@socketsecurity/cli-with-sentry 1.14.1 → 1.15.0

package/CHANGELOG.md

@@ -4,6 +4,19 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## [1.15.0](https://github.com/SocketDev/socket-cli/releases/tag/v1.15.0) - 2026-11-12
+
+### Added
+- `socket fix --package-managers` accepts `UV`, to include or leave out uv projects.
+
+### Changed
+- Updated the Coana CLI to v `15.15.0`.
+
+### Fixed
+- When `dotnet restore` fails in one .NET project, the projects it may have skipped as up to date are no longer reported as not restored.
+- Maven Socket facts now include every dependency edge Maven resolves, as Gradle and sbt facts do, so dependency chains show each path to a package. A dependency Maven puts on the runtime classpath is no longer marked as a dev dependency because Maven kept it under a test or provided dependency.
+- With `--ignore-unresolved`, a Maven module with unresolvable version conflicts no longer adds a partial dependency list.
+
 ## [1.14.1](https://github.com/SocketDev/socket-cli/releases/tag/v1.14.1) - 2026-11-06
 
 ### Changed

package/README.md

@@ -1,8 +1,8 @@
 # Socket CLI
 
 [![Socket Badge](https://socket.dev/api/badge/npm/package/socket)](https://socket.dev/npm/package/socket)
-[![Follow @SocketSecurity](https://raw.githubusercontent.com/SocketDev/socket-cli/v1.14.1/assets/fleet/badge-follow-x.svg)](https://twitter.com/SocketSecurity)
-[![Follow @socket.dev on Bluesky](https://raw.githubusercontent.com/SocketDev/socket-cli/v1.14.1/assets/fleet/badge-follow-bluesky.svg)](https://bsky.app/profile/socket.dev)
+[![Follow @SocketSecurity](https://raw.githubusercontent.com/SocketDev/socket-cli/v1.15.0/assets/fleet/badge-follow-x.svg)](https://twitter.com/SocketSecurity)
+[![Follow @socket.dev on Bluesky](https://raw.githubusercontent.com/SocketDev/socket-cli/v1.15.0/assets/fleet/badge-follow-bluesky.svg)](https://bsky.app/profile/socket.dev)
 
 CLI for [Socket.dev](https://socket.dev) — scan dependencies, audit packages, apply security patches, and gate installs from your terminal or CI. This is the 1.x line of the published `socket` package on npm.
 
@@ -57,6 +57,11 @@ socket patch setup --yes
 
 Free patches work without authentication. For paid patches, set `SOCKET_CLI_API_TOKEN` and `SOCKET_CLI_ORG_SLUG`.
 
+`socket login` uses browser OAuth for read-only package, alert, and threat-feed
+access. Open the printed authorization URL manually if a browser does not open.
+Use `socket login --api-token` or `SOCKET_CLI_API_TOKEN` for scans and write
+commands.
+
 ### Aliases
 
 All aliases support the flags and arguments of the commands they alias.
@@ -104,6 +109,26 @@ Socket reachability analysis comes in three forms:
 - **Precomputed reachability** (formerly Tier 2): Determines whether vulnerable code in transitive dependencies is reachable through your direct dependencies, using precomputed static analysis of dependency chains (no access to your application code required). In the CLI this is the fallback used when full application reachability cannot complete (see the `--reach-continue-on-*` flags).
 - **Dependency reachability** (formerly Tier 3): Package-level filtering that detects which dependencies are actually used, so CVEs in unused/dead dependencies can be filtered out.
 
+#### Network access
+
+Full application reachability (`socket scan reach`, `socket scan create --reach`) downloads its analysis engine, the Coana CLI, on first use and installs your project's dependencies to analyze them. On a restricted network, allow:
+
+| Host | Used for | If blocked |
+|---|---|---|
+| `api.socket.dev` | Socket API calls, and a signed URL for the engine download | The command fails |
+| `storage.googleapis.com` | Downloading the engine and its analyzers (about 120 MB) | The command fails with `Failed to get the Coana CLI <version>: getaddrinfo ENOTFOUND storage.googleapis.com` |
+| The package registry of each scanned ecosystem, for example `registry.npmjs.org` | Installing your project's dependencies for analysis | The analysis still completes, but the affected vulnerabilities are reported as `INSTALL ERROR` with no reachability result |
+
+The engine comes from Socket, not npm, so an npm mirror or registry proxy does not cover the engine download. The registry row does not apply when your dependencies are already installed in the scanned directory, for example a `node_modules` directory from an earlier `npm ci`.
+
+The engine is cached in `$XDG_CACHE_HOME/socket/coana` (`~/.cache/socket/coana` by default). Persist that directory between CI runs to skip the download; with a warm cache, `storage.googleapis.com` is not contacted.
+
+**Behind an HTTP(S) proxy**, set `NODE_USE_ENV_PROXY=1` along with `HTTPS_PROXY`. The CLI does not currently route its own requests through `HTTPS_PROXY` or `SOCKET_CLI_API_PROXY`, and fails with `getaddrinfo EAI_AGAIN api.socket.dev`. `NODE_USE_ENV_PROXY=1` (Node.js 22.21 or later) makes Node.js send them through the proxy:
+
+```bash
+HTTPS_PROXY=http://proxy.example.com:3128 NODE_USE_ENV_PROXY=1 socket scan reach .
+```
+
 ### Flags
 
 #### Output flags
@@ -158,7 +183,7 @@ npm exec socket
 ### Development environment variables
 
 - `SOCKET_CLI_API_BASE_URL` - API base URL (default: `https://api.socket.dev/v0/`)
-- `SOCKET_CLI_API_PROXY` - Proxy for API requests (aliases: `HTTPS_PROXY`, `https_proxy`, `HTTP_PROXY`, `http_proxy`)
+- `SOCKET_CLI_API_PROXY` - Proxy for API requests (aliases: `HTTPS_PROXY`, `https_proxy`, `HTTP_PROXY`, `http_proxy`). Currently not applied to API requests; see [Network access](#network-access) for the `NODE_USE_ENV_PROXY=1` workaround
 - `SOCKET_CLI_API_TIMEOUT` - API request timeout in milliseconds
 - `SOCKET_CLI_DEBUG` - Enable debug logging
 - `DEBUG` - Enable [`debug`](https://socket.dev/npm/package/debug) package logging
@@ -170,8 +195,8 @@ MIT
 <br/>
 <div align="center">
   <picture>
-    <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.14.1/assets/fleet/socket-combomark-dark.svg">
-    <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.14.1/assets/fleet/socket-combomark-light.svg">
-    <img width="324" height="104" alt="Socket" src="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.14.1/assets/fleet/socket-combomark-light.svg">
+    <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.15.0/assets/fleet/socket-combomark-dark.svg">
+    <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.15.0/assets/fleet/socket-combomark-light.svg">
+    <img width="324" height="104" alt="Socket" src="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.15.0/assets/fleet/socket-combomark-light.svg">
   </picture>
 </div>