Repository navigation
feat(scan): scope reachability analysis to chosen advisories - #1640
Merged
Martin Torp (mtorp) merged 4 commits intoOct 26, 2026
Merged
Conversation
`--reach-advisories` on `socket scan create --reach` and `socket scan reach` takes GHSA and CVE IDs. CVE IDs are converted to GHSA IDs through the GitHub API, the same way `socket fix --id` does, and an ID that cannot be resolved fails the command. The GHSA IDs go to Coana as `--ghsas`, which only analyzes those advisories and gives every other one unknown reachability.
Move the CVE/GHSA/PURL conversion loop out of `socket fix` into `src/utils/advisory-ids.mts` and have `--reach-advisories` resolution call it. `socket fix --id` keeps its behavior: case-sensitive IDs, PURL support, the same messages and logs, and sequential lookups. The reach path still normalizes case and rejects anything that is not a GHSA or CVE ID before any lookup, then throws on conversion errors. Also drop a `reach ? ... : []` guard in `scan create` that could never take its else branch, since reach flags already require `--reach`.
…ility-for-a-specific-set-o # Conflicts: # CHANGELOG.md # src/commands/scan/cmd-scan-reach.test.mts
Martin Torp (mtorp)
marked this pull request as ready for review
October 26, 2026 16:30
Martin Torp (mtorp)
requested a review
from Benjamin Barslev Nielsen (barslev)
October 26, 2026 16:30
…ility-for-a-specific-set-o # Conflicts: # CHANGELOG.md
Benjamin Barslev Nielsen (barslev)
approved these changes
Oct 26, 2026
Martin Torp (mtorp)
deleted the
martin/tier-1-reachability-for-a-specific-set-o
branch
October 26, 2026 17:30
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
socket scan create --reachandsocket scan reachget a--reach-advisoriesflag that limits reachability analysis to a set of advisories. It takes GHSA and CVE IDs, comma-separated or repeated. Every advisory outside the list gets unknown reachability, and it costs no analysis time.How it works:
resolveReachAdvisories(new,src/commands/scan/reach-advisories.mts) normalizes the IDs, rejects anything that is not a GHSA or CVE ID before any lookup, and converts CVE IDs to GHSA IDs. Socket-mode vulnerabilities in Coana only carry GHSA IDs, so the conversion has to happen here. An ID that is malformed or has no GHSA fails the command with anInputError. Dropping it silently would quietly leave that advisory unanalyzed.--ghsas. Nothing is passed when the flag is not used.scan create, the flag counts as a reach flag, so it needs--reachlike the others.handle-fix.mtsintoresolveAdvisoryIdsinsrc/utils/advisory-ids.mts, and both commands call it.socket fix --idbehaves exactly as before: case-sensitive IDs, PURL support, the same messages and logs, and sequential lookups. The GHSA and CVE format regexps moved toutils/cve-to-ghsa.mts.Coana support for
--ghsaslanded in coana-tech/coana-package-manager#2627 and ships in Coana 15.13.0, whichv1.xnow pins.Tests: unit tests for the ID resolution and for the
--ghsasforwarding, plus updated--helpsnapshots. The Coana PR has a full-cycle test for the analysis side. I have not run the two together against the real API.Expected reviewer effort: High-level design decisions
Note
Medium Risk
Changes reachability CLI behavior and Coana invocation (
--ghsas), with strict fail-fast ID resolution and a dependency on Coana support for advisory scoping.Overview
Adds
--reach-advisoriestosocket scan create --reachandsocket scan reachso reachability analysis can target specific GHSA or CVE IDs (comma-separated or repeated). Advisories outside the list keep unknown reachability instead of being fully analyzed; omitting the flag keeps the current “all advisories” behavior.resolveReachAdvisoriesnormalizes IDs, allows only GHSA/CVE (no PURLs), converts CVEs via GitHub, and fails the command on any bad or unresolvable ID rather than silently skipping. Resolved GHSAs are passed to Coana as--ghsaswhen the list is non-empty. Onscan create, setting advisories counts as a reach modifier and requires--reach.Refactors advisory ID conversion into shared
resolveAdvisoryIds(src/utils/advisory-ids.mts);socket fixnow calls it with the same CVE/GHSA/PURL behavior as before. GHSA/CVE format regexps move tocve-to-ghsa.mts. Changelog documents the flag; tests cover resolution, Coana arg forwarding, and help text.Reviewed by Cursor Bugbot for commit ba8022e. Configure here.