From 933664821eeff5a6d3e3ff6267dd67e33b393dba Mon Sep 17 00:00:00 2001 From: Oskar Haarklou Veileborg Date: Thu, 29 Oct 2026 10:26:05 +0100 Subject: [PATCH] Add --reach-disable-dependency-downloads Forwards Coana's --disable-dependency-downloads (Coana 15.13.1+), which makes reachability analysis use only dependencies that are already installed and report missing ones as install failures. --- CHANGELOG.md | 8 ++++++++ docs/cli-reference.md | 3 ++- pyproject.toml | 2 +- socketsecurity/__init__.py | 2 +- socketsecurity/config.py | 10 ++++++++++ socketsecurity/core/tools/reachability.py | 4 ++++ socketsecurity/socketcli.py | 1 + uv.lock | 2 +- 8 files changed, 28 insertions(+), 4 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 519b1eb..7c034ba 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,13 @@ # Changelog +## 2.11.6 + +### Added: `--reach-disable-dependency-downloads` + +- Reachability analysis uses only dependencies that are already installed (e.g. + in `.venv`, `vendor/` or the module cache), and reports missing ones as + install failures. + ## 2.11.5 ### Changed: bump pinned Coana CLI to 15.13.2 diff --git a/docs/cli-reference.md b/docs/cli-reference.md index 3f913a5..eb71263 100644 --- a/docs/cli-reference.md +++ b/docs/cli-reference.md @@ -219,7 +219,7 @@ socketcli [-h] [--api-token API_TOKEN] [--repo REPO] [--workspace WORKSPACE] [-- [--reach] [--reach-version REACH_VERSION] [--reach-analysis-timeout REACH_ANALYSIS_TIMEOUT] [--reach-analysis-memory-limit REACH_ANALYSIS_MEMORY_LIMIT] [--reach-concurrency REACH_CONCURRENCY] [--reach-ecosystems REACH_ECOSYSTEMS] [--reach-min-severity ] [--reach-skip-cache] [--reach-disable-analytics] [--reach-enable-analysis-splitting] [--reach-detailed-analysis-log-file] - [--reach-use-only-pregenerated-sboms] [--reach-debug] [--reach-disable-external-tool-checks] + [--reach-use-only-pregenerated-sboms] [--reach-debug] [--reach-disable-external-tool-checks] [--reach-disable-dependency-downloads] [--reach-output-file REACH_OUTPUT_FILE] [--only-facts-file] [--version] ```` @@ -352,6 +352,7 @@ If you don't want to provide the Socket API Token every time then you can use th | `--reach-use-only-pregenerated-sboms` | False | False | Build the scan only from pre-generated CycloneDX (CDX) and SPDX files in your project (requires --reach) | | `--reach-debug` | False | False | Enable coana debug output (`--debug`) for the analysis, independent of the global `--enable-debug` | | `--reach-disable-external-tool-checks` | False | False | Disable coana's external tool availability checks (passes `--disable-external-tool-checks`) | +| `--reach-disable-dependency-downloads` | False | False | Only analyze dependencies that are already installed (e.g. in `.venv`, `vendor/` or the module cache); missing ones count as install failures (passes `--disable-dependency-downloads`) | | `--reach-output-file` | False | .socket.facts.json | Path where reachability analysis results should be saved | | `--reach-exclude-paths` | False | | **[DEPRECATED — use `--exclude-paths`]** Comma-separated paths to exclude from reachability analysis. Still honored (unioned with `--exclude-paths`) but will be hidden in a future release | | `--only-facts-file` | False | False | Submit only the .socket.facts.json file when creating the full scan (requires --reach) | diff --git a/pyproject.toml b/pyproject.toml index 91d3751..cf71be4 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -6,7 +6,7 @@ build-backend = "hatchling.build" [project] name = "socketsecurity" -version = "2.11.5" +version = "2.11.6" requires-python = ">= 3.11" license = {"file" = "LICENSE"} dependencies = [ diff --git a/socketsecurity/__init__.py b/socketsecurity/__init__.py index 57088db..812baa9 100644 --- a/socketsecurity/__init__.py +++ b/socketsecurity/__init__.py @@ -1,3 +1,3 @@ __author__ = 'socket.dev' -__version__ = '2.11.5' +__version__ = '2.11.6' USER_AGENT = f'SocketPythonCLI/{__version__}' diff --git a/socketsecurity/config.py b/socketsecurity/config.py index c13dacd..f5e2431 100644 --- a/socketsecurity/config.py +++ b/socketsecurity/config.py @@ -222,6 +222,7 @@ class CliConfig: reach_continue_on_no_source_files: bool = False reach_debug: bool = False reach_disable_external_tool_checks: bool = False + reach_disable_dependency_downloads: bool = False max_purl_batch_size: int = 5000 enable_commit_status: bool = False legal: bool = False @@ -369,6 +370,7 @@ def from_args(cls, args_list: Optional[List[str]] = None) -> 'CliConfig': 'reach_continue_on_no_source_files': args.reach_continue_on_no_source_files, 'reach_debug': args.reach_debug, 'reach_disable_external_tool_checks': args.reach_disable_external_tool_checks, + 'reach_disable_dependency_downloads': args.reach_disable_dependency_downloads, 'max_purl_batch_size': args.max_purl_batch_size, 'enable_commit_status': args.enable_commit_status, 'legal': args.legal or args.legal_format == "fossa", @@ -1223,6 +1225,14 @@ def create_argument_parser() -> argparse.ArgumentParser: help="Disable coana's external tool availability checks during reachability analysis " "(passes --disable-external-tool-checks to the coana CLI)." ) + reachability_group.add_argument( + "--reach-disable-dependency-downloads", + dest="reach_disable_dependency_downloads", + action="store_true", + help="Only analyze dependencies that are already installed (e.g. in the project's .venv, " + "vendor directory or module cache); missing ones count as install failures " + "(passes --disable-dependency-downloads to the coana CLI)." + ) parser.add_argument( '--version', diff --git a/socketsecurity/core/tools/reachability.py b/socketsecurity/core/tools/reachability.py index 80dd15e..4d57392 100644 --- a/socketsecurity/core/tools/reachability.py +++ b/socketsecurity/core/tools/reachability.py @@ -124,6 +124,7 @@ def run_reachability_analysis( continue_on_no_source_files: bool = False, reach_debug: bool = False, disable_external_tool_checks: bool = False, + disable_dependency_downloads: bool = False, ) -> Dict[str, Any]: """ Run reachability analysis. @@ -213,6 +214,9 @@ def run_reachability_analysis( if disable_external_tool_checks: coana_args.append("--disable-external-tool-checks") + if disable_dependency_downloads: + coana_args.append("--disable-dependency-downloads") + if use_only_pregenerated_sboms: coana_args.append("--use-only-pregenerated-sboms") diff --git a/socketsecurity/socketcli.py b/socketsecurity/socketcli.py index 4100b4b..a3213f4 100644 --- a/socketsecurity/socketcli.py +++ b/socketsecurity/socketcli.py @@ -552,6 +552,7 @@ def main_code(): continue_on_no_source_files=config.reach_continue_on_no_source_files, reach_debug=config.reach_debug, disable_external_tool_checks=config.reach_disable_external_tool_checks, + disable_dependency_downloads=config.reach_disable_dependency_downloads, ) log.info("Reachability analysis completed successfully") diff --git a/uv.lock b/uv.lock index 567d6e8..ceec542 100644 --- a/uv.lock +++ b/uv.lock @@ -1332,7 +1332,7 @@ wheels = [ [[package]] name = "socketsecurity" -version = "2.11.5" +version = "2.11.6" source = { editable = "." } dependencies = [ { name = "beautifulsoup4" },