Adds the `--reach-use-only-pregenerated-sboms` flag #138

mtorp · 2025-12-10T13:02:47Z

Adds the --reach-use-only-pregenerated-sboms to the Python CLI. Equivalent to this PR to the npm CLI.
Updates the CLI to 2.2.44

Why?

Public Changelog

N/A

…PDX files from a Tier 1 reachability scan

…d in the final scan

github-actions · 2025-12-10T13:03:31Z

🚀 Preview package published!

Install with:

pip install --index-url https://test.pypi.org/simple/ --extra-index-url https://pypi.org/simple socketsecurity==2.2.48.dev1

Docker image: socketdev/cli:pr-138

…cation. Left the new function in place and just called find_files with the optional params

socket-security · 2025-12-10T14:06:10Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	License
	pypi/pytest@8.4.1 ⏵ 9.0.2	^-3
	pypi/uv@0.8.13 ⏵ 0.9.17	⁺²	⁺³	^-10
	pypi/pre-commit@4.3.0 ⏵ 4.5.0	⁺¹
	pypi/docutils@0.22 ⏵ 0.22.3
	pypi/hatch@1.14.1 ⏵ 1.16.2	^-1
	pypi/coverage@7.10.5 ⏵ 7.13.0	⁺¹
	pypi/hatchling@1.27.0 ⏵ 1.28.0	⁺¹
	pypi/pycparser@2.22 ⏵ 2.23	⁺¹
	pypi/urllib3@2.5.0 ⏵ 2.6.1		⁺²²
	pypi/twine@6.1.0 ⏵ 6.2.0	⁺¹
	pypi/identify@2.6.13 ⏵ 2.6.15	⁺¹
	pypi/charset-normalizer@3.4.3 ⏵ 3.4.4
	pypi/certifi@2025.8.3 ⏵ 2025.11.12
	pypi/python-dotenv@1.1.1 ⏵ 1.2.1	⁺¹
	pypi/pyproject-hooks@1.2.0
	pypi/tomli@2.2.1 ⏵ 2.3.0	⁺¹
	pypi/nh3@0.3.0 ⏵ 0.3.2
	pypi/mdutils@1.8.0 ⏵ 1.8.1
	pypi/typing-extensions@4.14.1 ⏵ 4.15.0	⁺¹
	pypi/ruff@0.12.10 ⏵ 0.14.8	⁺¹			⁺³¹
	pypi/pytest-cov@6.2.1 ⏵ 7.0.0
	pypi/pyyaml@6.0.2 ⏵ 6.0.3
	pypi/platformdirs@4.3.8 ⏵ 4.5.1	⁺¹
	pypi/iniconfig@2.1.0 ⏵ 2.3.0
	pypi/more-itertools@10.7.0 ⏵ 10.8.0	⁺¹
	pypi/pytest-asyncio@1.1.0 ⏵ 1.3.0	⁺¹
	pypi/cfgv@3.4.0 ⏵ 3.5.0	⁺¹
	pypi/pytest-mock@3.14.1 ⏵ 3.15.1	⁺¹
	pypi/wcwidth@0.2.13 ⏵ 0.2.14	⁺¹
	pypi/backports-zstd@1.2.0
	pypi/filelock@3.19.1 ⏵ 3.20.0
	pypi/idna@3.10 ⏵ 3.11
See 2 more rows in the dashboard

View full report

socket-security · 2025-12-10T14:06:12Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		License policy violation: pypi `identify` under AGPL-3.0 License: AGPL-3.0 - the applicable license policy does not allow this license (4) (identify-2.6.15/identify/vendor/licenses.py) License: EPL-1.0 - the applicable license policy does not allow this license (4) (identify-2.6.15/identify/vendor/licenses.py) License: EUPL-1.1 - the applicable license policy does not allow this license (4) (identify-2.6.15/identify/vendor/licenses.py) License: EUPL-1.2 - the applicable license policy does not allow this license (4) (identify-2.6.15/identify/vendor/licenses.py) License: OSL-3.0 - the applicable license policy does not allow this license (4) (identify-2.6.15/identify/vendor/licenses.py) From: uv.lock → `pypi/[email protected]` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `[email protected]`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore pypi/[email protected]`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: pypi `identify` under EUPL-1.2 License: EUPL-1.2 - the applicable license policy does not allow this license (4) (identify/vendor/licenses.py) License: AGPL-3.0 - the applicable license policy does not allow this license (4) (identify/vendor/licenses.py) License: EPL-1.0 - the applicable license policy does not allow this license (4) (identify/vendor/licenses.py) License: EUPL-1.1 - the applicable license policy does not allow this license (4) (identify/vendor/licenses.py) License: OSL-3.0 - the applicable license policy does not allow this license (4) (identify/vendor/licenses.py) From: uv.lock → `pypi/[email protected]` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `[email protected]`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore pypi/[email protected]`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

socket-security-staging · 2025-12-10T14:06:26Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability
	pypi/pytest@8.4.1 ⏵ 9.0.2	^-3
	pypi/pre-commit@4.3.0 ⏵ 4.5.0	⁺¹
	pypi/docutils@0.22 ⏵ 0.22.3
	pypi/hatch@1.14.1 ⏵ 1.16.2	^-1
	pypi/coverage@7.10.5 ⏵ 7.13.0	⁺¹
	pypi/hatchling@1.27.0 ⏵ 1.28.0	⁺¹
	pypi/pycparser@2.22 ⏵ 2.23	⁺¹
	pypi/urllib3@2.5.0 ⏵ 2.6.1		⁺²²
	pypi/identify@2.6.13 ⏵ 2.6.15	⁺¹
	pypi/backports-zstd@1.2.0
	pypi/twine@6.1.0 ⏵ 6.2.0	⁺¹
	pypi/certifi@2025.8.3 ⏵ 2025.11.12
	pypi/python-dotenv@1.1.1 ⏵ 1.2.1	⁺¹
	pypi/pyproject-hooks@1.2.0
	pypi/uv@0.8.13 ⏵ 0.9.17		⁺³
	pypi/tomli@2.2.1 ⏵ 2.3.0	⁺¹
	pypi/nh3@0.3.0 ⏵ 0.3.2
	pypi/mdutils@1.8.0 ⏵ 1.8.1
	pypi/typing-extensions@4.14.1 ⏵ 4.15.0	⁺¹
	pypi/ruff@0.12.10 ⏵ 0.14.8
	pypi/pytest-cov@6.2.1 ⏵ 7.0.0
	pypi/platformdirs@4.3.8 ⏵ 4.5.1	⁺¹
	pypi/iniconfig@2.1.0 ⏵ 2.3.0
	pypi/pyyaml@6.0.2 ⏵ 6.0.3	⁺¹
	pypi/more-itertools@10.7.0 ⏵ 10.8.0	⁺¹
	pypi/pytest-asyncio@1.1.0 ⏵ 1.3.0	⁺¹
	pypi/cfgv@3.4.0 ⏵ 3.5.0	⁺¹
	pypi/pytest-mock@3.14.1 ⏵ 3.15.1	⁺¹
	pypi/wcwidth@0.2.13 ⏵ 0.2.14	⁺¹
	pypi/filelock@3.19.1 ⏵ 3.20.0
	pypi/idna@3.10 ⏵ 3.11
See 1 more rows in the dashboard

View full report

socket-security-staging · 2025-12-10T14:06:28Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		License policy violation: pypi `docutils` License: License :: OSI Approved :: GNU General Public License (GPL) - This license classifier is not allowed by the applicable policy (docutils-0.22.3/PKG-INFO) License: License :: OSI Approved :: GNU General Public License (GPL) - This license classifier is not allowed by the applicable policy (docutils-0.22.3/pyproject.toml) From: uv.lock → `pypi/[email protected]` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `[email protected]`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity-Staging ignore pypi/[email protected]`. You can also ignore all packages with `@SocketSecurity-Staging ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: pypi `docutils` License: License :: OSI Approved :: GNU General Public License (GPL) - This license classifier is not allowed by the applicable policy (docutils-0.22.3.dist-info/METADATA) From: uv.lock → `pypi/[email protected]` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `[email protected]`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity-Staging ignore pypi/[email protected]`. You can also ignore all packages with `@SocketSecurity-Staging ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: pypi `identify` under EPL-1.0 License: EPL-1.0 - the applicable license policy does not allow this license (4) (identify-2.6.15/identify/vendor/licenses.py) License: EUPL-1.1 - the applicable license policy does not allow this license (4) (identify-2.6.15/identify/vendor/licenses.py) License: EUPL-1.2 - the applicable license policy does not allow this license (4) (identify-2.6.15/identify/vendor/licenses.py) License: GPL-2.0+ - the applicable license policy does not allow this license (4) (identify-2.6.15/identify/vendor/licenses.py) License: OFL-1.1 - the applicable license policy does not allow this license (4) (identify-2.6.15/identify/vendor/licenses.py) License: WTFPL - the applicable license policy does not allow this license (4) (identify-2.6.15/identify/vendor/licenses.py) From: uv.lock → `pypi/[email protected]` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `[email protected]`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity-Staging ignore pypi/[email protected]`. You can also ignore all packages with `@SocketSecurity-Staging ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: pypi `identify` under OFL-1.1 License: OFL-1.1 - the applicable license policy does not allow this license (4) (identify/vendor/licenses.py) License: WTFPL - the applicable license policy does not allow this license (4) (identify/vendor/licenses.py) License: EPL-1.0 - the applicable license policy does not allow this license (4) (identify/vendor/licenses.py) License: EUPL-1.1 - the applicable license policy does not allow this license (4) (identify/vendor/licenses.py) License: EUPL-1.2 - the applicable license policy does not allow this license (4) (identify/vendor/licenses.py) License: GPL-2.0+ - the applicable license policy does not allow this license (4) (identify/vendor/licenses.py) From: uv.lock → `pypi/[email protected]` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `[email protected]`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity-Staging ignore pypi/[email protected]`. You can also ignore all packages with `@SocketSecurity-Staging ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

dacoburn · 2025-12-10T15:08:47Z

Made some changes:

Moved the logic from find_sbom_files to find_files
Bumped the SDK requirement to 3.0.22 to handle results with no version for the diff/full scans

mtorp added 3 commits December 10, 2025 13:27

add flag --reach-use-only-pregenerated-sboms to exclude non-CDX and S…

b04025e

…PDX files from a Tier 1 reachability scan

prepare for 2.2.44

c1fa510

ensure only CDX/SPDX manifests and the .socket.facts.json are include…

2838704

…d in the final scan

mtorp requested a review from dacoburn December 10, 2025 13:02

mtorp requested a review from a team as a code owner December 10, 2025 13:02

mtorp requested review from ljharb and nolanlawson and removed request for a team December 10, 2025 13:02

mtorp changed the title ~~Reach use only pregenerated sboms~~ Adds the --reach-use-only-pregenerated-sboms flag Dec 10, 2025

Moved the logic for find_sbom_files to find_files to avoid code dupli…

fb5c18d

…cation. Left the new function in place and just called find_files with the optional params

dacoburn added 3 commits December 10, 2025 06:51

Bumped minimum required SDK version with fix for no version in results

c47a62d

bumped to fixed version of the SDK for no version in results

114b9ad

Upgraded socketdev sdk in lock file

ec682b0

dacoburn approved these changes Dec 10, 2025

View reviewed changes

dacoburn merged commit c2deb21 into main Dec 10, 2025
6 checks passed

dacoburn deleted the reach-use-only-pregenerated-sboms branch December 10, 2025 15:18

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Adds the `--reach-use-only-pregenerated-sboms` flag #138

Adds the `--reach-use-only-pregenerated-sboms` flag #138

Uh oh!

mtorp commented Dec 10, 2025

Uh oh!

github-actions bot commented Dec 10, 2025 •

edited

Loading

Uh oh!

socket-security bot commented Dec 10, 2025 •

edited

Loading

Uh oh!

socket-security bot commented Dec 10, 2025 •

edited

Loading

Uh oh!

socket-security-staging bot commented Dec 10, 2025 •

edited

Loading

Uh oh!

socket-security-staging bot commented Dec 10, 2025 •

edited

Loading

Uh oh!

dacoburn commented Dec 10, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Adds the --reach-use-only-pregenerated-sboms flag #138

Adds the --reach-use-only-pregenerated-sboms flag #138

Uh oh!

Conversation

mtorp commented Dec 10, 2025

Why?

Public Changelog

Uh oh!

github-actions bot commented Dec 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security bot commented Dec 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security bot commented Dec 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security-staging bot commented Dec 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security-staging bot commented Dec 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

dacoburn commented Dec 10, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Adds the `--reach-use-only-pregenerated-sboms` flag #138

Adds the `--reach-use-only-pregenerated-sboms` flag #138

github-actions bot commented Dec 10, 2025 •

edited

Loading

socket-security bot commented Dec 10, 2025 •

edited

Loading

socket-security bot commented Dec 10, 2025 •

edited

Loading

socket-security-staging bot commented Dec 10, 2025 •

edited

Loading

socket-security-staging bot commented Dec 10, 2025 •

edited

Loading