@socketsecurity/cli 1.1.164 → 1.1.166

package/CHANGELOG.md

@@ -4,6 +4,20 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## [1.1.166](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.166) - 2026-09-03
+
+### Changed
+- Updated the Coana CLI to v `15.10.33`.
+
+### Fixed
+- `socket scan create --dynamic-sbom-inference` works without `--reach` again, so a single command produces a per-build-root Socket facts SBOM for Gradle, sbt, and Maven projects. It is a standalone flag now, no longer a reachability modifier.
+- `--dynamic-sbom-inference` no longer generates Conda or Bazel manifests as a side effect. It touches Gradle, sbt, and Maven only; pass `--auto-manifest` alongside it if you want the other ecosystems too.
+
+## [1.1.165](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.165) - 2026-09-02
+
+### Changed
+- Updated the Coana CLI to v `15.10.32`.
+
 ## [1.1.164](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.164) - 2026-09-01
 
 ### Changed

package/README.md

@@ -1,8 +1,8 @@
 # Socket CLI
 
 [![Socket Badge](https://socket.dev/api/badge/npm/package/socket)](https://socket.dev/npm/package/socket)
-[![Follow @SocketSecurity](https://raw.githubusercontent.com/SocketDev/socket-cli/v1.1.164/assets/fleet/badge-follow-x.svg)](https://twitter.com/SocketSecurity)
-[![Follow @socket.dev on Bluesky](https://raw.githubusercontent.com/SocketDev/socket-cli/v1.1.164/assets/fleet/badge-follow-bluesky.svg)](https://bsky.app/profile/socket.dev)
+[![Follow @SocketSecurity](https://raw.githubusercontent.com/SocketDev/socket-cli/v1.1.166/assets/fleet/badge-follow-x.svg)](https://twitter.com/SocketSecurity)
+[![Follow @socket.dev on Bluesky](https://raw.githubusercontent.com/SocketDev/socket-cli/v1.1.166/assets/fleet/badge-follow-bluesky.svg)](https://bsky.app/profile/socket.dev)
 
 CLI for [Socket.dev](https://socket.dev) — scan dependencies, audit packages, apply security patches, and gate installs from your terminal or CI. This is the 1.x line of the published `socket` package on npm.
 
@@ -138,8 +138,8 @@ MIT
 <br/>
 <div align="center">
   <picture>
-    <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.1.164/assets/fleet/socket-combomark-dark.svg">
-    <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.1.164/assets/fleet/socket-combomark-light.svg">
-    <img width="324" height="104" alt="Socket" src="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.1.164/assets/fleet/socket-combomark-light.svg">
+    <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.1.166/assets/fleet/socket-combomark-dark.svg">
+    <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.1.166/assets/fleet/socket-combomark-light.svg">
+    <img width="324" height="104" alt="Socket" src="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.1.166/assets/fleet/socket-combomark-light.svg">
   </picture>
 </div>

package/dist/cli.js

@@ -7145,21 +7145,14 @@ async function handleCreateNewScan({
   // paths. Always allocated (even when unused) to keep this uniform rather
   // than conditional on autoManifest/reach.
   await utils.withTmpDir('socket-auto-manifest-', async manifestTmpDir => {
-    if (autoManifest) {
+    if (autoManifest || reach.dynamicSbomInference) {
       logger.logger.info('Auto-generating manifest files ...');
-      debug.debugFn('notice', 'Auto-manifest mode enabled');
-      const sockJson = utils.readOrDefaultSocketJson(cwd);
-      const detected = await detectManifestActions(sockJson, cwd);
-      debug.debugDir('inspect', {
-        detected
-      });
+      debug.debugFn('notice', 'Manifest auto-generation enabled');
       if (reach.dynamicSbomInference) {
         // Recursively discover and generate Socket facts for every
         // independent gradle/sbt/maven build root instead of only the one at
-        // cwd; generateAutoManifest below is left to handle conda/bazel only.
-        detected.gradle = false;
-        detected.sbt = false;
-        detected.maven = false;
+        // cwd. This runs on its own, so nothing outside those three
+        // ecosystems is generated unless --auto-manifest also asked for it.
         const dynamicResult = await runDynamicSbomInference({
           cwd,
           excludePaths: reach.excludePaths,
@@ -7174,20 +7167,34 @@ async function handleCreateNewScan({
         scanTargets = Array.from(new Set([...scanTargets, ...dynamicResult.factsPaths]));
         resolvedPathsSidecar = dynamicResult.resolvedPathsSidecar;
       }
-      const autoManifestResult = await generateAutoManifest({
-        computeArtifactsSidecar: reach.runReachabilityAnalysis,
-        cwd,
-        detected,
-        excludePaths: reach.excludePaths,
-        outputKind,
-        tmpDir: manifestTmpDir,
-        verbose: false
-      });
-      if (autoManifestResult.resolvedPathsSidecar) {
-        resolvedPathsSidecar = resolvedPathsSidecar ? mergeResolvedPathsSidecars(resolvedPathsSidecar, autoManifestResult.resolvedPathsSidecar) : autoManifestResult.resolvedPathsSidecar;
-      }
-      if (autoManifestResult.generatedFiles.length) {
-        scanTargets = Array.from(new Set([...scanTargets, ...autoManifestResult.generatedFiles]));
+      if (autoManifest) {
+        const sockJson = utils.readOrDefaultSocketJson(cwd);
+        const detected = await detectManifestActions(sockJson, cwd);
+        debug.debugDir('inspect', {
+          detected
+        });
+        if (reach.dynamicSbomInference) {
+          // Already generated recursively above; resolving cwd's own build
+          // root a second time would race on the same .socket.facts.json.
+          detected.gradle = false;
+          detected.sbt = false;
+          detected.maven = false;
+        }
+        const autoManifestResult = await generateAutoManifest({
+          computeArtifactsSidecar: reach.runReachabilityAnalysis,
+          cwd,
+          detected,
+          excludePaths: reach.excludePaths,
+          outputKind,
+          tmpDir: manifestTmpDir,
+          verbose: false
+        });
+        if (autoManifestResult.resolvedPathsSidecar) {
+          resolvedPathsSidecar = resolvedPathsSidecar ? mergeResolvedPathsSidecars(resolvedPathsSidecar, autoManifestResult.resolvedPathsSidecar) : autoManifestResult.resolvedPathsSidecar;
+        }
+        if (autoManifestResult.generatedFiles.length) {
+          scanTargets = Array.from(new Set([...scanTargets, ...autoManifestResult.generatedFiles]));
+        }
       }
       logger.logger.info('Auto-generation finished. Proceeding with Scan creation.');
     }
@@ -19284,16 +19291,11 @@ const cmdRepository = {
   }
 };
 
-// Shared prefix so each command can append how it obtains the per-build-root
-// SBOMs, which differs: `scan create` piggybacks on --auto-manifest, while
-// `scan reach` runs the build tools itself.
-const DYNAMIC_SBOM_INFERENCE_DESCRIPTION = 'For Gradle, sbt, and Maven: splits reachability analysis per project/module using a Socket facts SBOM (generated directly by each package manager) per build root, instead of one synthetic root.';
+// Shared prefix so each command can append what the SBOMs are used for, which
+// differs: reachability is optional on `scan create` and always on for
+// `scan reach`.
+const DYNAMIC_SBOM_INFERENCE_DESCRIPTION = 'For Gradle, sbt, and Maven: generate a Socket facts SBOM (produced directly by each package manager) per independent build root, instead of one synthetic root.';
 const reachabilityFlags = {
-  dynamicSbomInference: {
-    type: 'boolean',
-    default: false,
-    description: `${DYNAMIC_SBOM_INFERENCE_DESCRIPTION} Reachability analysis only; implies --auto-manifest.`
-  },
   reachVersion: {
     type: 'string',
     description: `Override the version of @coana-tech/cli used for reachability analysis. Default: ${constants.default.ENV.INLINED_SOCKET_CLI_COANA_TECH_CLI_VERSION}.`
@@ -19466,7 +19468,7 @@ const generalFlags$1 = {
   ...flags.outputFlags,
   autoManifest: {
     type: 'boolean',
-    description: 'Run `socket manifest auto` before collecting manifest files. This is necessary for languages like Scala, Gradle, and Kotlin, See `socket manifest auto --help`.'
+    description: 'Run `socket manifest auto` before collecting manifest files, which generates them for ecosystems that need their build tool to resolve dependencies, such as Scala, Gradle, and Kotlin. See `socket manifest auto --help`. For Gradle, sbt, and Maven, --dynamic-sbom-inference generates a Socket facts SBOM per build root instead.'
   },
   branch: {
     type: 'string',
@@ -19502,6 +19504,11 @@ const generalFlags$1 = {
     default: false,
     description: 'Set the default branch of the repository to the branch of this full-scan. Should only need to be done once, for example for the "main" or "master" branch.'
   },
+  dynamicSbomInference: {
+    type: 'boolean',
+    default: false,
+    description: `${DYNAMIC_SBOM_INFERENCE_DESCRIPTION} Combine with --reach to split the reachability analysis per project/module.`
+  },
   interactive: {
     type: 'boolean',
     default: true,
@@ -19698,11 +19705,6 @@ async function run$d(argv, importMeta, {
       autoManifest = false;
     }
   }
-  // --dynamic-sbom-inference requires auto-manifest to generate the
-  // per-workspace facts it feeds to Coana.
-  if (dynamicSbomInference) {
-    autoManifest = true;
-  }
   if (!branchName) {
     if (sockJson.defaults?.scan?.create?.branch) {
       branchName = sockJson.defaults.scan.create.branch;
@@ -19789,7 +19791,7 @@ async function run$d(argv, importMeta, {
   // to regenerate it would be misleading; the manifest data is already there
   // and will be picked up by the scan.
   const hasFactsFile = fs$1.existsSync(path.join(cwd, constants.default.DOT_SOCKET_DOT_FACTS_JSON));
-  if (detected.count > 0 && !autoManifest && !hasFactsFile) {
+  if (detected.count > 0 && !autoManifest && !dynamicSbomInference && !hasFactsFile) {
     logger.logger.info(`Detected ${detected.count} manifest targets we could try to generate. Please set the --auto-manifest flag if you want to include languages covered by \`socket manifest auto\` in the Scan.`);
   }
   if (updatedInput && orgSlug && targets.length) {
@@ -21932,15 +21934,15 @@ const CMD_NAME$4 = 'reach';
 const description$6 = 'Compute full application reachability';
 const hidden$4 = true;
 
-// `scan create` gets its per-build-root facts from --auto-manifest, a flag
-// this command doesn't have; here the build tools are run directly instead,
-// so the flag's description differs.
+// Not in reachabilityFlags: on `scan create` it is a general flag the --reach
+// guard must not reject. Reachability is always on here, so the description
+// drops that command's --reach caveat.
 const reachabilityFlagsForReach = {
   ...reachabilityFlags,
   dynamicSbomInference: {
     type: 'boolean',
     default: false,
-    description: `${DYNAMIC_SBOM_INFERENCE_DESCRIPTION} Each discovered build root is built first to generate its SBOM.`
+    description: `${DYNAMIC_SBOM_INFERENCE_DESCRIPTION} The reachability analysis is split per project/module accordingly.`
   }
 };
 const generalFlags = {
@@ -24096,5 +24098,5 @@ process.on('unhandledRejection', async (reason, promise) => {
   // eslint-disable-next-line n/no-process-exit
   process.exit(1);
 });
-//# debugId=5f7c5659-2323-4182-a73a-b5a96997ea01
+//# debugId=33f14952-bd82-49b9-8fcf-7a7cc5bf3926
 //# sourceMappingURL=cli.js.map