馃摚馃 feat(fix): add opt-in --allow-overrides flag - #1573
Draft
Martin Torp (mtorp) wants to merge 1 commit into
Draft
Martin Torp (mtorp) wants to merge 1 commit into
Martin Torp (mtorp) wants to merge 1 commit into
Conversation
socket fix can now write a package manager override when that is the only way to fix a vulnerability. This happens when a parent package declares a version range that rules out every fixed version of the vulnerable dependency. The flag is off by default. When it is set, socket fix passes --allow-overrides to Coana in both local and CI mode. Coana then writes an npm overrides, pnpm overrides, Yarn Berry resolutions or Rush globalOverrides entry scoped to the blocking parent. The forced version can sit outside the range the parent declares, so the parent should be tested afterwards. Coana only gets the flag when it is set, so runs keep working with Coana versions that do not know it yet.
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
LLM Description written by claude-code:claude-opus-5-5
Summary
This adds an opt-in
--allow-overridesflag tosocket fix. It is off by default.Sometimes the only fix for a vulnerability is blocked because a parent package declares a version range that rules out every fixed version. With the flag set, Coana writes an override or resolution that forces the fixed version under that parent. That is an npm
overrides, pnpm overrides, Yarn Berryresolutionsor RushglobalOverridesentry. The forced version can sit outside the range the parent declares, so the help text tells people to test the parent afterwards.The CLI passes
--allow-overridestocompute-fixes-and-upgrade-purlsin both local mode and CI/PR mode. It only passes it when the flag is set, so runs keep working with the pinned Coana version, which does not know the flag yet.Why
Part of ENG-5422, this PR is ENG-5425. The fix engine side is SocketDev/depscan#27205, which adds
allow_overridesto the/fixesAPI. The Coana CLI side, coana-tech/coana-package-manager#2525, adds--allow-overridestocompute-fixes-and-upgrade-purls.Testing
pnpm build:dist:src, thenpnpm test:unit src/commands/fix/handle-fix-limit.test.mts src/commands/fix/coana-fix-pr-files.test.mts src/commands/fix/coana-fix-dynamic-sbom-inference.test.mts src/commands/fix/handle-fix-id.test.mtspasses (55 tests). New cases check that the flag reaches Coana in local and PR mode and is left out when unset.pnpm test:unit src/commands/fix/cmd-fix.integration.test.mts: the updated--helpsnapshot and the new--allow-overridesdry-run case pass. Two other cases fail on my machine (--autopilot --config {}and a 30s timeout in--ecosystems ... --package-managers). They fail the same way on an untouchedv1.xcheckout, so they are local environment noise.pnpm run check:tscpasses.pnpm run lintpasses with 3 existing warnings on lines this PR does not touch.Follow-ups
@coana-tech/clionce Coana ships a release with--allow-overrides. Until then, setting the flag sends an option the pinned Coana version does not know, so this should merge together with that bump or after it.Expected reviewer effort: Stamp