socket 1.1.147 → 1.1.152

package/CHANGELOG.md

@@ -4,6 +4,22 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## [1.1.152](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.152) - 2026-08-03
+
+### Changed
+- Updated the Coana CLI to v `15.10.0`.
+
+## [1.1.151](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.151) - 2026-07-31
+
+### Changed
+- Updated the Coana CLI to v `15.9.9`.
+- `socket scan view` now reads completed scans from Socket's cached immutable results, retrying briefly while a fresh scan finalizes; `--stream` keeps streaming live results.
+- `socket fix` vulnerability discovery now reads Coana's structured `--output-file` JSON result instead of parsing stdout, and warns when the Socket backend resolved 0 artifacts so an incomplete server-side resolve is surfaced instead of silently reporting "Finished!".
+
+### Fixed
+- `socket fix` no longer reports success when the Coana vulnerability-discovery step fails — Coana errors and unreadable discovery output now exit non-zero with the underlying reason instead of printing "Finished!" with nothing fixed.
+- Fixed `--auto-manifest --reach` reachability scans on sbt/Scala projects sometimes failing to resolve the Scala standard library.
+
 ## [1.1.147](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.147) - 2026-07-27
 
 ### Changed

package/DISCLOSURE

@@ -0,0 +1,45 @@
+# Dual-use disclosure
+
+Packages: socket, @socketsecurity/cli, @socketsecurity/cli-with-sentry
+Content policy class: dual-use (https://docs.npmjs.com/policies/dual-use)
+
+All three packages are built from one source tree
+(https://github.com/SocketDev/socket-cli, branch v1.x). "socket" is the
+primary package. "@socketsecurity/cli" is the same tool published under its
+older name. "@socketsecurity/cli-with-sentry" is the same tool with the
+Sentry error-reporting library added.
+
+## What the packages do that can look like malware
+
+The packages install command-line executables: socket, socket-npm,
+socket-npx, socket-pnpm, and socket-yarn. The two variant packages ship the
+same commands and add variant-named aliases of them. These commands wrap
+the npm, npx, pnpm, and yarn package managers: when a user runs an install
+through them, the tool reads the dependency tree first, sends package names
+and versions to the socket.dev security API for analysis, and can warn
+about or refuse to continue an install when a dependency looks risky. The
+tool can also read project files such as manifests, lockfiles, and package
+contents to build a security scan, and it uploads those scan inputs to
+socket.dev when the user requests a scan. Wrapping package managers,
+stopping installs, reading project files, and uploading scan data are
+behaviors that automated malware scanning can mistake for malicious
+software.
+
+## What the packages send over the network
+
+The tool talks to the socket.dev API to run the security analysis the user
+asked for. It sends what that analysis needs: package names and versions,
+dependency manifests and lockfiles, and the scan files the user chose to
+upload. The user's API token is sent to authenticate those requests. In
+addition, the @socketsecurity/cli-with-sentry variant bundles the
+@sentry/node library and reports errors and crashes to Sentry so the
+maintainers can debug failures. The other two packages do not include
+Sentry.
+
+## Intended legitimate use
+
+The packages exist for defensive supply-chain security: developers and CI
+systems use them to find known-malicious, hijacked, typosquatted, or
+policy-violating dependencies before those dependencies run. The tool runs
+only when a user or a CI job invokes it. Its source code is public at
+https://github.com/SocketDev/socket-cli and issues are tracked there.