Repository navigation
Conversation
`--reach` downloads the analysis engine from storage.googleapis.com through a signed URL from api.socket.dev, then installs the project's dependencies from each ecosystem's registry. None of that was documented, and the registry case fails quietly: the scan completes but reports every affected vulnerability as INSTALL ERROR. Add a "Reachability network access" section to the CLI reference with the hosts, what fails when each is blocked, and proxy behavior, plus a troubleshooting entry for the two failure signatures. Note that 2.11.0 was never published. Bump to 2.11.12 for the version check.
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.
Bugbot Autofix is ON, but none of the reported issues met your autofix severity threshold.
Comment @cursor review or bugbot run to trigger another review on this PR
Reviewed by Cursor Bugbot for commit d9c5dce. Configure here.
The entry only needs the documented network requirements. The note about the 2.11.1 heading and the documentation-only remark describe the PR, not the release.
Contributor
Author
|
bugbot run |
|
Skipping Bugbot: your team's auto mode classified this PR to skip. Visit the Bugbot dashboard to update your settings. |
This branch was previously deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Documents the network access
--reachneeds. None of it is in the docs today, and one failure mode is quiet: with the package registry blocked, the scan completes and reports every affected vulnerability asINSTALL ERROR.docs/cli-reference.md: a "Reachability network access" section after the reachability requirements. It listsapi.socket.dev,storage.googleapis.com(engine download, about 120 MB) and each ecosystem's package registry, what fails when each is blocked, that an npm mirror does not cover the engine, that preinstalled dependencies remove the registry need, and thatHTTPS_PROXYis honored.docs/troubleshooting.md: an entry for the two failure signatures.CHANGELOG.md: a 2.11.12 docs entry, plus a note under 2.11.1 that 2.11.0 was not published.check_versionrequires a bump. Documentation-only otherwise.Verification
Every claim was checked against
socketcli 2.11.11 --reachon an npm test project, with a DNS sidecar that logged and allowlisted hostnames, plus a logging proxy on a network with no other egress:api.socket.dev,storage.googleapis.com,registry.npmjs.orgapi.socket.dev,storage.googleapis.comINSTALL ERRORstorage.googleapis.comblockedFailed to run reachability analysis: HTTPSConnectionPool(host='storage.googleapis.com', ...)HTTPS_PROXYsetPublic Changelog
N/A
Note
Low Risk
Documentation and version metadata only; no changes to scan, reachability, or networking code paths.
Overview
Documents which hosts
--reachmust reach and what breaks when they are blocked, filling a gap where registry failures can finish the scan with every affected finding asINSTALL ERROR.docs/cli-reference.mdadds a Reachability network access section: a table forapi.socket.dev,storage.googleapis.com(~120 MB engine download), and per-ecosystem registries; notes that npm mirrors do not cover the Socket-hosted engine, preinstalled deps skip registry use, warm cache avoids GCS, andHTTPS_PROXYapplies to the CLI, download, and engine.docs/troubleshooting.mdadds matching bullets for the GCS connection error (exit 3) and blanketINSTALL ERRORresults.CHANGELOG.mdrecords 2.11.12 (docs-only) and clarifies that 2.11.0 was never published. Version is bumped to 2.11.12 inpyproject.toml,socketsecurity/__init__.py, anduv.lockfor the release/version check; no runtime behavior changes.Reviewed by Cursor Bugbot for commit d9c5dce. Configure here.