Merge branch 'main' into no-major-upgrades-show-affected-direct-dependencies

Author: mtorp

.config/babel.config.js

@@ -21,7 +21,7 @@ module.exports = {
         version: '^7.27.1',
       },
     ],
-    path.join(babelPluginsPath, 'transform-set-proto-plugin.js'),
-    path.join(babelPluginsPath, 'transform-url-parse-plugin.js'),
+    path.join(babelPluginsPath, 'transform-set-proto-plugin.mjs'),
+    path.join(babelPluginsPath, 'transform-url-parse-plugin.mjs'),
   ],
 }

.config/rollup.base.config.mjs

@@ -14,13 +14,13 @@ import { escapeRegExp } from '@socketsecurity/registry/lib/regexps'
 import { spawnSync } from '@socketsecurity/registry/lib/spawn'
 import { stripAnsi } from '@socketsecurity/registry/lib/strings'
 
-import constants from '../scripts/constants.js'
-import socketModifyPlugin from '../scripts/rollup/socket-modify-plugin.js'
+import constants from '../scripts/constants.mjs'
+import socketModifyPlugin from '../scripts/rollup/socket-modify-plugin.mjs'
 import {
   getPackageName,
   isBuiltin,
   normalizeId,
-} from '../scripts/utils/packages.js'
+} from '../scripts/utils/packages.mjs'
 
 const {
   INLINED_SOCKET_CLI_COANA_TECH_CLI_VERSION,
@@ -109,7 +109,7 @@ export default function baseConfig(extendConfig = {}) {
     ? extendConfig.plugins.slice()
     : []
 
-  const extractedPlugins = { __proto__: null }
+  const extractedPlugins = Object.create(null)
   if (extendPlugins.length) {
     for (const pluginName of [
       'babel',
@@ -138,6 +138,18 @@ export default function baseConfig(extendConfig = {}) {
         id,
         path.isAbsolute(id) ? nmPath.length + 1 : 0,
       )
+      // Externalize anything from the external directory.
+      if (id.includes('/external/') || id.startsWith('../external/')) {
+        return true
+      }
+      // Externalize @socketsecurity/registry and all its internal paths.
+      if (
+        pkgName === '@socketsecurity/registry' ||
+        id.includes('@socketsecurity/registry/external/') ||
+        id.includes('/@socketsecurity+registry@')
+      ) {
+        return true
+      }
       return (
         id.endsWith('.d.cts') ||
         id.endsWith('.d.mts') ||

.config/rollup.dist.config.mjs

@@ -23,13 +23,13 @@ import { naturalCompare } from '@socketsecurity/registry/lib/sorts'
 import { spawn } from '@socketsecurity/registry/lib/spawn'
 
 import baseConfig, { EXTERNAL_PACKAGES } from './rollup.base.config.mjs'
-import constants from '../scripts/constants.js'
-import socketModifyPlugin from '../scripts/rollup/socket-modify-plugin.js'
+import constants from '../scripts/constants.mjs'
+import socketModifyPlugin from '../scripts/rollup/socket-modify-plugin.mjs'
 import {
   getPackageName,
   isBuiltin,
   normalizeId,
-} from '../scripts/utils/packages.js'
+} from '../scripts/utils/packages.mjs'
 
 const {
   CONSTANTS,
@@ -468,12 +468,12 @@ export default async () => {
         cwd: blessedContribSrcPath,
       })
     ).map(filepath => {
-      const relPath = `${path.relative(srcPath, filepath).slice(0, -4 /*.mjs*/)}.js`
+      const relPath = `${path.relative(blessedContribSrcPath, filepath).slice(0, -4 /*.mjs*/)}.js`
       return {
         input: filepath,
         output: [
           {
-            file: path.join(rootPath, relPath),
+            file: path.join(constants.blessedContribPath, relPath),
             exports: 'auto',
             externalLiveBindings: false,
             format: 'cjs',
@@ -500,6 +500,22 @@ export default async () => {
             preferBuiltins: true,
           }),
           jsonPlugin(),
+          // Fix blessed library octal escape sequences
+          {
+            name: 'fix-blessed-octal',
+            transform(code, id) {
+              if (
+                id.includes('blessed') &&
+                (id.includes('tput.js') || id.includes('box.js'))
+              ) {
+                return code
+                  .replace(/ch = '\\200';/g, "ch = '\\x80';")
+                  .replace(/'\\016'/g, "'\\x0E'")
+                  .replace(/'\\017'/g, "'\\x0F'")
+              }
+              return null
+            },
+          },
           commonjsPlugin({
             defaultIsModuleExports: true,
             extensions: ['.cjs', '.js'],

.env.dist

@@ -1,2 +1,3 @@
 LINT_DIST=1
 NODE_COMPILE_CACHE="./.cache"
+NODE_OPTIONS="--max-old-space-size=4096 --max-semi-space-size=512"

.env.local

@@ -1 +1,2 @@
 NODE_COMPILE_CACHE="./.cache"
+NODE_OPTIONS="--max-old-space-size=8192 --max-semi-space-size=1024"

.env.test

@@ -1,2 +1,6 @@
 NODE_COMPILE_CACHE="./.cache"
+NODE_OPTIONS="--max-old-space-size=2048"
+NODE_ENV=test
 VITEST=1
+SOCKET_CLI_DEBUG=false
+DEBUG=false

.github/workflows/provenance.yml.disabled

@@ -11,6 +11,7 @@ on:
         options:
           - '0'
           - '1'
+
 jobs:
   build:
     runs-on: ubuntu-latest
@@ -26,14 +27,28 @@ jobs:
           scope: '@socketsecurity'
       - run: pnpm install
 
+      - name: Ensure npm version 11.5.1+ for trusted publishing
+        run: |
+          NPM_VERSION=$(npm --version)
+          echo "Current npm version: $NPM_VERSION"
+          # Check if npm version is >= 11.5.1
+          if ! npx --yes semver "$NPM_VERSION" -r ">=11.5.1"; then
+            echo "Installing npm 11.5.1+ for trusted publishing..."
+            npm install -g npm@latest
+            echo "Updated npm version: $(npm --version)"
+          else
+            echo "npm version $NPM_VERSION meets the 11.5.1+ requirement for trusted publishing"
+          fi
+
       # Build and publish 'socket' package (default).
       - name: Build socket package
         run: INLINED_SOCKET_CLI_PUBLISHED_BUILD=1 pnpm run build:dist
+        env:
+          SOCKET_CLI_DEBUG: ${{ inputs.debug }}
       - name: Publish socket package
-        run: cd dist && npm publish --provenance --access public --no-git-checks
+        run: cd dist && npm publish --access public --no-git-checks
         continue-on-error: true
         env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
           SOCKET_CLI_DEBUG: ${{ inputs.debug }}
 
       # Build and publish '@socketsecurity/cli' package (legacy).
@@ -42,10 +57,9 @@ jobs:
         env:
           SOCKET_CLI_DEBUG: ${{ inputs.debug }}
       - name: Publish @socketsecurity/cli package
-        run: cd dist && npm publish --provenance --access public --no-git-checks
+        run: cd dist && npm publish --access public --no-git-checks
         continue-on-error: true
         env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
           SOCKET_CLI_DEBUG: ${{ inputs.debug }}
 
       # Build and publish '@socketsecurity/cli-with-sentry' package.
@@ -54,8 +68,7 @@ jobs:
         env:
           SOCKET_CLI_DEBUG: ${{ inputs.debug }}
       - name: Publish @socketsecurity/cli-with-sentry package
-        run: cd dist && npm publish --provenance --access public --no-git-checks
+        run: cd dist && npm publish --access public --no-git-checks
         continue-on-error: true
         env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
           SOCKET_CLI_DEBUG: ${{ inputs.debug }}

.github/workflows/release-sea.yml

@@ -13,24 +13,29 @@ on:
 jobs:
   build-sea:
     strategy:
+      fail-fast: false  # Continue building other platforms if one fails
       matrix:
         include:
+          # Linux builds - fully supported
           - os: ubuntu-latest
             platform: linux
             arch: x64
           - os: ubuntu-latest
             platform: linux
-            arch: arm64
+            arch: arm64    # Cross-compilation, generally stable
+          # macOS builds - fully supported (native compilation)
           - os: macos-latest
             platform: darwin
             arch: x64
           - os: macos-latest
             platform: darwin
             arch: arm64
+          # Windows builds - x64 is stable
           - os: windows-latest
             platform: win32
             arch: x64
-          - os: windows-latest
+          # Windows ARM64 - native ARM64 runner (GitHub Actions 2025)
+          - os: windows-2022-arm64
             platform: win32
             arch: arm64
 
@@ -105,11 +110,17 @@ jobs:
               --draft
           fi
 
-          # Upload binaries
-          for file in dist/sea/socket-*; do
-            echo "Uploading $file..."
-            gh release upload "$VERSION" "$file" --clobber
-          done
+          # Upload binaries (skip if none exist)
+          if ls dist/sea/socket-* 1> /dev/null 2>&1; then
+            for file in dist/sea/socket-*; do
+              echo "Uploading $file..."
+              gh release upload "$VERSION" "$file" --clobber
+            done
+          else
+            echo "⚠️  No binaries found to upload"
+            echo "This may be expected if some platform builds failed"
+            echo "See docs/SEA_PLATFORM_SUPPORT.md for supported platforms"
+          fi
 
   publish-npm:
     needs: upload-release