add --reach-lazy-mode. update coana to v138 (#998)

* add --reach-lazy-mode. update coana to v138

* add missing option validation

---------

Co-authored-by: John-David Dalton <[email protected]>

Author: mtorp

CHANGELOG.md

@@ -4,6 +4,14 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## [1.1.51](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.51) - 2025-12-23
+
+### Added
+- Added internal `--reach-lazy-mode` flag for reachability analysis.
+
+### Changed
+- Updated the Coana CLI to v `14.12.138`.
+
 ## [1.1.50](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.50) - 2025-12-19
 
 ### Fixed

package.json

@@ -1,6 +1,6 @@
 {
   "name": "socket",
-  "version": "1.1.50",
+  "version": "1.1.51",
   "description": "CLI for Socket.dev",
   "homepage": "https://github.com/SocketDev/socket-cli",
   "license": "MIT AND OFL-1.1",
@@ -94,7 +94,7 @@
     "@babel/preset-typescript": "7.27.1",
     "@babel/runtime": "7.28.4",
     "@biomejs/biome": "2.2.4",
-    "@coana-tech/cli": "14.12.134",
+    "@coana-tech/cli": "14.12.138",
     "@cyclonedx/cdxgen": "11.11.0",
     "@dotenvx/dotenvx": "1.49.0",
     "@eslint/compat": "1.3.2",

pnpm-lock.yaml

@@ -59,6 +59,7 @@ export async function handleCi(autoManifest: boolean): Promise<void> {
       reachDisableAnalytics: false,
       reachEcosystems: [],
       reachExcludePaths: [],
+      reachLazyMode: false,
       reachSkipCache: false,
       reachUseOnlyPregeneratedSboms: false,
       reachVersion: undefined,

src/commands/ci/handle-ci.mts

@@ -243,6 +243,7 @@ async function run(
     reachDebug,
     reachDisableAnalysisSplitting,
     reachDisableAnalytics,
+    reachLazyMode,
     reachSkipCache,
     reachUseOnlyPregeneratedSboms,
     reachVersion,
@@ -273,6 +274,7 @@ async function run(
     reachDebug: boolean
     reachDisableAnalysisSplitting: boolean
     reachDisableAnalytics: boolean
+    reachLazyMode: boolean
     reachSkipCache: boolean
     reachUseOnlyPregeneratedSboms: boolean
     reachVersion: string | undefined
@@ -460,6 +462,7 @@ async function run(
     isUsingNonDefaultTimeout ||
     isUsingNonDefaultVersion ||
     reachDisableAnalysisSplitting ||
+    reachLazyMode ||
     reachSkipCache ||
     reachUseOnlyPregeneratedSboms
 
@@ -575,6 +578,7 @@ async function run(
       reachDisableAnalytics: Boolean(reachDisableAnalytics),
       reachEcosystems,
       reachExcludePaths,
+      reachLazyMode: Boolean(reachLazyMode),
       reachSkipCache: Boolean(reachSkipCache),
       reachUseOnlyPregeneratedSboms: Boolean(reachUseOnlyPregeneratedSboms),
       reachVersion,

src/commands/scan/cmd-scan-create.mts

@@ -127,6 +127,7 @@ async function run(
     reachDebug,
     reachDisableAnalysisSplitting,
     reachDisableAnalytics,
+    reachLazyMode,
     reachSkipCache,
     reachUseOnlyPregeneratedSboms,
     reachVersion,
@@ -143,6 +144,7 @@ async function run(
     reachDebug: boolean
     reachDisableAnalysisSplitting: boolean
     reachDisableAnalytics: boolean
+    reachLazyMode: boolean
     reachSkipCache: boolean
     reachUseOnlyPregeneratedSboms: boolean
     reachVersion: string | undefined
@@ -264,6 +266,7 @@ async function run(
       reachDisableAnalytics: Boolean(reachDisableAnalytics),
       reachEcosystems,
       reachExcludePaths,
+      reachLazyMode: Boolean(reachLazyMode),
       reachSkipCache: Boolean(reachSkipCache),
       reachUseOnlyPregeneratedSboms: Boolean(reachUseOnlyPregeneratedSboms),
       reachVersion,

src/commands/scan/cmd-scan-reach.mts

@@ -257,6 +257,7 @@ async function scanOneRepo(
       reachDisableAnalytics: false,
       reachEcosystems: [],
       reachExcludePaths: [],
+      reachLazyMode: false,
       reachSkipCache: false,
       reachUseOnlyPregeneratedSboms: false,
       reachVersion: undefined,

src/commands/scan/create-scan-from-github.mts

@@ -22,6 +22,7 @@ export type ReachabilityOptions = {
   reachDisableAnalytics: boolean
   reachEcosystems: PURL_Type[]
   reachExcludePaths: string[]
+  reachLazyMode: boolean
   reachSkipCache: boolean
   reachUseOnlyPregeneratedSboms: boolean
   reachVersion: string | undefined
@@ -187,6 +188,7 @@ export async function performReachabilityAnalysis(
     ...(reachabilityOptions.reachExcludePaths.length
       ? ['--exclude-dirs', ...reachabilityOptions.reachExcludePaths]
       : []),
+    ...(reachabilityOptions.reachLazyMode ? ['--lazy-mode'] : []),
     ...(reachabilityOptions.reachSkipCache ? ['--skip-cache-usage'] : []),
     ...(reachabilityOptions.reachUseOnlyPregeneratedSboms
       ? ['--use-only-pregenerated-sboms']

src/commands/scan/perform-reachability-analysis.mts

@@ -55,6 +55,12 @@ export const reachabilityFlags: MeowFlags = {
     description:
       'List of paths to exclude from reachability analysis, as either a comma separated value or as multiple flags.',
   },
+  reachLazyMode: {
+    type: 'boolean',
+    default: false,
+    description: 'Enable lazy mode for reachability analysis.',
+    hidden: true,
+  },
   reachSkipCache: {
     type: 'boolean',
     default: false,