upgrading coana to version 15.10.13 and naming the workspace in reach errors - #1492
Merged
Conversation
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
Martin Torp (mtorp)
force-pushed
the
coana-15.10.13
branch
from
August 12, 2026 08:48
4276028 to
e95a64b
Compare
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
Coana 15.10.8 split the reachability output into a build-root subprojectPath and a per-workspace workspacePath, so a single-root npm monorepo now reports one '.' subproject holding three workspaces. The workspaceDiagnostics assertions still read subprojectPath and failed with [ '.', '.', '.' ] not containing 'packages/package-a'.
Coana 15.10.8 made subprojectPath the build root and moved the workspace to workspacePath, so the per-vulnerability warning printed (.) for every error in a single-root repo instead of the workspace that failed. Label the location the way Coana's own getFullWorkspacePath does.
Martin Torp (mtorp)
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
@coana-tech/clifrom15.10.10to15.10.13.socket scan reachreported every reachability error against the repository root instead of naming the workspace it came from.scan reache2e assertions that the same Coana change invalidated (they had been failing on every PR since, including the bump that shipped1.1.156).## [Unreleased]section.Root cause
Coana
15.10.8restructured the reachability output fromecosystem → workspacetoecosystem → subproject (build root) → workspace, and the two path fields swapped roles:subprojectPathworkspacePath15.10.4packages/package-a).15.10.8.)packages/package-a)Verified against
15.10.13by reading a real.socket.facts.json: three diagnostics entries, allsubprojectPath: '.', withworkspacePathcarrying.,packages/package-a, andpackages/package-b.Production impact
extractReachabilityErrorsstill readsubprojectPath, so the per-vulnerability warning degraded to:getFullWorkspacePathnow labels the location exactly as Coana's own helper of that name does — joining a non-root build root with its workspace, and falling back cleanly when either side is absent (older Coana releases emit noworkspacePath). This regression shipped in1.1.155; it is not new in15.10.13.Test impact
The
workspaceDiagnosticsassertions still readsubprojectPath, so a single-root npm monorepo produced[ '.', '.', '.' ]and failed withexpected [ '.', '.', '.' ] to include 'packages/package-a'in two tests. They now assert workspace identity onworkspacePath, plus that all three workspaces belong to the single.build root.findReachabilityForGhsaalready matched onworkspacePath, so the per-vulnerability assertions were unaffected.Verification
cmd-scan-reach.e2e.test.mts: 9/9 pass against Coana15.10.13(was 7/9), run locally against the real API.coana.test.mts+output-scan-reach.test.mts: 23 pass, including 5 new cases for the labelling helper and an assertion that the warning names the workspace.pnpm run check(lint + type check) passes.Versioning
Per the v1.x release process, this PR does not hand-write a version bump.
package.jsonkeeps the last released number (1.1.156) and thePublish to npm registryworkflow derives the next one from the commits in range — a patch, so1.1.157— writingpackage.json+CHANGELOG.mditself and promoting the## [Unreleased]block verbatim under the new version heading.Coana Changelog
For details on what's included in this Coana release, see the Coana Changelogs.