feat(output): show patched versions in security findings

Author: lelia

socketsecurity/core/messages.py

@@ -4,7 +4,9 @@
 import re
 import uuid
 from datetime import datetime, timezone
+from html import escape
 from pathlib import Path
+
 from mdutils import MdUtils
 from prettytable import PrettyTable
 
@@ -14,6 +16,13 @@
 
 class Messages:
 
+    @staticmethod
+    def get_patched_version(alert: Issue) -> str:
+        """Return the first patched version exposed by an alert, if any."""
+        props = getattr(alert, "props", {}) or {}
+        value = props.get("firstPatchedVersionIdentifier")
+        return str(value) if value not in (None, "") else ""
+
     @staticmethod
     def map_severity_to_sarif(severity: str) -> str:
         """
@@ -857,6 +866,11 @@ def security_comment_template(diff: Diff, config=None) -> str:
             severity_icon = Messages.get_severity_icon(alert.severity)
             action = "Block" if alert.error else "Warn"
             details_open = ""
+            patched_version = Messages.get_patched_version(alert)
+            patched_version_html = (
+                f"<p><strong>Patched version:</strong> <code>{escape(patched_version)}</code></p>"
+                if patched_version else ""
+            )
             # Generate proper manifest URL
             manifest_url = Messages.get_manifest_file_url(diff, alert.manifests, config)
             # Generate a table row for each alert
@@ -877,6 +891,7 @@ def security_comment_template(diff: Diff, config=None) -> str:
     <details {details_open}>
       <summary>{alert.pkg_name}@{alert.pkg_version} - {alert.title}</summary>
       <p><strong>Note:</strong> {alert.description}</p>
+      {patched_version_html}
       <p><strong>Source:</strong> <a href="{manifest_url}">Manifest File</a></p>
       <p>ℹ️ Read more on:
       <a href="{alert.purl}">This package</a> |
@@ -1247,6 +1262,7 @@ def create_console_security_alert_table(diff: Diff) -> PrettyTable:
             [
                 "Alert",
                 "Package",
+                "Patched Version",
                 "url",
                 "Introduced by",
                 "Manifest File",
@@ -1267,6 +1283,7 @@ def create_console_security_alert_table(diff: Diff) -> PrettyTable:
             row = [
                 alert.title,
                 alert.purl,
+                Messages.get_patched_version(alert),
                 alert.url,
                 source_str,
                 manifest_str,

tests/unit/test_messages.py

@@ -0,0 +1,81 @@
+from socketsecurity.core.classes import Diff, Issue
+from socketsecurity.core.messages import Messages
+
+
+def _issue(**kwargs):
+    values = {
+        "pkg_type": "npm",
+        "pkg_name": "example-lib",
+        "pkg_version": "1.4.2",
+        "type": "highCVE",
+        "severity": "high",
+        "title": "High CVE",
+        "description": "A vulnerable dependency.",
+        "suggestion": "Upgrade to a patched release.",
+        "purl": "pkg:npm/example-lib@1.4.2",
+        "url": "https://socket.dev/npm/package/example-lib/overview/1.4.2",
+        "manifests": "package-lock.json",
+        "introduced_by": [["example-lib", "package-lock.json"]],
+        "error": True,
+    }
+    values.update(kwargs)
+    return Issue(**values)
+
+
+def test_console_security_alert_table_includes_patched_version():
+    diff = Diff(
+        new_alerts=[
+            _issue(props={"firstPatchedVersionIdentifier": "1.5.0"}),
+        ]
+    )
+
+    table = Messages.create_console_security_alert_table(diff)
+
+    assert table.field_names == [
+        "Alert",
+        "Package",
+        "Patched Version",
+        "url",
+        "Introduced by",
+        "Manifest File",
+        "CI Status",
+    ]
+    assert table.rows[0][2] == "1.5.0"
+
+
+def test_console_security_alert_table_leaves_missing_patched_version_blank():
+    diff = Diff(
+        new_alerts=[
+            _issue(),
+            _issue(props={}),
+            _issue(props={"firstPatchedVersionIdentifier": None}),
+        ]
+    )
+
+    table = Messages.create_console_security_alert_table(diff)
+
+    assert [row[2] for row in table.rows] == ["", "", ""]
+
+
+def test_security_comment_includes_patched_version_when_available():
+    diff = Diff(
+        new_alerts=[
+            _issue(props={"firstPatchedVersionIdentifier": "1.5.0"}),
+        ],
+        diff_url="https://socket.dev/dashboard/org/acme/diff/before/after",
+    )
+
+    comment = Messages.security_comment_template(diff)
+
+    assert "<strong>Patched version:</strong> <code>1.5.0</code>" in comment
+
+
+def test_security_comment_omits_missing_patched_version():
+    diff = Diff(
+        new_alerts=[_issue(props={})],
+        diff_url="https://socket.dev/dashboard/org/acme/diff/before/after",
+    )
+
+    comment = Messages.security_comment_template(diff)
+
+    assert "Patched version:" not in comment