@socketsecurity/cli-with-sentry 1.5.0 → 1.6.0

package/CHANGELOG.md

@@ -4,13 +4,19 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## [1.6.0](https://github.com/SocketDev/socket-cli/releases/tag/v1.6.0) - 2026-10-07
+
+### Added
+- **`manifest`** — attribute direct JVM dependencies to subproject build files (#1581)
+
 ## [1.5.0](https://github.com/SocketDev/socket-cli/releases/tag/v1.5.0) - 2026-10-06
 
 ### Added
 - `socket fix --allow-overrides` fixes a vulnerability that a parent package's version range blocks by writing an override or resolution that forces the fixed version under that parent, in npm, pnpm, Yarn Berry and Rush projects.
+- Socket facts for multi-module Maven, Gradle and sbt builds now attribute each direct dependency to the subproject build files that pull it in, so the dashboard shows which module brought it in.
 
 ### Changed
-- Updated the Coana CLI to v `15.12.0`.
+- Updated the Coana CLI to v `15.12.1`.
 
 ## [1.4.2](https://github.com/SocketDev/socket-cli/releases/tag/v1.4.2) - 2026-10-05
 

package/README.md

@@ -1,8 +1,8 @@
 # Socket CLI
 
 [![Socket Badge](https://socket.dev/api/badge/npm/package/socket)](https://socket.dev/npm/package/socket)
-[![Follow @SocketSecurity](https://raw.githubusercontent.com/SocketDev/socket-cli/v1.5.0/assets/fleet/badge-follow-x.svg)](https://twitter.com/SocketSecurity)
-[![Follow @socket.dev on Bluesky](https://raw.githubusercontent.com/SocketDev/socket-cli/v1.5.0/assets/fleet/badge-follow-bluesky.svg)](https://bsky.app/profile/socket.dev)
+[![Follow @SocketSecurity](https://raw.githubusercontent.com/SocketDev/socket-cli/v1.6.0/assets/fleet/badge-follow-x.svg)](https://twitter.com/SocketSecurity)
+[![Follow @socket.dev on Bluesky](https://raw.githubusercontent.com/SocketDev/socket-cli/v1.6.0/assets/fleet/badge-follow-bluesky.svg)](https://bsky.app/profile/socket.dev)
 
 CLI for [Socket.dev](https://socket.dev) — scan dependencies, audit packages, apply security patches, and gate installs from your terminal or CI. This is the 1.x line of the published `socket` package on npm.
 
@@ -171,8 +171,8 @@ MIT
 <br/>
 <div align="center">
   <picture>
-    <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.5.0/assets/fleet/socket-combomark-dark.svg">
-    <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.5.0/assets/fleet/socket-combomark-light.svg">
-    <img width="324" height="104" alt="Socket" src="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.5.0/assets/fleet/socket-combomark-light.svg">
+    <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.6.0/assets/fleet/socket-combomark-dark.svg">
+    <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.6.0/assets/fleet/socket-combomark-light.svg">
+    <img width="324" height="104" alt="Socket" src="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.6.0/assets/fleet/socket-combomark-light.svg">
   </picture>
 </div>

package/dist/cli.js

@@ -1817,6 +1817,8 @@ function reachMemoryLimitToMb(value) {
 // No sources/targets here: those are local absolute paths, returned in-memory
 // as ResolvedArtifactPaths, never serialized into the SBOM.
 
+// Relative to the facts file's directory.
+
 // Resolved on-disk paths for a --with-files run, keyed by coordinate. `targets`
 // = classpath entries (jars / module output dirs); `sources` = module source
 // roots.
@@ -2697,7 +2699,7 @@ function assembleFacts(parsed, opts = {}) {
   for (const p of parsed.projects.values()) {
     projectsByGav.set(gav(p.group, p.name, p.version), p);
   }
-  const components = buildComponents(finalNodes, projectsByGav);
+  const components = buildComponents(finalNodes, projectsByGav, buildManifestFilesByCoord(parsed, directByRoot, perRoot));
   const projects = opts.emitProjects === false ? [] : buildProjects(parsed, directByRoot, perRoot);
   const metadata = {
     format: 'socket-facts-sbom',
@@ -2806,7 +2808,30 @@ function mergeByCoordinate(perRoot) {
     directByRoot
   };
 }
-function buildComponents(finalNodes, projectsByGav) {
+function buildManifestFilesByCoord(parsed, directByRoot, perRoot) {
+  const buildFilesByCoord = new Map();
+  for (const [rootId, ids] of directByRoot) {
+    const projectKey = perRoot.get(rootId)?.projectKey ?? '';
+    const buildFiles = parsed.projects.get(projectKey)?.buildFiles ?? [];
+    for (const id of ids) {
+      let set = buildFilesByCoord.get(id);
+      if (!set) {
+        set = new Set();
+        buildFilesByCoord.set(id, set);
+      }
+      for (const f of buildFiles) {
+        set.add(f);
+      }
+    }
+  }
+  return new Map([...buildFilesByCoord].map(({
+    0: id,
+    1: buildFiles
+  }) => [id, [constants.default.DOT_SOCKET_DOT_FACTS_JSON, ...[...buildFiles].sort()].map(file => ({
+    file
+  }))]));
+}
+function buildComponents(finalNodes, projectsByGav, manifestFilesByCoord) {
   return [...finalNodes.keys()].sort().map(id => {
     const fn = finalNodes.get(id);
     const c = fn.coord;
@@ -2843,6 +2868,10 @@ function buildComponents(finalNodes, projectsByGav) {
     if (fn.children.size) {
       comp.dependencies = [...fn.children].sort();
     }
+    const manifestFiles = manifestFilesByCoord.get(id);
+    if (manifestFiles) {
+      comp.manifestFiles = manifestFiles;
+    }
     return comp;
   });
 }
@@ -3159,6 +3188,7 @@ function serializeExcludePathPatterns(paths) {
 //   project     projectKey  group  name  version  dir
 //   projectSrc  projectKey  path                         (--with-files only)
 //   projectTgt  projectKey  path                         (--with-files only)
+//   projectBuild  projectKey  path                       (build-root-relative)
 //   root        rootId  projectKey  config  prod(0|1)
 //   node        rootId  coordId  group  name  version  ext  classifier  direct(0|1)
 //   edge        rootId  parentCoordId  childCoordId
@@ -3227,7 +3257,8 @@ function parseRecords(text) {
         version: '',
         dir: '',
         sources: [],
-        targets: []
+        targets: [],
+        buildFiles: []
       };
       result.projects.set(key, p);
     }
@@ -3263,6 +3294,11 @@ function parseRecords(text) {
           project(f[1] ?? '').targets.push(f[2]);
         }
         break;
+      case 'projectBuild':
+        if (f[2]) {
+          project(f[1] ?? '').buildFiles.push(f[2]);
+        }
+        break;
       case 'root':
         {
           const r = root(f[1] ?? '');
@@ -24431,5 +24467,5 @@ process.on('unhandledRejection', async (reason, promise) => {
   // eslint-disable-next-line n/no-process-exit
   process.exit(1);
 });
-//# debugId=49b84e0d-2ad3-4172-ac33-4d007769e3c8
+//# debugId=b7761d71-38de-4772-91bc-d1db319250b4
 //# sourceMappingURL=cli.js.map