@socketsecurity/cli-with-sentry 1.6.2 → 1.7.0

package/CHANGELOG.md

@@ -4,6 +4,13 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## [1.7.0](https://github.com/SocketDev/socket-cli/releases/tag/v1.7.0) - 2026-10-09
+
+### Changed
+- Socket facts for Maven, Gradle and sbt builds are now written per build — `pom.xml.socket.facts.json` (named after the POM Maven runs on, so `-f other-pom.xml` gets its own), `gradle.socket.facts.json` and `sbt.socket.facts.json` — so builds sharing a directory no longer overwrite each other. Delete any `.socket.facts.json` an earlier run left behind.
+- Reachability scans no longer feed a leftover `.socket.facts.json` report from an earlier run back into the analysis.
+- Updated the Coana CLI to v `15.12.4`.
+
 ## [1.6.2](https://github.com/SocketDev/socket-cli/releases/tag/v1.6.2) - 2026-10-09
 
 ### Changed

package/README.md

@@ -1,8 +1,8 @@
 # Socket CLI
 
 [![Socket Badge](https://socket.dev/api/badge/npm/package/socket)](https://socket.dev/npm/package/socket)
-[![Follow @SocketSecurity](https://raw.githubusercontent.com/SocketDev/socket-cli/v1.6.2/assets/fleet/badge-follow-x.svg)](https://twitter.com/SocketSecurity)
-[![Follow @socket.dev on Bluesky](https://raw.githubusercontent.com/SocketDev/socket-cli/v1.6.2/assets/fleet/badge-follow-bluesky.svg)](https://bsky.app/profile/socket.dev)
+[![Follow @SocketSecurity](https://raw.githubusercontent.com/SocketDev/socket-cli/v1.7.0/assets/fleet/badge-follow-x.svg)](https://twitter.com/SocketSecurity)
+[![Follow @socket.dev on Bluesky](https://raw.githubusercontent.com/SocketDev/socket-cli/v1.7.0/assets/fleet/badge-follow-bluesky.svg)](https://bsky.app/profile/socket.dev)
 
 CLI for [Socket.dev](https://socket.dev) — scan dependencies, audit packages, apply security patches, and gate installs from your terminal or CI. This is the 1.x line of the published `socket` package on npm.
 
@@ -171,8 +171,8 @@ MIT
 <br/>
 <div align="center">
   <picture>
-    <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.6.2/assets/fleet/socket-combomark-dark.svg">
-    <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.6.2/assets/fleet/socket-combomark-light.svg">
-    <img width="324" height="104" alt="Socket" src="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.6.2/assets/fleet/socket-combomark-light.svg">
+    <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.7.0/assets/fleet/socket-combomark-dark.svg">
+    <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.7.0/assets/fleet/socket-combomark-light.svg">
+    <img width="324" height="104" alt="Socket" src="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.7.0/assets/fleet/socket-combomark-light.svg">
   </picture>
 </div>

package/dist/cli.js

@@ -1955,15 +1955,13 @@ async function performReachabilityAnalysis(options) {
   }
   const sockSdk = sockSdkCResult.data;
   spinner?.start('Uploading manifests for reachability analysis...');
+  const outputFilePath = outputPath || constants.default.DOT_SOCKET_DOT_FACTS_JSON;
 
   // Ensure uploaded manifest files are relative to analysis target as coana resolves SBOM manifest files relative to this path
-  // NOTE: previously stripped any `.socket.facts.json` from packagePaths
-  // here to avoid uploading leftover post-reachability output. With the
-  // producer flow (`socket manifest gradle --facts`) those files are
-  // legitimate INPUT to compute-artifacts, so we now upload them. Stale
-  // facts files are cleaned up downstream — see the post-success
-  // deletion in handle-create-new-scan.mts.
-  const uploadCResult = await utils.handleApiCall(sockSdk.uploadManifestFiles(orgSlug, packagePaths, {
+  const uploadCResult = await utils.handleApiCall(sockSdk.uploadManifestFiles(orgSlug, packagePaths.filter(p => !utils.isReachabilityReportPath(p, {
+    cwd,
+    outputPath: outputFilePath
+  })), {
     pathsRelativeTo: path.resolve(cwd, analysisTarget)
   }), {
     description: 'upload manifests',
@@ -1991,7 +1989,6 @@ async function performReachabilityAnalysis(options) {
   spinner?.success(`Manifests uploaded successfully. Tar hash: ${tarHash}`);
   spinner?.start();
   spinner?.infoAndStop('Running reachability analysis with Coana...');
-  const outputFilePath = outputPath || constants.default.DOT_SOCKET_DOT_FACTS_JSON;
 
   // Temp file for --compute-artifacts-sidecar, removed in the finally below.
   // Written even when empty under dynamicSbomInference, since the
@@ -2282,6 +2279,15 @@ const BUILD_TOOL_WRAPPER = {
   maven: 'mvnw'
 };
 
+// Gradle (8+) and sbt hold one build per directory; Maven builds are addressed
+// by POM file, so `mvn -f other-pom.xml` puts a second build in the directory.
+const ADDRESSED_BY_FILE = {
+  __proto__: null,
+  gradle: false,
+  maven: true,
+  sbt: false
+};
+
 // sbt happily runs in any directory, synthesizing a default project from its
 // name, so an sbt run outside a build yields a plausible but bogus SBOM. Maven
 // and Gradle refuse such a directory themselves.
@@ -2299,6 +2305,14 @@ function resolveBuildToolBin(tool, projectDir, bin) {
   return DEFAULT_BUILD_TOOL_BIN[tool];
 }
 
+// Distinct for every build sharing a directory.
+function socketFactsFileName(tool, entryFile) {
+  if (!ADDRESSED_BY_FILE[tool]) {
+    return `${tool}${constants.default.DOT_SOCKET_DOT_FACTS_JSON}`;
+  }
+  return entryFile ? `${path.basename(entryFile)}${constants.default.DOT_SOCKET_DOT_FACTS_JSON}` : undefined;
+}
+
 // Gradle's variant-aware resolver: distinct exceptions give mutually-exclusive
 // phrasing, so most-specific-first substring checks classify reliably.
 function classifyGradleFailure(detail) {
@@ -2656,7 +2670,7 @@ function renderResolutionErrorReport(failures, scannedConfigs = [], tool = 'grad
 }
 
 const PURL_TYPE_MAVEN = 'maven';
-function assembleFacts(parsed, opts = {}) {
+function assembleFacts(parsed, opts) {
   const fileExists = opts.fileExists ?? fs$1.existsSync;
   const perRoot = buildPerRoot(parsed);
   const {
@@ -2664,7 +2678,7 @@ function assembleFacts(parsed, opts = {}) {
     finalNodes
   } = mergeById(perRoot);
   const tool = parsed.tool || 'gradle';
-  const components = buildComponents(finalNodes, buildManifestFilesById(parsed, directByRoot, perRoot));
+  const components = buildComponents(finalNodes, buildManifestFilesById(parsed, directByRoot, perRoot, opts.factsFileName));
   const projects = opts.emitProjects === false ? [] : buildProjects(parsed, directByRoot, perRoot);
   const metadata = {
     format: 'socket-facts-sbom',
@@ -2789,7 +2803,7 @@ function mergeById(perRoot) {
     directByRoot
   };
 }
-function buildManifestFilesById(parsed, directByRoot, perRoot) {
+function buildManifestFilesById(parsed, directByRoot, perRoot, factsFileName) {
   const buildFilesByCoord = new Map();
   for (const [rootId, ids] of directByRoot) {
     const root = perRoot.get(rootId);
@@ -2813,7 +2827,7 @@ function buildManifestFilesById(parsed, directByRoot, perRoot) {
   return new Map([...buildFilesByCoord].map(({
     0: id,
     1: buildFiles
-  }) => [id, [constants.default.DOT_SOCKET_DOT_FACTS_JSON, ...[...buildFiles].sort()].map(file => ({
+  }) => [id, [...(factsFileName ? [factsFileName] : []), ...[...buildFiles].sort()].map(file => ({
     file
   }))]));
 }
@@ -3128,6 +3142,7 @@ function serializeExcludePathPatterns(paths) {
 //
 //   meta        tool  toolVersion  javaVersion
 //   buildRoot   path                                     (absolute; the facts file's directory)
+//   entry       path                                     (file-addressed builds; build-root-relative)
 //   project     projectKey  group  name  version  dir
 //   projectSrc  projectKey  path                         (--with-files only)
 //   projectTgt  projectKey  path                         (--with-files only)
@@ -3173,6 +3188,7 @@ function parseRecords(text) {
     toolVersion: '',
     javaVersion: '',
     buildRoot: '',
+    entry: '',
     projects: new Map(),
     roots: new Map(),
     scannedConfigs: [],
@@ -3228,6 +3244,9 @@ function parseRecords(text) {
       case 'buildRoot':
         result.buildRoot = f[1] ?? '';
         break;
+      case 'entry':
+        result.entry = f[1] ?? '';
+        break;
       case 'project':
         {
           const p = project(f[1] ?? '');
@@ -3392,18 +3411,22 @@ async function writeSbtPlugin(globalBase, sourceFilename, destFilename) {
   });
   await fs$1.promises.writeFile(path.join(pluginsDir, destFilename), src);
 }
-async function assembleFromRecords(out, recordsFile) {
+async function assembleFromRecords(tool, out, recordsFile) {
   const text = fs$1.existsSync(recordsFile) ? await fs$1.promises.readFile(recordsFile, 'utf8') : '';
   const parsed = parseRecords(text);
+  const factsFileName = socketFactsFileName(tool, parsed.entry || undefined);
   const {
     artifactPaths,
     facts,
     report
-  } = assembleFacts(parsed);
+  } = assembleFacts(parsed, {
+    factsFileName
+  });
   return {
     buildRoot: parsed.buildRoot || undefined,
     code: out.code,
     facts,
+    factsFileName,
     report,
     artifactPaths,
     stderr: out.stderr,
@@ -3476,7 +3499,7 @@ async function invokeGradle(opts, initScriptFilename, task, tmpDirPrefix) {
     // resolvedConfiguration API and shared accumulator aren't cache-safe.
     const args = ['--init-script', initScript, '-Dorg.gradle.configuration-cache=false', `-Psocket.recordsFile=${recordsFile}`, ...commonProps(opts, '-P'), ...(opts.toolOpts ?? []), task, '--no-daemon', '--console=plain'];
     const out = await runNeverThrow(bin, args, opts);
-    return await assembleFromRecords(out, recordsFile);
+    return await assembleFromRecords('gradle', out, recordsFile);
   });
 }
 async function runGradle(opts) {
@@ -3502,7 +3525,7 @@ async function invokeSbtIn(globalBase, opts, pluginSourceFilename, pluginDestFil
   const javaHomeOpt = javaHome && !(opts.toolOpts ?? []).includes('--java-home') ? ['--java-home', javaHome] : [];
   const args = [...javaHomeOpt, ...props, ...(opts.toolOpts ?? []), '--batch', task];
   const out = await runNeverThrow(bin, args, opts);
-  return await assembleFromRecords(out, recordsFile);
+  return await assembleFromRecords('sbt', out, recordsFile);
 }
 async function runSbt(opts) {
   const run = globalBase => invokeSbtIn(globalBase, opts, 'socket-facts.plugin.scala', SBT_FACTS_PLUGIN_FILENAME, FACTS_TASK);
@@ -3529,7 +3552,7 @@ async function invokeMaven(opts, coanaTask, tmpDirPrefix) {
     const props = [`-Dmaven.ext.class.path=${jarPath}`, `-Dcoana.task=${coanaTask}`, `-Dsocket.recordsFile=${recordsFile}`, ...commonProps(opts, '-D')];
     const args = [...props, ...(opts.toolOpts ?? []), '--batch-mode', 'validate'];
     const out = await runNeverThrow(bin, args, opts);
-    return await assembleFromRecords(out, recordsFile);
+    return await assembleFromRecords('maven', out, recordsFile);
   });
 }
 async function runMaven(opts) {
@@ -3552,8 +3575,9 @@ function tailBuildOutput(stdout, stderr) {
 // `process.exitCode`, which can already be non-zero for an unrelated reason.
 
 // Runs the bundled build-tool resolution script for a JVM project and writes
-// `.socket.facts.json`. `withFiles` (reachability only) additionally folds
-// resolved artifact paths into `sidecarAcc`. A blocking resolution failure sets
+// its `<entry>.socket.facts.json` (see socketFactsFileName). `withFiles`
+// (reachability only) additionally folds resolved artifact paths into
+// `sidecarAcc`. A blocking resolution failure sets
 // a non-zero exit code and returns (matching the `--pom` generator) unless
 // `ignoreUnresolved`; a crashed build — a process failure, not an unresolved
 // dependency — always fails.
@@ -3639,6 +3663,7 @@ async function runManifestFacts({
     buildRoot,
     code,
     facts,
+    factsFileName,
     report,
     stderr,
     stdout
@@ -3697,14 +3722,20 @@ async function runManifestFacts({
     logger.logger.warn(`No resolvable ${ecosystem} dependencies found; nothing to upload.`);
     return;
   }
-  if (!buildRoot) {
+  if (!buildRoot || !factsFileName) {
     process.exitCode = 1;
-    logger.logger.fail(`The ${ecosystem} build did not report its root directory, so its Socket facts file cannot be placed.`);
+    logger.logger.fail(`The ${ecosystem} build did not report its ${buildRoot ? 'entry build file' : 'root directory'}, so its Socket facts file cannot be placed.`);
     return null;
   }
   // Every path in the facts is relative to the build root, which `-f`/`-p`
   // can move away from cwd.
-  const factsPath = path.join(buildRoot, constants.default.DOT_SOCKET_DOT_FACTS_JSON);
+  const factsPath = path.join(buildRoot, factsFileName);
+  // Not a name producers write, so a copy here is stale and would be uploaded
+  // alongside the new file.
+  const legacyFactsPath = path.join(buildRoot, constants.default.DOT_SOCKET_DOT_FACTS_JSON);
+  if (fs$1.existsSync(legacyFactsPath)) {
+    logger.logger.warn(`Found \`${legacyFactsPath}\`, which is uploaded alongside \`${factsFileName}\`. Delete it if an earlier \`socket manifest\` run left it behind.`);
+  }
   const socketCliVersion = constants.default.ENV.INLINED_SOCKET_CLI_VERSION;
   if (facts.metadata && socketCliVersion) {
     facts.metadata.socketCliVersion = socketCliVersion;
@@ -6385,7 +6416,8 @@ async function extractBazelToMaven(opts) {
   }
 }
 
-// Generates `.socket.facts.json` for a Gradle project via the bundled init script.
+// Generates `gradle.socket.facts.json` for a Gradle project via the bundled
+// init script.
 async function convertGradleToFacts({
   bin,
   cwd,
@@ -6415,7 +6447,8 @@ async function convertGradleToFacts({
   });
 }
 
-// Generates `.socket.facts.json` for a Maven project via the bundled extension.
+// Generates `pom.xml.socket.facts.json` (named after the POM Maven runs on)
+// for a Maven project via the bundled extension.
 async function convertMavenToFacts({
   bin,
   cwd,
@@ -6445,7 +6478,7 @@ async function convertMavenToFacts({
   });
 }
 
-// Generates `.socket.facts.json` for an sbt project via the bundled sbt plugin.
+// Generates `sbt.socket.facts.json` for an sbt project via the bundled sbt plugin.
 // sbt 0.13/early 1.x can't run on modern JDKs — pass a compatible JDK via
 // `--sbt-opts "--java-home <path>"` or `JAVA_HOME`.
 async function convertSbtToFacts({
@@ -7342,12 +7375,12 @@ async function createNewScan({
         logger.logger.success('Reachability analysis completed successfully');
         reachabilityReport = reachResult.data?.reachabilityReport;
 
-        // When using only pre-generated SBOMs, build the scan from those inputs —
-        // CycloneDX, SPDX, and Socket facts — matching Coana's
-        // `--use-only-pregenerated-sboms` selection. Otherwise drop every facts
-        // file; coana's fresh reachability report (appended below) is the
-        // authoritative facts file for the scan.
-        const pathsForScan = reach.reachUseOnlyPregeneratedSboms ? filterToPregeneratedSboms(packagePaths, supportedFiles) : packagePaths.filter(p => !utils.isSocketFactsFile(p));
+        // Mirror the SBOM inputs Coana analyzed; otherwise its fresh report
+        // (appended below) supersedes every facts file.
+        const pathsForScan = reach.reachUseOnlyPregeneratedSboms ? filterToPregeneratedSboms(packagePaths, supportedFiles).filter(p => !utils.isReachabilityReportPath(p, {
+          cwd,
+          outputPath: constants.default.DOT_SOCKET_DOT_FACTS_JSON
+        })) : packagePaths.filter(p => !utils.isSocketFactsFile(p));
 
         // Append coana's reachability report, but not twice: a pre-generated facts
         // input can resolve to the same path coana wrote its report to.
@@ -7396,17 +7429,8 @@ async function createNewScan({
       logger.logger.warn('Reachability analysis ran but no full application reachability scan ID was found; skipping reachability finalize. The scan was created but its reachability report was not linked.');
     }
 
-    // On a successful scan, clean up the `.socket.facts.json` coana wrote at
-    // the path we instructed it to write to (via `--socket-mode`). Failed
-    // scans leave the file in place for debugging. Producer-written files
-    // (e.g. from `socket manifest gradle --facts`) are NOT touched here —
-    // those are user-owned input that the user can clean up themselves; in
-    // the --reach path coana overwrites that file with its enriched output
-    // anyway, so it's the same path that gets removed. `--reach-retain-facts-file`
-    // opts out of this cleanup so the report can be inspected; the user is then
-    // responsible for deleting it before the next full application reachability
-    // scan (a stale file is picked up as pre-generated input and would make those
-    // results unreliable).
+    // A scan without --reach would upload a leftover report as an SBOM with
+    // stale reachability results; a failed scan keeps it for debugging.
     if (fullScanCResult.ok && scanId && reachabilityReport && !reach.reachRetainFactsFile) {
       try {
         await fs.unlink(path.resolve(cwd, reachabilityReport));
@@ -9897,7 +9921,7 @@ const reachabilityFlags = {
   reachRetainFactsFile: {
     type: 'boolean',
     default: false,
-    description: 'Keep the `.socket.facts.json` reachability report that the analysis writes to the scan directory instead of deleting it after a successful scan. IMPORTANT: you must delete this file before running a fresh full application reachability scan. A stale `.socket.facts.json` left in place is picked up as a pre-generated input and silently overrides fresh analysis, so the new scan results will not be reliable.'
+    description: 'Keep the `.socket.facts.json` reachability report that the analysis writes to the scan directory instead of deleting it after a successful scan. Delete it once inspected: later reachability scans ignore it, but a scan without --reach uploads it as an SBOM carrying stale reachability results.'
   },
   reachSkipCache: {
     type: 'boolean',
@@ -12904,7 +12928,10 @@ const config$d = {
       $ ${command} [options] [CWD=.]
 
     Recursively walks CWD, discovers independent gradle, sbt, and maven build
-    roots, and generates a Socket facts SBOM (.socket.facts.json) for each,
+    roots, and generates a Socket facts SBOM for each
+    (pom.xml.socket.facts.json, gradle.socket.facts.json, or
+    sbt.socket.facts.json, so builds sharing a directory never overwrite each
+    other),
     skipping subproject/reactor-module directories a parent build root already
     covers. Unlike \`socket manifest auto\`, this looks beyond CWD itself.
 
@@ -12993,11 +13020,11 @@ const config$c = {
     },
     facts: {
       type: 'boolean',
-      description: 'Emit a Socket facts JSON file (`.socket.facts.json`) describing the resolved dependency graph. This is the default; pass `--pom` to generate `pom.xml` files instead'
+      description: 'Emit a Socket facts JSON file (`gradle.socket.facts.json`) describing the resolved dependency graph. This is the default; pass `--pom` to generate `pom.xml` files instead'
     },
     pom: {
       type: 'boolean',
-      description: 'Generate `pom.xml` manifest file(s) instead of the default Socket facts file (`.socket.facts.json`)'
+      description: 'Generate `pom.xml` manifest file(s) instead of the default Socket facts file (`gradle.socket.facts.json`)'
     },
     includeConfigs: {
       type: 'string',
@@ -13028,9 +13055,9 @@ const config$c = {
     Options
       ${utils.getFlagListOutput(config.flags)}
 
-    By default, emits a single \`.socket.facts.json\` describing the resolved
-    dependency graph of the whole build, using gradle (preferably your local
-    \`gradlew\`). An unresolved dependency is a fatal error. You can pass
+    By default, emits a single \`gradle.socket.facts.json\` describing the
+    resolved dependency graph of the whole build, using gradle (preferably your
+    local \`gradlew\`). An unresolved dependency is a fatal error. You can pass
     --include-configs / --exclude-configs (comma-separated glob patterns) to
     control which configurations are resolved (e.g.
     --include-configs=\`*CompileClasspath,*RuntimeClasspath\`), and
@@ -13247,11 +13274,11 @@ const config$b = {
     },
     facts: {
       type: 'boolean',
-      description: 'Emit a Socket facts JSON file (`.socket.facts.json`) describing the resolved dependency graph. This is the default; pass `--pom` to generate `pom.xml` files instead'
+      description: 'Emit a Socket facts JSON file (`gradle.socket.facts.json`) describing the resolved dependency graph. This is the default; pass `--pom` to generate `pom.xml` files instead'
     },
     pom: {
       type: 'boolean',
-      description: 'Generate `pom.xml` manifest file(s) instead of the default Socket facts file (`.socket.facts.json`)'
+      description: 'Generate `pom.xml` manifest file(s) instead of the default Socket facts file (`gradle.socket.facts.json`)'
     },
     includeConfigs: {
       type: 'string',
@@ -13282,9 +13309,9 @@ const config$b = {
     Options
       ${utils.getFlagListOutput(config.flags)}
 
-    By default, emits a single \`.socket.facts.json\` describing the resolved
-    dependency graph of the whole build, using gradle (preferably your local
-    \`gradlew\`). An unresolved dependency is a fatal error. You can pass
+    By default, emits a single \`gradle.socket.facts.json\` describing the
+    resolved dependency graph of the whole build, using gradle (preferably your
+    local \`gradlew\`). An unresolved dependency is a fatal error. You can pass
     --include-configs / --exclude-configs (comma-separated glob patterns) to
     control which configurations are resolved (e.g.
     --include-configs=\`*CompileClasspath,*RuntimeClasspath\`), and
@@ -13521,8 +13548,8 @@ const config$a = {
     Options
       ${utils.getFlagListOutput(config.flags)}
 
-    Emits a single \`.socket.facts.json\` describing the resolved dependency
-    graph of your Maven project, using maven (\`mvn\` on PATH by default). It
+    Emits a single \`pom.xml.socket.facts.json\` (named after the POM Maven
+    runs on) describing the resolved dependency graph of your Maven project, using maven (\`mvn\` on PATH by default). It
     reads dependency metadata only and never downloads artifacts; an unresolved
     dependency is a fatal error. You can pass --include-configs /
     --exclude-configs (comma-separated glob patterns) to control which Maven
@@ -13685,11 +13712,11 @@ const config$9 = {
     },
     facts: {
       type: 'boolean',
-      description: 'Emit a Socket facts JSON file (`.socket.facts.json`) describing the resolved dependency graph. This is the default; pass `--pom` to generate `pom.xml` files instead'
+      description: 'Emit a Socket facts JSON file (`sbt.socket.facts.json`) describing the resolved dependency graph. This is the default; pass `--pom` to generate `pom.xml` files instead'
     },
     pom: {
       type: 'boolean',
-      description: 'Generate `pom.xml` manifest file(s) instead of the default Socket facts file (`.socket.facts.json`)'
+      description: 'Generate `pom.xml` manifest file(s) instead of the default Socket facts file (`sbt.socket.facts.json`)'
     },
     includeConfigs: {
       type: 'string',
@@ -13706,7 +13733,7 @@ const config$9 = {
     },
     out: {
       type: 'string',
-      description: 'Only with --pom: path of the output `pom.xml`, see also --stdout. Does not apply when generating Socket facts (always written to the project root as `.socket.facts.json`)'
+      description: 'Only with --pom: path of the output `pom.xml`, see also --stdout. Does not apply when generating Socket facts (always written to the project root as `sbt.socket.facts.json`)'
     },
     stdout: {
       type: 'boolean',
@@ -13728,8 +13755,8 @@ const config$9 = {
     Options
       ${utils.getFlagListOutput(config.flags)}
 
-    By default, emits a single \`.socket.facts.json\` describing the resolved
-    dependency graph of the whole build. It reads dependency metadata only and
+    By default, emits a single \`sbt.socket.facts.json\` describing the
+    resolved dependency graph of the whole build. It reads dependency metadata only and
     never downloads artifacts; an unresolved dependency is a fatal error. You
     can pass --include-configs / --exclude-configs (comma-separated glob
     patterns) to control which sbt configurations are resolved (e.g.
@@ -13910,7 +13937,7 @@ async function run$A(argv, importMeta, {
   //       would the file name be?
 
   // --out / --stdout only affect the pom path. Socket facts are always written
-  // to the project root as `.socket.facts.json` so that `socket scan create`
+  // to the project root as `sbt.socket.facts.json` so that `socket scan create`
   // picks them up, so reject these flags in facts mode rather than silently
   // ignoring an explicitly-passed output location.
   const wasValidInput = utils.checkCommandInput(outputKind, {
@@ -13921,7 +13948,7 @@ async function run$A(argv, importMeta, {
   }, {
     nook: true,
     test: !(facts && (cli.flags['out'] !== undefined || cli.flags['stdout'] !== undefined)),
-    message: 'The `--out` and `--stdout` options only apply with `--pom`; Socket facts are always written to the project root as `.socket.facts.json`',
+    message: 'The `--out` and `--stdout` options only apply with `--pom`; Socket facts are always written to the project root as `sbt.socket.facts.json`',
     fail: 'remove --out/--stdout, or pass --pom'
   });
   if (!wasValidInput) {
@@ -14514,7 +14541,7 @@ async function askForFactsFlag(current) {
     choices: [{
       name: 'Socket facts (default)',
       value: 'yes',
-      description: 'Generate a .socket.facts.json file describing the resolved dependency graph'
+      description: 'Generate a Socket facts file (*.socket.facts.json) describing the resolved dependency graph'
     }, {
       name: 'pom.xml',
       value: 'no',
@@ -24478,5 +24505,5 @@ process.on('unhandledRejection', async (reason, promise) => {
   // eslint-disable-next-line n/no-process-exit
   process.exit(1);
 });
-//# debugId=40113ed0-ae58-43eb-a197-d1810801160e
+//# debugId=679b39e8-2ace-4602-9ad0-c5cf11bec9e3
 //# sourceMappingURL=cli.js.map