Include package changes in JSON reports

[John-David Dalton (jdalton)]

LLM Description written by Codex:GPT-6

---

JSON consumers can read package changes and scores without parsing console output.

• Adds new_packages, updated_packages, removed_packages, and replaced_packages.
• Preserves the existing package fields, raw scores, order, and scan references.
• Documents direct-dependency scope and empty lists for full scans and no-run results.

Why?

The CLI already classifies these package changes but omits them from standard Socket JSON. Exposing the retained lists makes them available to CI integrations. Updated and replaced versions remain separate snapshots; this change does not infer version pairs.

Builds on #402 in the #396 → #398 → #399 → #402 stack.

Validation

40 focused tests pass, including real Core/SDK requests against the approved local HTTP fixture. Scoped Ruff and formatting checks pass. Independent source review found no blocking issues.

Public Changelog

Include package changes and scores in standard Socket JSON reports.

---

Note

Low Risk
Additive JSON fields with empty defaults for full-scan and no-run; no changes to alert blocking, scan APIs, or authentication.

Overview
Standard Socket JSON (--enable-json) now exposes classified dependency changes as four additive arrays: new_packages, updated_packages, removed_packages, and replaced_packages.

build_socket_json_report serializes each Purl via _serialize_package_change, preserving existing package metadata, order, raw API scores (or {} when absent), and deep-copying so JSON mutation does not alter in-memory diff state. Alert selection (--strict-blocking) still only affects new_alerts; package lists are unchanged.

Full-scan inventory, no-run (NO_DIFF_RAN), and non-diff paths keep all four arrays empty (inventory in diff.packages is not promoted into change lists). Docs note direct-deps-by-default scope, separate updated/replaced snapshots (no previousVersion), and that strict JSON consumers may reject new keys.

^{Reviewed by Cursor Bugbot for commit c397151. Configure here.}