Always omit license details from full-scan diff request#221
Merged
lelia merged 5 commits intoJun 3, 2026
Merged
Conversation
…E-224 follow-on) The full-scan diff request (fullscans.stream_diff) now always sets include_license_details=false, decoupled from the --exclude-license-details flag. This prevents the CE-224 truncation crash (Unterminated string / JSON parse failure on large repos, reported by the tremendous org) from recurring even when the flag is not passed. Why this is safe (no output changes): the license fields the diff endpoint can embed are never consumed off the diff. With --generate-license off, the only consumer (the legal/FOSSA artifact builder) never runs. With --generate-license on, get_license_text_via_purl re-fetches license data from the dedicated PURL endpoint and overwrites whatever the diff embedded before anything reads it. Either way the embedded payload was dead weight that only bloated the response. --exclude-license-details still works but its scope is now narrower: it controls only the dashboard report URL, not the internal diff payload. Help text updated. Core.get_added_and_removed_packages(..., include_license_details=True) remains as an explicit override seam (exercised in tests). Minor bump to 2.4.0: outputs are provably unchanged, but this is a deliberate default-behavior change (2.3.0 made the flag propagate; 2.4.0 makes the lean diff the default), which warrants a minor bump per the project's semver policy. Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>
|
🚀 Preview package published! Install with: pip install --index-url https://test.pypi.org/simple/ --extra-index-url https://pypi.org/simple socketsecurity==2.4.0.dev4Docker image: |
lelia
changed the title
Eric Hibbs (flowstate)
approved these changes
Jun 2, 2026
Collaborator
Eric Hibbs (flowstate)
left a comment
Eric Hibbs (flowstate)
left a comment
There was a problem hiding this comment.
LGTM with one nit:
The CHANGELOG entry could explicitly call out the --exclude-license-details scope narrowing as a "soft breaking change for flag-scripted use."
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
Contributor
Author
Eric Hibbs (@flowstate) fixed in: 970fb55 |
…ude-license-details-flag-not-wired-through-to
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Follow-on PR to the fixes introduced in #211. Now that SocketDev/socket-sdk-python#84 is released as
socketdev v3.1.2, this PR raises the CLI SDK floor tosocketdev>=3.1.2and makes the full-scan diff request (fullscans.stream_diff) always sendinclude_license_details=false.This prevents the large-repo truncation crash (
Unterminated string/ JSON parse failure) from recurring even when the user does not pass--exclude-license-details.Scope of
--exclude-license-details--exclude-license-detailsstill controls the human-facing dashboard report URL (?include_license_details=false), but no longer affects the internal diff payload. The CLI help text and changelog now describe that narrower scope.License artifact output is unchanged:
--generate-licensecontinues to fetch license details from the dedicated PURL endpoint before writing Socket/FOSSA legal artifacts.Versioning
This is a deliberate default-behavior change, so the CLI version is bumped to
2.4.0.Tests
uv run --extra test pytest tests/core/test_sdk_methods.py tests/core/test_package_and_alerts.py tests/unit/test_socketcli.py tests/unit/test_fossa_compat.py -q(55 passed)Fixes: CE-224