feat!: migrate patch command to @socketsecurity/socket-patch@1.2.0 #1039
Conversation
Add streaming-based filtering to globWithGitIgnore to prevent heap overflow when scanning large monorepos with 100k+ files. Instead of accumulating all file paths and filtering afterwards, files are now filtered during streaming which dramatically reduces memory usage. Changes: - Add `filter` option to globWithGitIgnore for early filtering during streaming - Add createSupportedFilesFilter helper to create filter from supported files - Update getPackageFilesForScan to use streaming filter Fixes SMO-522 Ported from v1.x commit 9bbb8e8 ([SMO-522] Fix heap overflow in large monorepo scans #1026) Co-authored-by: Mikola Lysenko <mikolalysenko@gmail.com>
BREAKING CHANGE: Replace custom built-in patch implementation with external @socketsecurity/socket-patch package, following the same integration pattern as Coana and SFW. Changes: - Add socket-patch@1.2.0 to external-tools.json - Create socket-patch spawn utility (src/utils/socket-patch/spawn.mts) - Add SOCKET_CLI_SOCKET_PATCH_LOCAL_PATH environment variable support - Replace 30+ custom patch files with simple wrapper that delegates to socket-patch - Move old custom implementation to patch-old/ for reference - Add INLINED_SOCKET_CLI_SOCKET_PATCH_VERSION to env constants BREAKING CHANGE: External tool version getters now throw errors instead of returning empty strings when versions are missing from external-tools.json. This affects getCoanaVersion(), getSwfVersion(), and getSocketPatchVersion(). Benefits: - Consistent external tool integration pattern across CLI - Reduces maintenance burden (socket-patch maintained separately) - Users get socket-patch updates without CLI releases - Simplified codebase (~30 files → 1 wrapper) Ported from v1.x commits: - 44655ac: Use @socketsecurity/socket-patch for patch command (#987) - dfe019d: feat: update @socketsecurity/socket-patch to v1.2.0 (#1030)
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
| // Forward SOCKET_PATCH_PROXY_URL if set. | ||
| if (ENV.SOCKET_PATCH_PROXY_URL) { | ||
| mixinsEnv['SOCKET_PATCH_PROXY_URL'] = ENV.SOCKET_PATCH_PROXY_URL | ||
| } |
There was a problem hiding this comment.
Environment variable never forwarded due to missing definition
Medium Severity
The code attempts to forward SOCKET_PATCH_PROXY_URL to the socket-patch subprocess by accessing ENV.SOCKET_PATCH_PROXY_URL, but this environment variable is never imported or added to the ENV module's snapshot in env.mts. The ENV Proxy only reads from process.env in VITEST mode; in production, it reads from the snapshot where this property doesn't exist. As a result, ENV.SOCKET_PATCH_PROXY_URL is always undefined in production builds, and proxy configuration is never forwarded to socket-patch.
| return { | ||
| ok: true, | ||
| data: spawnResult.stdout?.toString() ?? '', | ||
| } |
There was a problem hiding this comment.
Local socket-patch spawn doesn't wait for process completion
High Severity
The local path case for spawning socket-patch doesn't properly await process completion. spawnNode returns a SpawnResult synchronously (per its type signature), and the result contains a spawnPromise that needs to be awaited to wait for the process to finish. Without awaiting spawnResult.spawnPromise, the function returns ok: true immediately while the subprocess may still be running or may have failed. The dlx case correctly awaits result.spawnPromise, and the similar spawnCoanaDlx function properly awaits the spawn result in its local path case. This could cause socket patch commands to report success before the actual patch operation completes or to miss failures.
Summary
@socketsecurity/socket-patch@1.2.0packageChanges
spawnSocketPatch()utility following the coana/sfw patternBreaking Changes
This migration replaces the built-in custom patch implementation with the external socket-patch package. The functionality remains the same from a user perspective, but the implementation is now delegated to the external package.
Test plan
socket patchcommands work with the external package🤖 Generated with Claude Code
Note
Breaking change:
socket patchnow delegates to external@socketsecurity/socket-patch@1.2.0.cmd-patch.mts) that forwards args to socket-patch; legacy code moved topatch-old/spawnSocketPatch()utility and env support: inline socket-patch version,SOCKET_CLI_SOCKET_PATCH_LOCAL_PATH; export throughconstants/env.mtsexternal-tools.jsonincludes@socketsecurity/socket-patch@1.2.0; bump Coana CLI to14.12.148getCoanaVersion,getSwfVersion,getSocketPatchVersionnow throw if missingglobWithGitIgnoreandcreateSupportedFilesFilter; use during scan file discovery to avoid accumulating all pathsCHANGELOG.mdto reflect migration and memory fixWritten by Cursor Bugbot for commit 2a4e41c. Configure here.