [1.1.68](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.68) - 2026-03-09
+
+### Changed
+- Updated the Coana CLI to v `14.12.191`.
+
+## [1.1.67](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.67) - 2026-03-06
+
+### Changed
+- Updated `@socketsecurity/socket-patch` to v2.0.0, now powered by a native Rust binary for faster patch operations
+- The `socket patch` command now directly invokes the platform-specific Rust binary instead of a Node.js wrapper
+- Enhanced `socket patch` documentation with a complete subcommand reference and quick-start guide
+
 ## [1.1.66](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.66) - 2026-03-02
 
 ### Changed
@@ -52,7 +64,6 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 - Deprecated `--reach-disable-analysis-splitting` flag (now a no-op for backwards compatibility).
 - Updated the Coana CLI to v `14.12.154`.
 
-
 ## [1.1.57](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.57) - 2026-01-10
 
 ### Changed

README.md

@@ -22,6 +22,38 @@ socket --help
 
 - `socket cdxgen [command]` - Run [cdxgen](https://cyclonedx.github.io/cdxgen/#/?id=getting-started) for SBOM generation
 
+- `socket patch <command>` - Apply, manage, and rollback Socket security patches for vulnerable dependencies
+
+### Patch subcommands
+
+| Command | Description |
+|---------|-------------|
+| `socket patch scan` | Scan installed packages for available security patches |
+| `socket patch get <uuid> --org <slug>` | Download a patch by UUID and store it locally |
+| `socket patch apply` | Apply downloaded patches to `node_modules` |
+| `socket patch rollback [purl\|uuid]` | Rollback patches and restore original files |
+| `socket patch list [--json]` | List all patches in the local manifest |
+| `socket patch remove <purl\|uuid>` | Remove a patch from the manifest (rolls back by default) |
+| `socket patch setup [--yes]` | Add `socket patch apply` to `postinstall` scripts |
+| `socket patch repair` | Download missing blobs and clean up unused blobs |
+
+**Quick start:**
+
+```bash
+# Scan for available patches, download, and apply.
+socket patch scan
+socket patch apply
+
+# Or download a specific patch by UUID.
+socket patch get <uuid> --org <org-slug>
+socket patch apply
+
+# Add to postinstall so patches reapply on npm install.
+socket patch setup --yes
+```
+
+Free patches work without authentication. For paid patches, set `SOCKET_CLI_API_TOKEN` and `SOCKET_CLI_ORG_SLUG`.
+
 ## Aliases
 
 All aliases support the flags and arguments of the commands they alias.

package.json

@@ -1,6 +1,6 @@
 {
   "name": "socket",
-  "version": "1.1.66",
+  "version": "1.1.68",
   "description": "CLI for Socket.dev",
   "homepage": "https://github.com/SocketDev/socket-cli",
   "license": "MIT AND OFL-1.1",
@@ -86,6 +86,9 @@
     "update:deps": "taze",
     "update:socket": "pnpm update '@socketsecurity/*' '@socketregistry/*' --latest"
   },
+  "dependencies": {
+    "@socketsecurity/socket-patch": "2.0.0"
+  },
   "devDependencies": {
     "@babel/core": "7.28.4",
     "@babel/plugin-proposal-export-default-from": "7.27.1",
@@ -94,7 +97,7 @@
     "@babel/preset-typescript": "7.27.1",
     "@babel/runtime": "7.28.4",
     "@biomejs/biome": "2.2.4",
-    "@coana-tech/cli": "14.12.189",
+    "@coana-tech/cli": "14.12.191",
     "@cyclonedx/cdxgen": "11.11.0",
     "@dotenvx/dotenvx": "1.49.0",
     "@eslint/compat": "1.3.2",
@@ -123,7 +126,6 @@
     "@socketsecurity/config": "3.0.1",
     "@socketsecurity/registry": "1.1.17",
     "@socketsecurity/sdk": "1.4.96",
-    "@socketsecurity/socket-patch": "1.2.0",
     "@types/blessed": "0.1.25",
     "@types/cmd-shim": "5.0.2",
     "@types/js-yaml": "4.0.9",

pnpm-lock.yaml

@@ -1,12 +1,15 @@
-import { runPatch } from '@socketsecurity/socket-patch/run'
+import { spawnSync } from 'node:child_process'
+import { existsSync } from 'node:fs'
+import path from 'node:path'
 
 import constants from '../../constants.mts'
 
 import type { CliCommandContext } from '../../utils/meow-with-subcommands.mts'
 
 export const CMD_NAME = 'patch'
 
-const description = 'Manage CVE patches for dependencies'
+const description =
+  'Apply, manage, and rollback Socket security patches for vulnerable dependencies'
 
 const hidden = false
 
@@ -16,42 +19,80 @@ export const cmdPatch = {
   run,
 }
 
+// Resolve the path to the socket-patch binary.
+// The @socketsecurity/socket-patch package registers a bin entry that pnpm
+// links into node_modules/.bin/socket-patch. This launcher script finds and
+// executes the platform-specific Rust binary from the optionalDependencies.
+function resolveSocketPatchBin(): string {
+  // Walk up from this file (or dist/) to find the closest node_modules/.bin.
+  let dir = __dirname
+  for (let i = 0; i < 10; i += 1) {
+    const candidate = path.join(dir, 'node_modules', '.bin', 'socket-patch')
+    if (existsSync(candidate)) {
+      return candidate
+    }
+    const parent = path.dirname(dir)
+    if (parent === dir) {
+      break
+    }
+    dir = parent
+  }
+  // Fallback: assume socket-patch is on PATH.
+  return 'socket-patch'
+}
+
 async function run(
   argv: string[] | readonly string[],
   _importMeta: ImportMeta,
   _context: CliCommandContext,
 ): Promise<void> {
   const { ENV } = constants
 
-  // Map socket-cli environment to socket-patch options.
-  // Only include properties with defined values (exactOptionalPropertyTypes).
-  const options: Parameters<typeof runPatch>[1] = {}
+  // Build environment variables for the socket-patch binary.
+  const spawnEnv: Record<string, string | undefined> = {
+    ...process.env,
+  }
 
+  // Map socket-cli environment to socket-patch environment variables.
   // Strip /v0/ suffix from API URL if present.
   const apiUrl = ENV.SOCKET_CLI_API_BASE_URL?.replace(/\/v0\/?$/, '')
   if (apiUrl) {
-    options.apiUrl = apiUrl
+    spawnEnv['SOCKET_API_URL'] = apiUrl
   }
   if (ENV.SOCKET_CLI_API_TOKEN) {
-    options.apiToken = ENV.SOCKET_CLI_API_TOKEN
+    spawnEnv['SOCKET_API_TOKEN'] = ENV.SOCKET_CLI_API_TOKEN
   }
   if (ENV.SOCKET_CLI_ORG_SLUG) {
-    options.orgSlug = ENV.SOCKET_CLI_ORG_SLUG
+    spawnEnv['SOCKET_ORG_SLUG'] = ENV.SOCKET_CLI_ORG_SLUG
   }
   if (ENV.SOCKET_PATCH_PROXY_URL) {
-    options.patchProxyUrl = ENV.SOCKET_PATCH_PROXY_URL
+    spawnEnv['SOCKET_PATCH_PROXY_URL'] = ENV.SOCKET_PATCH_PROXY_URL
   }
   if (ENV.SOCKET_CLI_API_PROXY) {
-    options.httpProxy = ENV.SOCKET_CLI_API_PROXY
+    spawnEnv['HTTPS_PROXY'] = ENV.SOCKET_CLI_API_PROXY
   }
   if (ENV.SOCKET_CLI_DEBUG) {
-    options.debug = ENV.SOCKET_CLI_DEBUG
+    spawnEnv['SOCKET_PATCH_DEBUG'] = '1'
   }
 
-  // Forward all arguments to socket-patch.
-  const exitCode = await runPatch([...argv], options)
+  // Resolve and spawn the socket-patch Rust binary.
+  // On Windows, node_modules/.bin shims are .cmd scripts that require shell.
+  const binPath = resolveSocketPatchBin()
+  const result = spawnSync(binPath, [...argv], {
+    stdio: 'inherit',
+    env: spawnEnv,
+    shell: constants.WIN32,
+  })
 
-  if (exitCode !== 0) {
-    process.exitCode = exitCode
+  if (result.error) {
+    throw result.error
+  }
+  // Propagate signal if the child was killed (e.g. SIGTERM, SIGINT).
+  if (result.signal) {
+    process.kill(process.pid, result.signal)
+    return
+  }
+  if (result.status !== null && result.status !== 0) {
+    process.exitCode = result.status
   }
 }