feat(fix): add --package-managers flag

CHANGELOG.md

@@ -4,6 +4,14 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## [1.1.90](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.90) - 2026-04-30
+
+### Added
+- `socket fix` now accepts a `--package-managers` flag to narrow fix computation to specific package managers within an ecosystem (e.g. only PNPM in a monorepo that mixes pnpm/yarn/npm). Accepts space- or comma-separated values and is case-insensitive. When combined with `--ecosystems`, both filters must match.
+
+### Changed
+- Updated the Coana CLI to v `15.2.0`.
+
 ## [1.1.89](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.89) - 2026-04-30
 
 ### Fixed

package.json

@@ -1,6 +1,6 @@
 {
   "name": "socket",
-  "version": "1.1.89",
+  "version": "1.1.90",
   "description": "CLI for Socket.dev",
   "homepage": "https://github.com/SocketDev/socket-cli",
   "license": "MIT AND OFL-1.1",
@@ -97,7 +97,7 @@
     "@babel/preset-typescript": "7.27.1",
     "@babel/runtime": "7.28.4",
     "@biomejs/biome": "2.2.4",
-    "@coana-tech/cli": "15.1.0",
+    "@coana-tech/cli": "15.2.0",
     "@cyclonedx/cdxgen": "12.1.2",
     "@dotenvx/dotenvx": "1.49.0",
     "@eslint/compat": "1.3.2",

src/commands/fix/cmd-fix.e2e.test.mts

@@ -470,6 +470,171 @@ describe('socket fix (E2E tests)', async () => {
     )
   })
 
+  describe('--package-managers filter', () => {
+    cmdit(
+      ['fix', '--package-managers', 'NPM', '.'],
+      'should fix only the npm-managed artifact when --package-managers NPM is set',
+      async cmd => {
+        const tempFixture = await createTempFixtureCopy('e2e-test-multipm')
+        let stdout = ''
+        let stderr = ''
+        let code = -1
+
+        try {
+          const npmAppDir = path.join(tempFixture.path, 'npm-app')
+          const pnpmAppDir = path.join(tempFixture.path, 'pnpm-app')
+
+          const beforeNpmPkg = await readPackageJson(npmAppDir)
+          const beforePnpmPkg = await readPackageJson(pnpmAppDir)
+
+          expect(beforeNpmPkg.dependencies?.['lodash']).toBe('4.17.20')
+          expect(beforePnpmPkg.dependencies?.['axios']).toBe('0.21.0')
+
+          const result = await spawnSocketCli(binCliPath, cmd, {
+            cwd: tempFixture.path,
+            env: getTestEnv(apiToken),
+          })
+          stdout = result.stdout
+          stderr = result.stderr
+          code = result.code
+
+          if (code !== 0) {
+            logCommandOutput(code, stdout, stderr)
+          }
+
+          expect(code, 'should exit with code 0').toBe(0)
+
+          const afterNpmPkg = await readPackageJson(npmAppDir)
+          const afterPnpmPkg = await readPackageJson(pnpmAppDir)
+
+          // npm-app's lodash should be upgraded.
+          const afterLodash = afterNpmPkg.dependencies?.['lodash']
+          expect(afterLodash).toBeDefined()
+          expect(
+            compareVersions(extractVersion(afterLodash!), '4.17.20'),
+            `lodash should be upgraded from 4.17.20 to ${afterLodash}`,
+          ).toBeGreaterThan(0)
+
+          // pnpm-app's axios should remain unchanged (filtered out by --package-managers NPM).
+          expect(
+            afterPnpmPkg.dependencies?.['axios'],
+            'pnpm-app axios should not be touched when --package-managers NPM is set',
+          ).toBe('0.21.0')
+
+          logger.info(
+            `\n--package-managers NPM upgraded npm-app lodash to ${afterLodash} and left pnpm-app axios untouched`,
+          )
+        } catch (e) {
+          if (code !== 0) {
+            logCommandOutput(code, stdout, stderr)
+          }
+          throw e
+        } finally {
+          await tempFixture.cleanup()
+        }
+      },
+      { timeout: testTimeout },
+    )
+
+    cmdit(
+      ['fix', '--package-managers', 'PNPM', '.'],
+      'should fix only the pnpm-managed artifact when --package-managers PNPM is set',
+      async cmd => {
+        const tempFixture = await createTempFixtureCopy('e2e-test-multipm')
+        let stdout = ''
+        let stderr = ''
+        let code = -1
+
+        try {
+          const npmAppDir = path.join(tempFixture.path, 'npm-app')
+          const pnpmAppDir = path.join(tempFixture.path, 'pnpm-app')
+
+          const beforeNpmPkg = await readPackageJson(npmAppDir)
+          const beforePnpmPkg = await readPackageJson(pnpmAppDir)
+
+          expect(beforeNpmPkg.dependencies?.['lodash']).toBe('4.17.20')
+          expect(beforePnpmPkg.dependencies?.['axios']).toBe('0.21.0')
+
+          const result = await spawnSocketCli(binCliPath, cmd, {
+            cwd: tempFixture.path,
+            env: getTestEnv(apiToken),
+          })
+          stdout = result.stdout
+          stderr = result.stderr
+          code = result.code
+
+          if (code !== 0) {
+            logCommandOutput(code, stdout, stderr)
+          }
+
+          expect(code, 'should exit with code 0').toBe(0)
+
+          const afterNpmPkg = await readPackageJson(npmAppDir)
+          const afterPnpmPkg = await readPackageJson(pnpmAppDir)
+
+          // pnpm-app's axios should be upgraded.
+          const afterAxios = afterPnpmPkg.dependencies?.['axios']
+          expect(afterAxios).toBeDefined()
+          expect(
+            compareVersions(extractVersion(afterAxios!), '0.21.0'),
+            `axios should be upgraded from 0.21.0 to ${afterAxios}`,
+          ).toBeGreaterThan(0)
+
+          // npm-app's lodash should remain unchanged (filtered out by --package-managers PNPM).
+          expect(
+            afterNpmPkg.dependencies?.['lodash'],
+            'npm-app lodash should not be touched when --package-managers PNPM is set',
+          ).toBe('4.17.20')
+
+          logger.info(
+            `\n--package-managers PNPM upgraded pnpm-app axios to ${afterAxios} and left npm-app lodash untouched`,
+          )
+        } catch (e) {
+          if (code !== 0) {
+            logCommandOutput(code, stdout, stderr)
+          }
+          throw e
+        } finally {
+          await tempFixture.cleanup()
+        }
+      },
+      { timeout: testTimeout },
+    )
+
+    cmdit(
+      ['fix', '--package-managers', 'NOT_A_REAL_PM', '.'],
+      'should fail fast with a clear error when --package-managers value is invalid',
+      async cmd => {
+        const tempFixture = await createTempFixtureCopy('e2e-test-multipm')
+        let stdout = ''
+        let stderr = ''
+        let code = -1
+
+        try {
+          const result = await spawnSocketCli(binCliPath, cmd, {
+            cwd: tempFixture.path,
+            env: getTestEnv(apiToken),
+          })
+          stdout = result.stdout
+          stderr = result.stderr
+          code = result.code
+
+          const output = stdout + stderr
+          expect(output).toContain('Invalid package manager')
+          expect(code, 'should exit with non-zero code').not.toBe(0)
+        } catch (e) {
+          if (code === 0) {
+            logCommandOutput(code, stdout, stderr)
+          }
+          throw e
+        } finally {
+          await tempFixture.cleanup()
+        }
+      },
+      { timeout: testTimeout },
+    )
+  })
+
   describe('Python projects', () => {
     cmdit(
       ['fix', '.'],

src/commands/fix/cmd-fix.integration.test.mts

@@ -183,6 +183,7 @@ describe('socket fix', async () => {
             --no-apply-fixes    Compute fixes only, do not apply them. Logs what upgrades would be applied. If combined with --output-file, the output file will contain the upgrades that would be applied.
             --no-major-updates  Do not suggest or apply fixes that require major version updates of direct or transitive dependencies
             --output-file       Path to store upgrades as a JSON file at this path.
+            --package-managers  Limit fix analysis to specific package managers within an ecosystem (e.g. NPM, PNPM, YARN, MAVEN, POETRY). Accepts space- or comma-separated values and is case-insensitive. When combined with --ecosystems, an artifact must satisfy both filters.
             --pr-limit          Maximum number of pull requests to create in CI mode (default 10). Has no effect in local mode.
             --range-style       Define how dependency version ranges are updated in package.json (default 'preserve').
                                 Available styles:
@@ -1127,6 +1128,98 @@ describe('socket fix', async () => {
     )
   })
 
+  describe('--package-managers flag behavior', () => {
+    cmdit(
+      [
+        'fix',
+        FLAG_DRY_RUN,
+        '--package-managers',
+        'NPM',
+        FLAG_CONFIG,
+        '{"apiToken":"fakeToken"}',
+      ],
+      'should accept --package-managers with single value',
+      async cmd => {
+        const { code, stdout } = await spawnSocketCli(binCliPath, cmd)
+        expect(stdout).toMatchInlineSnapshot(`"[DryRun]: Not saving"`)
+        expect(code, 'should exit with code 0').toBe(0)
+      },
+    )
+
+    cmdit(
+      [
+        'fix',
+        FLAG_DRY_RUN,
+        '--package-managers',
+        'npm,pnpm',
+        FLAG_CONFIG,
+        '{"apiToken":"fakeToken"}',
+      ],
+      'should accept --package-managers comma-separated case-insensitive',
+      async cmd => {
+        const { code, stdout } = await spawnSocketCli(binCliPath, cmd)
+        expect(stdout).toMatchInlineSnapshot(`"[DryRun]: Not saving"`)
+        expect(code, 'should exit with code 0').toBe(0)
+      },
+    )
+
+    cmdit(
+      [
+        'fix',
+        FLAG_DRY_RUN,
+        '--package-managers',
+        'NPM',
+        '--package-managers',
+        'PNPM',
+        FLAG_CONFIG,
+        '{"apiToken":"fakeToken"}',
+      ],
+      'should accept multiple --package-managers flags',
+      async cmd => {
+        const { code, stdout } = await spawnSocketCli(binCliPath, cmd)
+        expect(stdout).toMatchInlineSnapshot(`"[DryRun]: Not saving"`)
+        expect(code, 'should exit with code 0').toBe(0)
+      },
+    )
+
+    cmdit(
+      [
+        'fix',
+        FLAG_DRY_RUN,
+        '--package-managers',
+        'FOO',
+        FLAG_CONFIG,
+        '{"apiToken":"fakeToken"}',
+      ],
+      'should fail with invalid --package-managers value',
+      async cmd => {
+        const { code, stderr, stdout } = await spawnSocketCli(binCliPath, cmd)
+        const output = stdout + stderr
+        expect(output).toContain('Invalid package manager')
+        expect(code, 'should exit with non-zero code').not.toBe(0)
+      },
+    )
+
+    cmdit(
+      [
+        'fix',
+        FLAG_DRY_RUN,
+        '--ecosystems',
+        'npm',
+        '--package-managers',
+        'PNPM',
+        FLAG_CONFIG,
+        '{"apiToken":"fakeToken"}',
+      ],
+      'should accept --ecosystems combined with --package-managers',
+      async cmd => {
+        const { code, stdout } = await spawnSocketCli(binCliPath, cmd)
+        expect(stdout).toMatchInlineSnapshot(`"[DryRun]: Not saving"`)
+        expect(code, 'should exit with code 0').toBe(0)
+      },
+    )
+  })
+
   describe('--all flag behavior', () => {
     cmdit(
       ['fix', FLAG_DRY_RUN, '--all', FLAG_CONFIG, '{"apiToken":"fakeToken"}'],