fix(comments): preserve dependency change types

Author: lelia

socketsecurity/core/__init__.py

@@ -2157,16 +2157,22 @@ def create_diff_report(
         alerts_in_removed_packages: Dict[str, List[Issue]] = {}
         alerts_in_unchanged_packages: Dict[str, List[Issue]] = {}
 
-        seen_new_packages = set()
-        seen_removed_packages = set()
+        seen_packages = {
+            "added": set(),
+            "updated": set(),
+            "removed": set(),
+            "replaced": set(),
+        }
 
         for package_id, package in added_packages.items():
             purl = self.create_purl(package_id, added_packages)
             base_purl = f"{purl.ecosystem}/{purl.name}@{purl.version}"
 
-            if (not direct_only or package.direct) and base_purl not in seen_new_packages:
-                diff.new_packages.append(purl)
-                seen_new_packages.add(base_purl)
+            change_type = "updated" if package.diffType == "updated" else "added"
+            target = diff.updated_packages if change_type == "updated" else diff.new_packages
+            if (not direct_only or package.direct) and base_purl not in seen_packages[change_type]:
+                target.append(purl)
+                seen_packages[change_type].add(base_purl)
 
             self.add_package_alerts_to_collection(
                 package=package,
@@ -2178,9 +2184,11 @@ def create_diff_report(
             purl = self.create_purl(package_id, removed_packages)
             base_purl = f"{purl.ecosystem}/{purl.name}@{purl.version}"
 
-            if (not direct_only or package.direct) and base_purl not in seen_removed_packages:
-                diff.removed_packages.append(purl)
-                seen_removed_packages.add(base_purl)
+            change_type = "replaced" if package.diffType == "replaced" else "removed"
+            target = diff.replaced_packages if change_type == "replaced" else diff.removed_packages
+            if (not direct_only or package.direct) and base_purl not in seen_packages[change_type]:
+                target.append(purl)
+                seen_packages[change_type].add(base_purl)
 
             self.add_package_alerts_to_collection(
                 package=package,
@@ -2310,18 +2318,16 @@ def add_purl_capabilities(diff: Diff) -> None:
         Args:
             diff: Diff object to update with capability information
         """
-        new_packages = []
-        for purl in diff.new_packages:
-            if purl.id in diff.new_capabilities:
-                new_purl = Purl(
-                    **{**purl.__dict__,
-                    "capabilities": diff.new_capabilities[purl.id]}
-                )
-                new_packages.append(new_purl)
-            else:
-                new_packages.append(purl)
-
-        diff.new_packages = new_packages
+        for attribute in ("new_packages", "updated_packages"):
+            packages = []
+            for purl in getattr(diff, attribute):
+                if purl.id in diff.new_capabilities:
+                    purl = Purl(
+                        **{**purl.__dict__,
+                        "capabilities": diff.new_capabilities[purl.id]}
+                    )
+                packages.append(purl)
+            setattr(diff, attribute, packages)
 
     def add_package_alerts_to_collection(self, package: Package, alerts_collection: dict, packages: dict) -> dict:
         """

socketsecurity/core/alert_selection.py

@@ -31,7 +31,9 @@ def clone_diff_with_selected_alerts(diff: Diff, selected_alerts: List[Issue]) ->
         removed_alerts=[],
         diff_url=getattr(diff, "diff_url", ""),
         new_packages=getattr(diff, "new_packages", []),
+        updated_packages=getattr(diff, "updated_packages", []),
         removed_packages=getattr(diff, "removed_packages", []),
+        replaced_packages=getattr(diff, "replaced_packages", []),
         packages=getattr(diff, "packages", {}),
     )
     selected_diff.id = getattr(diff, "id", "")

socketsecurity/core/classes.py

@@ -507,7 +507,9 @@ class Diff:
     """
 
     new_packages: list[Purl]
+    updated_packages: list[Purl]
     removed_packages: list[Purl]
+    replaced_packages: list[Purl]
     packages: dict[str, Package]
     new_capabilities: Dict[str, List[str]]
     new_alerts: list[Issue]
@@ -525,8 +527,12 @@ def __init__(self, **kwargs):
                 setattr(self, key, value)
         if not hasattr(self, "new_packages"):
             self.new_packages = []
+        if not hasattr(self, "updated_packages"):
+            self.updated_packages = []
         if not hasattr(self, "removed_packages"):
             self.removed_packages = []
+        if not hasattr(self, "replaced_packages"):
+            self.replaced_packages = []
         if not hasattr(self, "new_alerts"):
             self.new_alerts = []
         if not hasattr(self, "unchanged_alerts"):
@@ -548,8 +554,10 @@ def to_dict(self) -> dict:
         """
         return {
             "new_packages": [p.to_dict() for p in self.new_packages],
+            "updated_packages": [p.to_dict() for p in self.updated_packages],
             "new_capabilities": self.new_capabilities,
             "removed_packages": [p.to_dict() for p in self.removed_packages],
+            "replaced_packages": [p.to_dict() for p in self.replaced_packages],
             "new_alerts": [alert.__dict__ for alert in self.new_alerts],
             "unchanged_alerts": [alert.__dict__ for alert in self.unchanged_alerts] if hasattr(self, "unchanged_alerts") else [],
             "removed_alerts": [alert.__dict__ for alert in self.removed_alerts] if hasattr(self, "removed_alerts") else [],

socketsecurity/core/messages.py

@@ -1268,51 +1268,58 @@ def create_added_table(diff: Diff, md: MdUtils) -> MdUtils:
         num_of_overview_columns = len(overview_table)
 
         count = 0
-        for added in diff.new_packages:
-            added: Purl  # Ensure `added` has scores and relevant attributes.
-
-            package_url = f"[{added.purl}]({added.url})"
-            diff_badge = f"[![+](https://github-app-statics.socket.dev/diff-added.svg)]({added.url})"
-
-            # Scores dynamically converted to badge URLs and linked
-            def score_to_badge(score):
-                score_percent = int(score * 100)  # Convert to integer percentage
-                return f"[![{score_percent}](https://github-app-statics.socket.dev/score-{score_percent}.svg)]({added.url})"
-
-            def get_score_for_badge(score_name: str) -> float:
-                scores = getattr(added, "scores", None)
-                if isinstance(scores, dict):
-                    raw_score = scores.get(score_name)
-                else:
-                    raw_score = getattr(scores, score_name, None) if scores is not None else None
-
-                if raw_score is None:
-                    return 1.0
-
-                score = float(raw_score)
-                if score > 1:
-                    score = score / 100
-                return max(0.0, min(score, 1.0))
-
-            # Generate badges for each score type
-            supply_chain_risk_badge = score_to_badge(get_score_for_badge("supplyChain"))
-            vulnerability_badge = score_to_badge(get_score_for_badge("vulnerability"))
-            quality_badge = score_to_badge(get_score_for_badge("quality"))
-            maintenance_badge = score_to_badge(get_score_for_badge("maintenance"))
-            license_badge = score_to_badge(get_score_for_badge("license"))
-
-            # Add the row for this package
-            row = [
-                diff_badge,
-                package_url,
-                supply_chain_risk_badge,
-                vulnerability_badge,
-                quality_badge,
-                maintenance_badge,
-                license_badge
-            ]
-            overview_table.extend(row)
-            count += 1  # Count total packages
+        changes = (
+            ("Added", diff.new_packages),
+            ("Updated", diff.updated_packages),
+            ("Removed", diff.removed_packages),
+            ("Replaced", diff.replaced_packages),
+        )
+        for change, packages in changes:
+            for package in packages:
+                package: Purl
+
+                package_url = f"[{package.purl}]({package.url})"
+                diff_badge = f"**{change}**"
+
+                # Scores dynamically converted to badge URLs and linked
+                def score_to_badge(score):
+                    score_percent = int(score * 100)  # Convert to integer percentage
+                    return f"[![{score_percent}](https://github-app-statics.socket.dev/score-{score_percent}.svg)]({package.url})"
+
+                def get_score_for_badge(score_name: str) -> float:
+                    scores = getattr(package, "scores", None)
+                    if isinstance(scores, dict):
+                        raw_score = scores.get(score_name)
+                    else:
+                        raw_score = getattr(scores, score_name, None) if scores is not None else None
+
+                    if raw_score is None:
+                        return 1.0
+
+                    score = float(raw_score)
+                    if score > 1:
+                        score = score / 100
+                    return max(0.0, min(score, 1.0))
+
+                # Generate badges for each score type
+                supply_chain_risk_badge = score_to_badge(get_score_for_badge("supplyChain"))
+                vulnerability_badge = score_to_badge(get_score_for_badge("vulnerability"))
+                quality_badge = score_to_badge(get_score_for_badge("quality"))
+                maintenance_badge = score_to_badge(get_score_for_badge("maintenance"))
+                license_badge = score_to_badge(get_score_for_badge("license"))
+
+                # Add the row for this package
+                row = [
+                    diff_badge,
+                    package_url,
+                    supply_chain_risk_badge,
+                    vulnerability_badge,
+                    quality_badge,
+                    maintenance_badge,
+                    license_badge
+                ]
+                overview_table.extend(row)
+                count += 1
 
         # Calculate total rows for table
         num_of_overview_rows = count + 1  # Include header row

socketsecurity/socketcli.py

@@ -850,10 +850,15 @@ def _is_unprocessed(c):
                 if not new_security_comment:
                     log.debug("Security issue comment disabled, or no alerts and none to update")
 
-                # FIXME: diff.new_packages is never populated, neither is removed_packages
+                has_dependency_changes = any((
+                    diff.new_packages,
+                    diff.updated_packages,
+                    diff.removed_packages,
+                    diff.replaced_packages,
+                ))
                 new_overview_comment = should_write_comment(
                     config.disable_overview,
-                    len(diff.new_packages) > 0,
+                    has_dependency_changes,
                     update_old_overview_comment,
                 )
                 if not new_overview_comment:

tests/core/test_diff_generation.py

@@ -95,6 +95,19 @@ def test_create_diff_report(core, diff_input):
     assert hasattr(dp3_purl, "capabilities")
     assert "Environment Variables" in dp3_purl.capabilities
 
+
+def test_create_diff_report_preserves_package_change_types(core, diff_input):
+    added, removed = diff_input
+    added["dp3"].diffType = "updated"
+    removed["dp2"].diffType = "replaced"
+
+    diff = core.create_diff_report(added, removed)
+
+    assert {package.id for package in diff.new_packages} == {"dp4"}
+    assert {package.id for package in diff.updated_packages} == {"dp3"}
+    assert diff.removed_packages == []
+    assert {package.id for package in diff.replaced_packages} == {"dp2"}
+
 def create_input(core):
     # Get two different scans to compare
     head_scan = core.get_full_scan("head")

tests/unit/test_dependency_overview.py

@@ -65,3 +65,21 @@ def test_dependency_overview_template_defaults_missing_or_null_scores(tmp_path,
     assert "score-42.svg" in comment
     assert "score-100.svg" in comment
     assert "score-10000.svg" not in comment
+
+
+def test_dependency_overview_labels_each_change_type(tmp_path, monkeypatch):
+    monkeypatch.chdir(tmp_path)
+    diff = Diff(
+        id="test-diff",
+        diff_url="https://socket.dev/test-diff",
+        new_packages=[_make_purl("added", {})],
+        updated_packages=[_make_purl("updated", {})],
+        removed_packages=[_make_purl("removed", {})],
+        replaced_packages=[_make_purl("replaced", {})],
+        new_alerts=[],
+    )
+
+    comment = Messages.dependency_overview_template(diff)
+
+    for change in ("Added", "Updated", "Removed", "Replaced"):
+        assert f"**{change}**" in comment