Skip to content

Conversation

@mtorp
Copy link
Contributor

@mtorp mtorp commented Dec 23, 2025

  • Update Coana to v 14.12.138
  • Add --reach-lazy-mode flag. It's an experimental JS reachability feature that may improve performance for some users.

Note

Introduces a hidden reachability option for performance experimentation.

  • Adds --reach-lazy-mode flag to reachability flags and plumbs it through cmd-scan-create, cmd-scan-reach, CI, and GitHub scan defaults; forwarded to Coana as --lazy-mode in perform-reachability-analysis
  • Upgrades @coana-tech/cli to 14.12.138; bumps package to 1.1.51 and updates CHANGELOG and lockfile

Written by Cursor Bugbot for commit 90f8a9e. Configure here.

@mtorp mtorp requested a review from jdalton December 23, 2025 10:27
@socket-security
Copy link

socket-security bot commented Dec 23, 2025

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Updatednpm/​@​coana-tech/​cli@​14.12.134 ⏵ 14.12.138891008098100

View full report

@socket-security-staging
Copy link

socket-security-staging bot commented Dec 23, 2025

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Updatednpm/​@​coana-tech/​cli@​14.12.134 ⏵ 14.12.13889 +110080 +198100

View full report

Copy link

@cursor cursor bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Comment @cursor review or bugbot run to trigger another review on this PR

reachDisableAnalytics: Boolean(reachDisableAnalytics),
reachEcosystems,
reachExcludePaths,
reachLazyMode: Boolean(reachLazyMode),
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Missing reachLazyMode in reachability flags validation check

The isUsingAnyReachabilityFlags variable validates that users don't pass reachability flags without also passing --reach. However, the new reachLazyMode flag was not added to this check. Other similar boolean flags like reachDisableAnalysisSplitting, reachSkipCache, and reachUseOnlyPregeneratedSboms are included. Without this addition, users can pass --reach-lazy-mode without --reach and won't receive the expected validation error message telling them to add the --reach flag.

Fix in Cursor Fix in Web

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@mtorp This valid? I do remember the check being there but off the top of my head forget what it was for ☝️

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants