diff --git a/.gitignore b/.gitignore index e01bafe..990cbcc 100644 --- a/.gitignore +++ b/.gitignore @@ -24,6 +24,8 @@ test.py *.cpython-312.pyc` file_generator.py .coverage +.coverage.* +htmlcov/ .env.local Pipfile test/ diff --git a/CHANGELOG.md b/CHANGELOG.md index 683e0ad..441189c 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,44 @@ # Changelog +## [Unreleased] + +- Migrated license enrichment PURL lookup to the org-scoped endpoint (`POST /v0/orgs/{slug}/purl`) from the deprecated global endpoint (`POST /v0/purl`). + +## 2.2.80 + +- Hardened GitHub Actions workflows. +- Fixed broken links on PyPI page. + +## 2.2.79 + +- Updated minimum required Python version. +- Tweaked CI checks. + +## 2.2.78 + +- Fixed reachability filtering. +- Added config file support. + +## 2.2.77 + +- Fixed `has_manifest_files` failing to match root-level manifest files. + +## 2.2.76 + +- Added SARIF file output support. +- Improved reachability filtering. + +## 2.2.75 + +- Fixed `workspace` flag regression by updating SDK dependency. + +## 2.2.74 + +- Added `--workspace` flag to CLI args. +- Added GitLab branch protection flag. +- Added e2e tests for full scans and full scans with reachability. +- Bumped dependencies: `cryptography`, `virtualenv`, `filelock`, `urllib3`. + ## 2.2.71 - Added `strace` to the Docker image for debugging purposes. diff --git a/pyproject.toml b/pyproject.toml index 6b37502..3a6e9c7 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -6,7 +6,7 @@ build-backend = "hatchling.build" [project] name = "socketsecurity" -version = "2.2.80" +version = "2.2.81" requires-python = ">= 3.11" license = {"file" = "LICENSE"} dependencies = [ @@ -57,7 +57,7 @@ socketcli = "socketsecurity.socketcli:cli" socketclidev = "socketsecurity.socketcli:cli" [project.urls] -Homepage = "https://socket.dev" +Homepage = "https://github.com/SocketDev/socket-python-cli" [tool.coverage.run] source = ["socketsecurity"] diff --git a/socketsecurity/__init__.py b/socketsecurity/__init__.py index 92eb029..d4a1870 100644 --- a/socketsecurity/__init__.py +++ b/socketsecurity/__init__.py @@ -1,3 +1,3 @@ __author__ = 'socket.dev' -__version__ = '2.2.80' +__version__ = '2.2.81' USER_AGENT = f'SocketPythonCLI/{__version__}' diff --git a/socketsecurity/core/__init__.py b/socketsecurity/core/__init__.py index edd2814..154caf9 100644 --- a/socketsecurity/core/__init__.py +++ b/socketsecurity/core/__init__.py @@ -835,6 +835,7 @@ def get_license_text_via_purl(self, packages: dict[str, Package], batch_size: in results = self.sdk.purl.post( license=True, components=batch_components, + org_slug=self.config.org_slug, licenseattrib=True, licensedetails=True ) diff --git a/tests/core/test_package_and_alerts.py b/tests/core/test_package_and_alerts.py index 09a8455..f616479 100644 --- a/tests/core/test_package_and_alerts.py +++ b/tests/core/test_package_and_alerts.py @@ -228,4 +228,41 @@ def test_get_new_alerts_with_readded(self): # With ignore_readded=False new_alerts = Core.get_new_alerts(added_alerts, removed_alerts, ignore_readded=False) - assert len(new_alerts) == 1 + assert len(new_alerts) == 1 + + def test_get_license_text_via_purl_uses_org_scoped_endpoint(self, core, mock_sdk): + """Test license enrichment calls the org-scoped PURL SDK method.""" + core.sdk.purl = Mock() + core.sdk.purl.post.return_value = [ + { + "type": "npm", + "name": "lodash", + "version": "4.18.1", + "licenseAttrib": [{"name": "MIT"}], + "licenseDetails": [{"license": "MIT"}], + } + ] + + packages = { + "npm/lodash@4.18.1": Package( + id="pkg:npm/lodash@4.18.1", + type="npm", + name="lodash", + version="4.18.1", + score={}, + alerts=[], + topLevelAncestors=[], + ) + } + + result = core.get_license_text_via_purl(packages) + + core.sdk.purl.post.assert_called_once_with( + license=True, + components=[{"purl": "pkg:/npm/lodash@4.18.1"}], + org_slug="test-org", + licenseattrib=True, + licensedetails=True, + ) + assert result["npm/lodash@4.18.1"].licenseAttrib == [{"name": "MIT"}] + assert result["npm/lodash@4.18.1"].licenseDetails == [{"license": "MIT"}] diff --git a/tests/e2e/fixtures/simple-npm/package.json b/tests/e2e/fixtures/simple-npm/package.json index cf70416..3dd5fa9 100644 --- a/tests/e2e/fixtures/simple-npm/package.json +++ b/tests/e2e/fixtures/simple-npm/package.json @@ -4,7 +4,7 @@ "description": "Test fixture for reachability analysis", "main": "index.js", "dependencies": { - "lodash": "4.17.23", + "lodash": "4.18.1", "express": "4.22.0", "axios": "1.13.5" },