socketsecurity 2.11.2__tar.gz → 2.11.4__tar.gz

{socketsecurity-2.11.2 → socketsecurity-2.11.4}/.github/workflows/dependency-review.yml

@@ -598,7 +598,8 @@ jobs:
 
       # The eMudhra test hosts serve certificates from the compromised
       # intermediates. Require the specific rejection, not just any failure, so
-      # a DNS or network error cannot pass as "rejected".
+      # a DNS or network error cannot pass as "rejected". pip is checked on its
+      # own because it uses its vendored CA bundle, not the system store.
       - name: Check TLS clients reject the compromised eMudhra intermediates
         run: |
           docker run --rm --entrypoint sh socket-python-cli:dependabot-smoke -c '
@@ -640,6 +641,14 @@ jobs:
               echo "::error::python requests on $host: $result"
               status=1
             fi
+            if python -m pip download --no-deps --no-cache-dir --retries 0 --timeout 30 \
+                --dest /tmp/pip-tls --index-url "https://$host/simple/" certifi 2>&1 \
+                | grep -q CERTIFICATE_VERIFY_FAILED; then
+              echo "pip rejects $host"
+            else
+              echo "::error::pip on $host did not fail certificate verification"
+              status=1
+            fi
           done
           for url in https://api.socket.dev/v0/ https://registry.npmjs.org/ https://pypi.org/simple/; do
             if curl -sS -m 30 -o /dev/null "$url"; then

{socketsecurity-2.11.2 → socketsecurity-2.11.4}/CHANGELOG.md

@@ -1,5 +1,48 @@
 # Changelog
 
+## 2.11.4
+
+### Fixed: bump `brotli` and `brotlicffi` to patched versions
+
+- Bumped the pinned `brotli` (CPython) from `1.2.0` to `1.2.1` and `brotlicffi`
+  (other implementations) from `1.2.0.2` to `1.2.1.0`, which fix
+  CVE-2026-111497 (GHSA-9v8h-qqgm-4m35), an out-of-bounds write in the Brotli
+  decoder. The pins are exact, so earlier releases couldn't be installed
+  alongside the patched versions.
+
+### Fixed: find the reachability facts file when `--target-path` isn't the working directory
+
+- `--only-facts-file` and `--reach-use-only-pregenerated-sboms` now submit the
+  facts file, and `--reach` no longer warns `Facts file not found`.
+
+### Changed: update the Docker image's PyPy to 3.12
+
+- The amd64 Docker image now ships PyPy `8.0.1` (Python 3.12), up from PyPy
+  `7.3.20` (Python 3.11). The reachability engine uses it to speed up Python
+  analysis.
+
+### Changed: bump pinned Coana CLI to 15.13.0
+
+- Bumped the pinned reachability engine (the Coana CLI) from `15.12.11` to
+  `15.13.0`. See the
+  [reachability analysis changelog](https://docs.socket.dev/docs/reachability-analysis-changelog)
+  for engine changes.
+
+## 2.11.3
+
+### Fixed: finish rejecting the compromised eMudhra intermediate CAs
+
+- `socketsecurity` now requires `certifi>=2026.10.19`. Previously only the
+  Docker image's lockfile pinned it, so `pip install socketsecurity` could keep
+  an older CA bundle that trusts the compromised intermediates.
+- The Docker image upgrades `pip` to `26.2.2` or newer. Earlier versions use
+  their own vendored CA bundle, which still trusted them.
+
+### Changed: bump the Socket Python SDK to 3.6.1
+
+- Bumped the pinned Socket Python SDK (`socketdev`) from `3.6.0` to `3.6.1`,
+  which also requires `certifi>=2026.10.19`.
+
 ## 2.11.2
 
 ### Fixed: stop trusting the compromised eMudhra intermediate CAs

{socketsecurity-2.11.2 → socketsecurity-2.11.4}/Dockerfile

@@ -28,6 +28,12 @@ RUN apk update && apk add --no-cache \
     apk upgrade --no-cache ca-certificates && \
     [ "$(apk version -t "$(apk list -I ca-certificates | awk '{print $1}' | sed 's/^ca-certificates-//')" 20261020-r0)" != "<" ]
 
+# pip uses its own vendored CA bundle, not the system store, and the base image's
+# pip trusts the compromised eMudhra intermediates. 26.2.2 vendors certifi
+# 2026.10.19. Upgrade it against the system store fixed above.
+RUN python -m pip install --no-cache-dir --cert /etc/ssl/certs/ca-certificates.crt --upgrade "pip>=26.2.2" && \
+    python -c 'import sys, pip; sys.exit(tuple(map(int, pip.__version__.split(".")[:3])) < (26, 2, 2))'
+
 # npm, npx and yarn are symlinks in the node image. COPY would dereference them
 # into flat files and break their relative requires, so recreate the links.
 COPY --from=node /usr/local/bin/node /usr/local/bin/node
@@ -83,16 +89,16 @@ RUN if [ "$DOTNET_VERSION" = "6" ]; then \
 
 # Install PyPy (Alpine-compatible build for x86_64 only)
 # PyPy is an alternative Python interpreter that makes the Python reachability analysis faster.
-# This is a custom build of PyPy3.11 for Alpine on x86-64.
+# This is a custom build of PyPy3.12 for Alpine on x86-64.
 ARG TARGETARCH  # Passed by Docker buildx
 RUN if [ "$TARGETARCH" = "amd64" ]; then \
-        PYPY_URL="https://github.com/BarrensZeppelin/alpine-pypy/releases/download/alp3.23.1-pypy3.11-7.3.20/pypy3.11-v7.3.20-linux64-alpine3.21.tar.bz2" && \
-        PYPY_SHA256="60847fea6ffe96f10a3cd4b703686e944bb4fbcc01b7200c044088dd228425e1" && \
-        curl -L -o /tmp/pypy.tar.bz2 "$PYPY_URL" && \
-        echo "$PYPY_SHA256  /tmp/pypy.tar.bz2" | sha256sum -c - && \
+        PYPY_URL="https://github.com/BarrensZeppelin/alpine-pypy/releases/download/alp3.24.2-pypy3.12-8.0.1/pypy3.12-v8.0.1-linux64-alpine3.24.tar.gz" && \
+        PYPY_SHA256="b6d5dd429c6394f1710a52e3e20d5c9198547caff9528547c457d3f2ed37db09" && \
+        curl -L -o /tmp/pypy.tar.gz "$PYPY_URL" && \
+        echo "$PYPY_SHA256  /tmp/pypy.tar.gz" | sha256sum -c - && \
         mkdir -p /opt/pypy && \
-        tar -xj --strip-components=1 -C /opt/pypy -f /tmp/pypy.tar.bz2 && \
-        rm /tmp/pypy.tar.bz2 && \
+        tar -xz --strip-components=1 -C /opt/pypy -f /tmp/pypy.tar.gz && \
+        rm /tmp/pypy.tar.gz && \
         ln -s /opt/pypy/bin/pypy3 /bin/pypy3 && \
         pypy3 --version; \
     fi

{socketsecurity-2.11.2 → socketsecurity-2.11.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: socketsecurity
-Version: 2.11.2
+Version: 2.11.4
 Summary: Socket Security CLI for CI/CD
 Project-URL: Homepage, https://socket.dev
 Author-email: Douglas Coburn <douglas@socket.dev>
@@ -34,20 +34,21 @@ Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Requires-Python: >=3.11
 Requires-Dist: beautifulsoup4==4.15.0
-Requires-Dist: brotli==1.2.0; platform_python_implementation == 'CPython'
-Requires-Dist: brotlicffi==1.2.0.2; platform_python_implementation != 'CPython'
-Requires-Dist: gitpython==3.2.0
+Requires-Dist: brotli==1.2.1; platform_python_implementation == 'CPython'
+Requires-Dist: brotlicffi==1.2.1.0; platform_python_implementation != 'CPython'
+Requires-Dist: certifi>=2026.10.19
+Requires-Dist: gitpython==3.2.1
 Requires-Dist: markdown==3.11.1
 Requires-Dist: mdutils==1.8.1
 Requires-Dist: packaging==26.3
 Requires-Dist: prettytable==3.18.0
 Requires-Dist: python-dotenv==1.2.4
 Requires-Dist: requests==2.34.2
-Requires-Dist: socketdev==3.6.0
+Requires-Dist: socketdev==3.6.1
 Provides-Extra: dev
 Requires-Dist: hatch==1.18.1; extra == 'dev'
 Requires-Dist: pre-commit==4.7.0; extra == 'dev'
-Requires-Dist: ruff==0.17.0; extra == 'dev'
+Requires-Dist: ruff==0.17.1; extra == 'dev'
 Requires-Dist: twine==7.0.0; extra == 'dev'
 Requires-Dist: uv==0.13.4; extra == 'dev'
 Provides-Extra: test

{socketsecurity-2.11.2 → socketsecurity-2.11.4}/docs/cli-reference.md

@@ -338,7 +338,7 @@ If you don't want to provide the Socket API Token every time then you can use th
 | Parameter                        | Required | Default | Description                                                                                                                |
 |:---------------------------------|:---------|:--------|:---------------------------------------------------------------------------------------------------------------------------|
 | `--reach`                          | False    | False   | Enable reachability analysis to identify which vulnerable functions are actually called by your code. Creates a full application reachability scan (`scan_type=socket_tier1`). |
-| `--reach-version`                  | False    | 15.12.11 | Version of the Coana CLI to use. Defaults to the pinned version that ships with this CLI release, so the engine only changes when you upgrade the Socket CLI. Pass `latest` to always use the newest published version (opt-in auto-update), or an explicit version (e.g. `1.2.3`) to pin it. |
+| `--reach-version`                  | False    | 15.13.0 | Version of the Coana CLI to use. Defaults to the pinned version that ships with this CLI release, so the engine only changes when you upgrade the Socket CLI. Pass `latest` to always use the newest published version (opt-in auto-update), or an explicit version (e.g. `1.2.3`) to pin it. |
 | `--reach-analysis-timeout`         | False    | 10m     | Timeout for each reachability analysis run, e.g. `90s`, `10m` or `1h`. Omitted by default, so coana applies its own default (`10m`). Alias: `--reach-timeout` |
 | `--reach-analysis-memory-limit`    | False    | 8GB     | Memory limit for each reachability analysis run, e.g. `512MB` or `8GB`. Omitted by default, so coana applies its own default (`8GB`). Alias: `--reach-memory-limit` |
 | `--reach-concurrency`              | False    | 1       | Control parallel analysis execution (must be >= 1). Omitted by default, so coana applies its own default.                  |

{socketsecurity-2.11.2 → socketsecurity-2.11.4}/pyproject.toml

@@ -6,21 +6,25 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.11.2"
+version = "2.11.4"
 requires-python = ">= 3.11"
 license = {"file" = "LICENSE"}
 dependencies = [
     "requests==2.34.2",
     "mdutils==1.8.1",
     "prettytable==3.18.0",
-    "gitpython==3.2.0",
+    "gitpython==3.2.1",
     "packaging==26.3",
     "python-dotenv==1.2.4",
-    "socketdev==3.6.0",
+    "socketdev==3.6.1",
     "beautifulsoup4==4.15.0",
     "markdown==3.11.1",
-    "brotli==1.2.0; platform_python_implementation == 'CPython'",
-    "brotlicffi==1.2.0.2; platform_python_implementation != 'CPython'",
+    "brotli==1.2.1; platform_python_implementation == 'CPython'",
+    "brotlicffi==1.2.1.0; platform_python_implementation != 'CPython'",
+    # requests' CA bundle. A floor rather than an exact pin, so later trust-store
+    # fixes still reach installs; 2026.10.19 drops the roots behind the
+    # compromised eMudhra intermediates.
+    "certifi>=2026.10.19",
 ]
 readme = "README.md"
 description = "Socket Security CLI for CI/CD"
@@ -47,7 +51,7 @@ test = [
     "pytest-watch==4.2.0"
 ]
 dev = [
-    "ruff==0.17.0",
+    "ruff==0.17.1",
     "twine==7.0.0", # for building
     "uv==0.13.4",  # for dependency management
     "pre-commit==4.7.0",

{socketsecurity-2.11.2 → socketsecurity-2.11.4}/socketsecurity/__init__.py

@@ -1,3 +1,3 @@
 __author__ = 'socket.dev'
-__version__ = '2.11.2'
+__version__ = '2.11.4'
 USER_AGENT = f'SocketPythonCLI/{__version__}'

{socketsecurity-2.11.2 → socketsecurity-2.11.4}/socketsecurity/core/tools/reachability.py

@@ -22,7 +22,7 @@ log = logging.getLogger(__name__)
 # Pinned Coana CLI version. Bumped deliberately per Python CLI release so the
 # reachability engine version only changes through a standard pip upgrade (advance notice).
 # Pass --reach-version latest to opt into the newest published version instead.
-DEFAULT_COANA_CLI_VERSION: Final = "15.12.11"
+DEFAULT_COANA_CLI_VERSION: Final = "15.13.0"
 
 # Vendored from coana-package-manager, where it is generated; the only code that may read or
 # write the cache Coana shares with the Socket CLIs. See "Launching Coana" in that repo's
@@ -132,7 +132,7 @@ class ReachabilityAnalyzer:
             org_slug: Socket organization slug
             target_directory: Directory to analyze
             tar_hash: Tar hash from manifest upload or existing scan (optional)
-            output_path: Output file path for results
+            output_path: Output file path for results, relative to target_directory unless absolute
             timeout: Analysis timeout, forwarded verbatim to coana --analysis-timeout
                 (coana parses the units, e.g. '90s', '10m', '1h'; a bare number is seconds)
             memory_limit: Memory limit, forwarded verbatim to coana --memory-limit
@@ -282,8 +282,9 @@ class ReachabilityAnalyzer:
                 log.error(f"Reachability analysis failed with exit code {returncode}")
                 raise Exception(f"Reachability analysis failed with exit code {returncode}")
             
-            # Extract scan ID from output file
-            scan_id = self._extract_scan_id(output_path)
+            # Coana runs in target_directory, so a relative output_path lands there.
+            report_path = os.path.join(target_directory, output_path)
+            scan_id = self._extract_scan_id(report_path)
             
             log.info("Reachability analysis completed successfully")
             if scan_id:
@@ -291,7 +292,7 @@ class ReachabilityAnalyzer:
             
             return {
                 "scan_id": scan_id,
-                "report_path": output_path,
+                "report_path": report_path,
                 "tar_hash_used": tar_hash
             }
         

{socketsecurity-2.11.2 → socketsecurity-2.11.4}/socketsecurity/socketcli.py

@@ -561,7 +561,7 @@ def main_code():
                     
                     # If only-facts-file mode, mark the facts file for submission
                     if config.only_facts_file:
-                        facts_file_to_submit = os.path.abspath(output_path)
+                        facts_file_to_submit = os.path.abspath(result['report_path'])
                         log.info(f"Only-facts-file mode: will submit only {facts_file_to_submit}")
 
                     # If reach-use-only-pregenerated-sboms mode, submit CDX, SPDX, and facts file
@@ -570,9 +570,8 @@ def main_code():
                         sbom_files_to_submit = []
                         for scan_path in scan_paths:
                             sbom_files_to_submit.extend(core.find_sbom_files(scan_path))
-                        # Use relative path for facts file
-                        if os.path.exists(output_path):
-                            sbom_files_to_submit.append(output_path)
+                        if os.path.exists(result['report_path']):
+                            sbom_files_to_submit.append(result['report_path'])
                         log.info(f"Pre-generated SBOMs mode: will submit {len(sbom_files_to_submit)} files (CDX, SPDX, and facts file)")
                     
                 except Exception as e:

{socketsecurity-2.11.2 → socketsecurity-2.11.4}/tests/unit/test_reachability.py

@@ -20,12 +20,14 @@ from socketsecurity.core.tools.reachability import (
 
 VERSION = "1.2.3"
 
-# Records what it was run with in $FAKE_COANA_RUN, or fails when passed --fail.
+# Records what it was run with in $FAKE_COANA_RUN, or fails when passed --fail. Like Coana, it
+# writes the facts file to the --socket-mode path, resolved against its cwd.
 FAKE_CLI_WRAPPER = """
 import { writeFileSync } from 'node:fs'
 const args = process.argv.slice(2)
 if (args.includes('--fail')) process.exit(1)
 writeFileSync(process.env.FAKE_COANA_RUN, JSON.stringify({ args, cwd: process.cwd(), env: process.env }))
+writeFileSync(args[args.indexOf('--socket-mode') + 1], JSON.stringify({ tier1ReachabilityScanId: 'reach-scan-id' }))
 """
 
 
@@ -84,6 +86,27 @@ def test_runs_the_cached_cli_wrapper_with_the_args_and_cwd(fake_run_path):
     assert run["cwd"] == str(fake_run_path.parent)
 
 
+@pytest.mark.parametrize("absolute", [False, True])
+def test_report_path_is_where_coana_wrote_the_facts_file(fake_run_path, tmp_path, monkeypatch, absolute):
+    target = tmp_path / "project"
+    target.mkdir()
+    monkeypatch.chdir(tmp_path)
+    output_path = str(tmp_path / "out" / "facts.json") if absolute else ".socket.facts.json"
+    if absolute:
+        (tmp_path / "out").mkdir()
+
+    result = _analyzer().run_reachability_analysis(
+        org_slug="my-org",
+        target_directory=str(target),
+        tar_hash="tar-hash-abc123",
+        output_path=output_path,
+        version=VERSION,
+    )
+
+    assert result["report_path"] == (output_path if absolute else str(target / ".socket.facts.json"))
+    assert result["scan_id"] == "reach-scan-id"
+
+
 def test_reach_debug_appends_debug_long_flag(fake_run_path):
     """G9: --reach-debug -> coana --debug; does not emit the global -d."""
     args = _run(fake_run_path, reach_debug=True)["args"]