socket 1.1.159 → 1.1.161

package/CHANGELOG.md

@@ -4,17 +4,20 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
-## [1.1.159](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.159) - 2026-08-19
+## [1.1.161](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.161) - 2026-08-27
 
-## [1.1.160](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.160) - 2026-08-19
+### Fixed
+- **`release`** — stop the coana bump from hand-writing versions (#1515)
+
+## [Unreleased] - 2026-08-27
 
 ### Changed
-- Updated the Coana CLI to v `15.10.17`.
+- Updated the Coana CLI to v `15.10.25`.
 
-## [1.1.159](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.159) - 2026-08-18
+## [1.1.160](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.160) - 2026-08-26
 
 ### Changed
-- Updated the Coana CLI to v `15.10.16`.
+- Updated the Coana CLI to v `15.10.24`.
 
 ## [1.1.158](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.158) - 2026-08-17
 

package/README.md

@@ -1,8 +1,8 @@
 # Socket CLI
 
 [![Socket Badge](https://socket.dev/api/badge/npm/package/socket)](https://socket.dev/npm/package/socket)
-[![Follow @SocketSecurity](https://raw.githubusercontent.com/SocketDev/socket-cli/v1.1.159/assets/fleet/badge-follow-x.svg)](https://twitter.com/SocketSecurity)
-[![Follow @socket.dev on Bluesky](https://raw.githubusercontent.com/SocketDev/socket-cli/v1.1.159/assets/fleet/badge-follow-bluesky.svg)](https://bsky.app/profile/socket.dev)
+[![Follow @SocketSecurity](https://raw.githubusercontent.com/SocketDev/socket-cli/v1.1.161/assets/fleet/badge-follow-x.svg)](https://twitter.com/SocketSecurity)
+[![Follow @socket.dev on Bluesky](https://raw.githubusercontent.com/SocketDev/socket-cli/v1.1.161/assets/fleet/badge-follow-bluesky.svg)](https://bsky.app/profile/socket.dev)
 
 CLI for [Socket.dev](https://socket.dev) — scan dependencies, audit packages, apply security patches, and gate installs from your terminal or CI. This is the 1.x line of the published `socket` package on npm.
 
@@ -138,8 +138,8 @@ MIT
 <br/>
 <div align="center">
   <picture>
-    <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.1.159/assets/fleet/socket-combomark-dark.svg">
-    <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.1.159/assets/fleet/socket-combomark-light.svg">
-    <img width="324" height="104" alt="Socket" src="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.1.159/assets/fleet/socket-combomark-light.svg">
+    <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.1.161/assets/fleet/socket-combomark-dark.svg">
+    <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.1.161/assets/fleet/socket-combomark-light.svg">
+    <img width="324" height="104" alt="Socket" src="https://raw.githubusercontent.com/SocketDev/socket-cli/v1.1.161/assets/fleet/socket-combomark-light.svg">
   </picture>
 </div>

package/dist/cli.js

@@ -2087,69 +2087,6 @@ async function performReachabilityAnalysis(options) {
   }
 }
 
-// The point here is to attempt to detect the various supported manifest files
-// the CLI can generate. This would be environments that we can't do server side
-
-async function detectManifestActions(
-// Passing in null means we attempt detection for every supported language
-// regardless of local socket.json status. Sometimes we want that.
-sockJson, cwd = process.cwd()) {
-  const output = {
-    bazel: false,
-    cdxgen: false,
-    // TODO
-    count: 0,
-    conda: false,
-    gradle: false,
-    maven: false,
-    sbt: false
-  };
-  if (sockJson?.defaults?.manifest?.bazel?.disabled) {
-    debug.debugLog('notice', `[DEBUG] - bazel auto-detection is disabled in ${constants.SOCKET_JSON}`);
-  } else if (fs$1.existsSync(path.join(cwd, 'MODULE.bazel')) || fs$1.existsSync(path.join(cwd, 'WORKSPACE')) || fs$1.existsSync(path.join(cwd, 'WORKSPACE.bazel'))) {
-    debug.debugLog('notice', '[DEBUG] - Detected a Bazel workspace');
-    output.bazel = true;
-    output.count += 1;
-  }
-  if (sockJson?.defaults?.manifest?.sbt?.disabled) {
-    debug.debugLog('notice', `[DEBUG] - sbt auto-detection is disabled in ${constants.SOCKET_JSON}`);
-  } else if (fs$1.existsSync(path.join(cwd, 'build.sbt'))) {
-    debug.debugLog('notice', '[DEBUG] - Detected a Scala sbt build file');
-    output.sbt = true;
-    output.count += 1;
-  }
-  if (sockJson?.defaults?.manifest?.gradle?.disabled) {
-    debug.debugLog('notice', `[DEBUG] - gradle auto-detection is disabled in ${constants.SOCKET_JSON}`);
-  } else if (fs$1.existsSync(path.join(cwd, 'build.gradle')) || fs$1.existsSync(path.join(cwd, 'build.gradle.kts')) || fs$1.existsSync(path.join(cwd, 'settings.gradle')) || fs$1.existsSync(path.join(cwd, 'settings.gradle.kts'))) {
-    // Detect by build descriptor, not the `gradlew` wrapper (a project can build via
-    // `gradle` on PATH). `settings.gradle(.kts)` covers Kotlin-DSL roots with no root build script.
-    debug.debugLog('notice', '[DEBUG] - Detected a gradle build file');
-    output.gradle = true;
-    output.count += 1;
-  }
-  if (sockJson?.defaults?.manifest?.maven?.disabled) {
-    debug.debugLog('notice', `[DEBUG] - maven auto-detection is disabled in ${constants.SOCKET_JSON}`);
-  } else if (fs$1.existsSync(path.join(cwd, 'pom.xml'))) {
-    debug.debugLog('notice', '[DEBUG] - Detected a Maven pom.xml build file');
-    output.maven = true;
-    output.count += 1;
-  }
-  if (sockJson?.defaults?.manifest?.conda?.disabled) {
-    debug.debugLog('notice', `[DEBUG] - conda auto-detection is disabled in ${constants.SOCKET_JSON}`);
-  } else {
-    const envyml = path.join(cwd, constants.ENVIRONMENT_YML);
-    const hasEnvyml = fs$1.existsSync(envyml);
-    const envyaml = path.join(cwd, constants.ENVIRONMENT_YAML);
-    const hasEnvyaml = !hasEnvyml && fs$1.existsSync(envyaml);
-    if (hasEnvyml || hasEnvyaml) {
-      debug.debugLog('notice', '[DEBUG] - Detected an environment.yml Conda file');
-      output.conda = true;
-      output.count += 1;
-    }
-  }
-  return output;
-}
-
 const BUILD_TOOLS = ['gradle', 'maven', 'sbt'];
 
 // One glob-suffix set per ecosystem's build-descriptor marker(s); `settings.gradle(.kts)`
@@ -4028,6 +3965,104 @@ function resolveEcosystemConfig(ecosystem, dir, sockJson) {
   };
 }
 
+// Recursively discovers and generates Socket facts for every independent
+// gradle/sbt/maven build root under `cwd`, returning the generated facts
+// paths plus the resolved-paths sidecar that reachability forwards to Coana.
+async function runDynamicSbomInference({
+  cwd,
+  excludePaths,
+  sbtTmpDir,
+  withFiles
+}) {
+  const sidecarAcc = withFiles ? new Map() : undefined;
+  const outcomes = await generateRecursiveManifests({
+    cwd,
+    excludePaths,
+    sbtTmpDir: withFiles ? sbtTmpDir : undefined,
+    sidecarAcc,
+    verbose: false,
+    withFiles
+  });
+  // No candidates discovered at all (distinct from candidates that were found
+  // but produced no generated facts - empty/skippedDisabled are already warned
+  // about elsewhere and are not this kind of mistake).
+  if (!outcomes.length) {
+    throw new utils.InputError(['No Gradle, sbt, or Maven build root was found.', '', '- Remove --dynamic-sbom-inference; it only applies to these ecosystems.', '- Make sure to run it from the correct dir (use --cwd to target another dir).'].join('\n'));
+  }
+  // Fail loud rather than silently proceed with a partial multi-root result:
+  // matches handleManifestDynamicSbomInference's own check.
+  if (outcomes.some(o => o.status === 'failed')) {
+    throw new utils.InputError('One or more independent build roots failed to generate Socket facts; aborting (see the errors above).');
+  }
+  return {
+    factsPaths: outcomes.filter(o => o.status === 'generated').map(o => o.factsPath),
+    resolvedPathsSidecar: sidecarAcc && hasSidecarEntries(sidecarAcc) ? serializeSidecar(sidecarAcc) : undefined
+  };
+}
+
+// The point here is to attempt to detect the various supported manifest files
+// the CLI can generate. This would be environments that we can't do server side
+
+async function detectManifestActions(
+// Passing in null means we attempt detection for every supported language
+// regardless of local socket.json status. Sometimes we want that.
+sockJson, cwd = process.cwd()) {
+  const output = {
+    bazel: false,
+    cdxgen: false,
+    // TODO
+    count: 0,
+    conda: false,
+    gradle: false,
+    maven: false,
+    sbt: false
+  };
+  if (sockJson?.defaults?.manifest?.bazel?.disabled) {
+    debug.debugLog('notice', `[DEBUG] - bazel auto-detection is disabled in ${constants.SOCKET_JSON}`);
+  } else if (fs$1.existsSync(path.join(cwd, 'MODULE.bazel')) || fs$1.existsSync(path.join(cwd, 'WORKSPACE')) || fs$1.existsSync(path.join(cwd, 'WORKSPACE.bazel'))) {
+    debug.debugLog('notice', '[DEBUG] - Detected a Bazel workspace');
+    output.bazel = true;
+    output.count += 1;
+  }
+  if (sockJson?.defaults?.manifest?.sbt?.disabled) {
+    debug.debugLog('notice', `[DEBUG] - sbt auto-detection is disabled in ${constants.SOCKET_JSON}`);
+  } else if (fs$1.existsSync(path.join(cwd, 'build.sbt'))) {
+    debug.debugLog('notice', '[DEBUG] - Detected a Scala sbt build file');
+    output.sbt = true;
+    output.count += 1;
+  }
+  if (sockJson?.defaults?.manifest?.gradle?.disabled) {
+    debug.debugLog('notice', `[DEBUG] - gradle auto-detection is disabled in ${constants.SOCKET_JSON}`);
+  } else if (fs$1.existsSync(path.join(cwd, 'build.gradle')) || fs$1.existsSync(path.join(cwd, 'build.gradle.kts')) || fs$1.existsSync(path.join(cwd, 'settings.gradle')) || fs$1.existsSync(path.join(cwd, 'settings.gradle.kts'))) {
+    // Detect by build descriptor, not the `gradlew` wrapper (a project can build via
+    // `gradle` on PATH). `settings.gradle(.kts)` covers Kotlin-DSL roots with no root build script.
+    debug.debugLog('notice', '[DEBUG] - Detected a gradle build file');
+    output.gradle = true;
+    output.count += 1;
+  }
+  if (sockJson?.defaults?.manifest?.maven?.disabled) {
+    debug.debugLog('notice', `[DEBUG] - maven auto-detection is disabled in ${constants.SOCKET_JSON}`);
+  } else if (fs$1.existsSync(path.join(cwd, 'pom.xml'))) {
+    debug.debugLog('notice', '[DEBUG] - Detected a Maven pom.xml build file');
+    output.maven = true;
+    output.count += 1;
+  }
+  if (sockJson?.defaults?.manifest?.conda?.disabled) {
+    debug.debugLog('notice', `[DEBUG] - conda auto-detection is disabled in ${constants.SOCKET_JSON}`);
+  } else {
+    const envyml = path.join(cwd, constants.ENVIRONMENT_YML);
+    const hasEnvyml = fs$1.existsSync(envyml);
+    const envyaml = path.join(cwd, constants.ENVIRONMENT_YAML);
+    const hasEnvyaml = !hasEnvyml && fs$1.existsSync(envyaml);
+    if (hasEnvyml || hasEnvyaml) {
+      debug.debugLog('notice', '[DEBUG] - Detected an environment.yml Conda file');
+      output.conda = true;
+      output.count += 1;
+    }
+  }
+  return output;
+}
+
 /**
  * Resolve the bazel binary to invoke for `socket manifest bazel`.
  *
@@ -7125,36 +7160,19 @@ async function handleCreateNewScan({
         detected.gradle = false;
         detected.sbt = false;
         detected.maven = false;
-        const sidecarAcc = reach.runReachabilityAnalysis ? new Map() : undefined;
-        const outcomes = await generateRecursiveManifests({
+        const dynamicResult = await runDynamicSbomInference({
           cwd,
           excludePaths: reach.excludePaths,
           // sbt's Scala toolchain lives under its shared global base;
           // withFiles' resolved paths point into it, so when reachability
           // will consume them afterward, reuse manifestTmpDir (kept alive
-          // until reach finishes below) instead of letting this call clean
+          // until reach finishes below) instead of letting the call clean
           // its own ephemeral base up before reach ever reads those paths.
-          sbtTmpDir: reach.runReachabilityAnalysis ? manifestTmpDir : undefined,
-          sidecarAcc,
-          verbose: false,
+          sbtTmpDir: manifestTmpDir,
           withFiles: reach.runReachabilityAnalysis
         });
-        // No candidates discovered at all (distinct from candidates that were
-        // found but produced no generated facts - empty/skippedDisabled are
-        // already warned about elsewhere and are not this kind of mistake).
-        if (!outcomes.length) {
-          throw new utils.InputError(['No Gradle, sbt, or Maven build root was found.', '', '- Remove --dynamic-sbom-inference; it only applies to these ecosystems.', '- Make sure to run it from the correct dir (use --cwd to target another dir).'].join('\n'));
-        }
-        // Fail loud rather than silently upload a partial multi-root scan:
-        // matches handleManifestDynamicSbomInference's own check.
-        if (outcomes.some(o => o.status === 'failed')) {
-          throw new utils.InputError('One or more independent build roots failed to generate Socket facts; aborting (see the errors above).');
-        }
-        const generatedFactsPaths = outcomes.filter(o => o.status === 'generated').map(o => o.factsPath);
-        scanTargets = Array.from(new Set([...scanTargets, ...generatedFactsPaths]));
-        if (sidecarAcc && hasSidecarEntries(sidecarAcc)) {
-          resolvedPathsSidecar = serializeSidecar(sidecarAcc);
-        }
+        scanTargets = Array.from(new Set([...scanTargets, ...dynamicResult.factsPaths]));
+        resolvedPathsSidecar = dynamicResult.resolvedPathsSidecar;
       }
       const autoManifestResult = await generateAutoManifest({
         computeArtifactsSidecar: reach.runReachabilityAnalysis,
@@ -19266,11 +19284,15 @@ const cmdRepository = {
   }
 };
 
+// Shared prefix so each command can append how it obtains the per-build-root
+// SBOMs, which differs: `scan create` piggybacks on --auto-manifest, while
+// `scan reach` runs the build tools itself.
+const DYNAMIC_SBOM_INFERENCE_DESCRIPTION = 'For Gradle, sbt, and Maven: splits reachability analysis per project/module using a Socket facts SBOM (generated directly by each package manager) per build root, instead of one synthetic root.';
 const reachabilityFlags = {
   dynamicSbomInference: {
     type: 'boolean',
     default: false,
-    description: 'For Gradle, sbt, and Maven: splits reachability analysis per project/module using a Socket facts SBOM (generated directly by each package manager) per build root, instead of one synthetic root. Reachability analysis only; implies --auto-manifest.'
+    description: `${DYNAMIC_SBOM_INFERENCE_DESCRIPTION} Reachability analysis only; implies --auto-manifest.`
   },
   reachVersion: {
     type: 'string',
@@ -21792,7 +21814,7 @@ async function outputScanReach(result, {
   }
 }
 
-async function handleScanReach({
+async function runScanReach({
   cwd,
   interactive: _interactive,
   orgSlug,
@@ -21800,11 +21822,28 @@ async function handleScanReach({
   outputPath,
   reachabilityOptions,
   targets
-}) {
+}, sbtTmpDir) {
   const {
     spinner
   } = constants.default;
 
+  // Extra discovery targets beyond the user's own; the reachability target
+  // itself stays `targets[0]`.
+  let scanTargets = targets;
+  // Sidecar forwarded to reachability; populated by dynamic SBOM inference.
+  let resolvedPathsSidecar;
+  if (reachabilityOptions.dynamicSbomInference) {
+    logger.logger.info('Generating Socket facts for each Gradle, sbt, and Maven build root ...');
+    const dynamicResult = await runDynamicSbomInference({
+      cwd,
+      excludePaths: reachabilityOptions.excludePaths,
+      sbtTmpDir,
+      withFiles: true
+    });
+    scanTargets = Array.from(new Set([...scanTargets, ...dynamicResult.factsPaths]));
+    resolvedPathsSidecar = dynamicResult.resolvedPathsSidecar;
+  }
+
   // Get supported file names.
   const supportedFilesCResult = await fetchSupportedScanFileNames({
     orgSlug,
@@ -21832,7 +21871,7 @@ async function handleScanReach({
     reachabilityOptions,
     target: targets[0]
   });
-  const packagePaths = await utils.getPackageFilesForScan(targets, supportedFiles, {
+  const packagePaths = await utils.getPackageFilesForScan(scanTargets, supportedFiles, {
     additionalIgnores: additionalScaIgnores,
     config: socketConfig,
     cwd
@@ -21856,6 +21895,7 @@ async function handleScanReach({
     outputPath,
     packagePaths,
     reachabilityOptions: mergedReachabilityOptions,
+    resolvedPathsSidecar,
     spinner,
     target: targets[0],
     uploadManifests: true
@@ -21881,23 +21921,26 @@ async function handleScanReach({
     outputPath
   });
 }
+async function handleScanReach(config) {
+  // sbt provisions its Scala toolchain under the directory passed as its
+  // isolated global base; the sidecar's artifactPaths point into it, so it
+  // must stay on disk until the reachability analysis has consumed them.
+  return config.reachabilityOptions.dynamicSbomInference ? await utils.withTmpDir('socket-dynamic-sbom-inference-', tmpDir => runScanReach(config, tmpDir)) : await runScanReach(config, undefined);
+}
 
 const CMD_NAME$4 = 'reach';
 const description$6 = 'Compute full application reachability';
 const hidden$4 = true;
 
-// dynamicSbomInference relies on --auto-manifest generating per-workspace
-// Socket facts first, which this command never runs (see the hardcoded
-// `false` passed to handleScanReach below) - hidden here even though it's
-// otherwise public on `scan create`, since advertising a flag this command
-// silently ignores would be misleading.
+// `scan create` gets its per-build-root facts from --auto-manifest, a flag
+// this command doesn't have; here the build tools are run directly instead,
+// so the flag's description differs.
 const reachabilityFlagsForReach = {
   ...reachabilityFlags,
   dynamicSbomInference: {
     type: 'boolean',
     default: false,
-    hidden: true,
-    description: reachabilityFlags['dynamicSbomInference'].description
+    description: `${DYNAMIC_SBOM_INFERENCE_DESCRIPTION} Each discovered build root is built first to generate its SBOM.`
   }
 };
 const generalFlags = {
@@ -21965,6 +22008,7 @@ async function run$7(argv, importMeta, {
       $ ${command}
       $ ${command} ./proj
       $ ${command} ./proj --reach-ecosystems npm,pypi
+      $ ${command} ./monorepo --dynamic-sbom-inference
       $ ${command} --output custom-report.json
       $ ${command} ./proj --output ./reports/analysis.json
   `
@@ -21977,6 +22021,7 @@ async function run$7(argv, importMeta, {
   });
   const {
     cwd: cwdOverride,
+    dynamicSbomInference,
     interactive = true,
     json,
     markdown,
@@ -22084,9 +22129,7 @@ async function run$7(argv, importMeta, {
     outputKind,
     outputPath: outputPath || '',
     reachabilityOptions: {
-      // Not exposed here: it relies on --auto-manifest generating per-workspace
-      // Socket facts first, which `socket scan reach` never runs.
-      dynamicSbomInference: false,
+      dynamicSbomInference: Boolean(dynamicSbomInference),
       excludePaths,
       reachAnalysisMemoryLimit,
       reachAnalysisTimeout,
@@ -24053,5 +24096,5 @@ process.on('unhandledRejection', async (reason, promise) => {
   // eslint-disable-next-line n/no-process-exit
   process.exit(1);
 });
-//# debugId=69d6aee7-9895-453a-a64d-f9410fff5198
+//# debugId=5f7c5659-2323-4182-a73a-b5a96997ea01
 //# sourceMappingURL=cli.js.map