From 665c4dceea244e98bdd9cbf1e6574503ba005e12 Mon Sep 17 00:00:00 2001 From: "socket-pr-bot[bot]" <294242679+socket-pr-bot[bot]@users.noreply.github.com> Date: Thu, 6 Aug 2026 06:49:44 +0000 Subject: [PATCH 1/3] Bump pinned @coana-tech/cli to 15.10.4 --- CHANGELOG.md | 8 ++++++++ docs/cli-reference.md | 2 +- socketsecurity/core/tools/reachability.py | 6 +++--- 3 files changed, 12 insertions(+), 4 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 53adb48..b3ed22b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -15,6 +15,14 @@ ## 2.6.1 +### Changed: bump pinned @coana-tech/cli to 15.10.4 + +- Bumped the pinned reachability engine (`@coana-tech/cli`) from `15.10.3` to + `15.10.4`. See the [Coana changelogs](https://docs.coana.tech/changelogs) for + engine changes. + +## 2.6.1 + ### Changed: scan comparison now polls the diff-scans endpoints - Diff mode no longer holds a single idle HTTP connection open while the API diff --git a/docs/cli-reference.md b/docs/cli-reference.md index 9f4ca88..7d4f85c 100644 --- a/docs/cli-reference.md +++ b/docs/cli-reference.md @@ -275,7 +275,7 @@ If you don't want to provide the Socket API Token every time then you can use th | Parameter | Required | Default | Description | |:---------------------------------|:---------|:--------|:---------------------------------------------------------------------------------------------------------------------------| | `--reach` | False | False | Enable reachability analysis to identify which vulnerable functions are actually called by your code. Creates a full application reachability scan (`scan_type=socket_tier1`). | -| `--reach-version` | False | 15.10.3 | Version of @coana-tech/cli to use. Defaults to the pinned version that ships with this CLI release, so the engine only changes when you upgrade the Socket CLI. Pass `latest` to always use the newest published version (opt-in auto-update), or an explicit version (e.g. `1.2.3`) to pin it. | +| `--reach-version` | False | 15.10.4 | Version of @coana-tech/cli to use. Defaults to the pinned version that ships with this CLI release, so the engine only changes when you upgrade the Socket CLI. Pass `latest` to always use the newest published version (opt-in auto-update), or an explicit version (e.g. `1.2.3`) to pin it. | | `--reach-analysis-timeout` | False | 10m | Timeout for each reachability analysis run, e.g. `90s`, `10m` or `1h`. Omitted by default, so coana applies its own default (`10m`). Alias: `--reach-timeout` | | `--reach-analysis-memory-limit` | False | 8GB | Memory limit for each reachability analysis run, e.g. `512MB` or `8GB`. Omitted by default, so coana applies its own default (`8GB`). Alias: `--reach-memory-limit` | | `--reach-concurrency` | False | 1 | Control parallel analysis execution (must be >= 1). Omitted by default, so coana applies its own default. | diff --git a/socketsecurity/core/tools/reachability.py b/socketsecurity/core/tools/reachability.py index 34d7909..d0fdd07 100644 --- a/socketsecurity/core/tools/reachability.py +++ b/socketsecurity/core/tools/reachability.py @@ -18,7 +18,7 @@ # Pinned @coana-tech/cli version. Bumped deliberately per Python CLI release so the # reachability engine version only changes through a standard pip upgrade (advance notice). # Pass --reach-version latest to opt into the newest published version instead. -DEFAULT_COANA_CLI_VERSION: Final = "15.10.3" +DEFAULT_COANA_CLI_VERSION: Final = "15.10.4" # Resolved @coana-tech/cli script paths from the npm-install fallback, keyed by version. # Lives for the process lifetime so repeated fallback invocations install only once @@ -55,7 +55,7 @@ def __init__(self, sdk: socketdev, api_token: str): def _resolve_coana_package_spec(self, version: Optional[str] = None) -> str: """ - Resolve the @coana-tech/cli package spec to run (e.g. '@coana-tech/cli@15.10.3'). + Resolve the @coana-tech/cli package spec to run (e.g. '@coana-tech/cli@15.10.4'). Args: version: Coana CLI version to use. @@ -64,7 +64,7 @@ def _resolve_coana_package_spec(self, version: Optional[str] = None) -> str: - '': that exact version. Returns: - str: The package specifier to use with npx (e.g. '@coana-tech/cli@15.10.3'). + str: The package specifier to use with npx (e.g. '@coana-tech/cli@15.10.4'). """ return f"@coana-tech/cli@{self._resolve_coana_version(version)}" From 9cce34103a31eb102a40427a19b2af5492081059 Mon Sep 17 00:00:00 2001 From: lelia <2418071+lelia@users.noreply.github.com> Date: Thu, 6 Aug 2026 13:52:30 -0400 Subject: [PATCH 2/3] Rev version to 2.6.3, consolidating the unpublished 2.6.2 notes 2.6.1 shipped while this PR was in flight, and the 2.6.2 version bump on main was never published. Fold the 2.6.2 changelog entry, the Dependabot updates, and the dev/test dependency pinning into the 2.6.3 entry. Co-Authored-By: Claude Fable 5 --- CHANGELOG.md | 16 +++++++++++++--- pyproject.toml | 2 +- socketsecurity/__init__.py | 2 +- uv.lock | 2 +- 4 files changed, 16 insertions(+), 6 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index b3ed22b..08eac10 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,6 +1,6 @@ # Changelog -## 2.6.2 +## 2.6.3 ### Fixed: SBOM fetch failures no longer produce empty reports @@ -13,14 +13,24 @@ instead of raising, and individual unparseable artifacts are skipped rather than failing the whole response. -## 2.6.1 - ### Changed: bump pinned @coana-tech/cli to 15.10.4 - Bumped the pinned reachability engine (`@coana-tech/cli`) from `15.10.3` to `15.10.4`. See the [Coana changelogs](https://docs.coana.tech/changelogs) for engine changes. +### Changed: dependency updates and dev/test dependency pinning + +- Bumped pinned runtime dependencies: `beautifulsoup4` `4.14.3` → `4.15.0` and + `markdown` `3.10.2` → `3.10.3`. +- Pinned the `test` and `dev` optional dependency groups to exact versions + (previously open ranges or unpinned), extending the exact-pinning policy + introduced in 2.6.0 to all dependency groups. This includes a major `twine` + bump (`6.2.0` → `7.0.0`), which only affects package publishing, not the + installed CLI. +- Bumped GitHub Actions used in CI workflows (`actions/setup-python` to + `7.0.0`, plus minor/patch updates). No effect on the installed CLI. + ## 2.6.1 ### Changed: scan comparison now polls the diff-scans endpoints diff --git a/pyproject.toml b/pyproject.toml index 8275fdb..f325c07 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -6,7 +6,7 @@ build-backend = "hatchling.build" [project] name = "socketsecurity" -version = "2.6.2" +version = "2.6.3" requires-python = ">= 3.11" license = {"file" = "LICENSE"} dependencies = [ diff --git a/socketsecurity/__init__.py b/socketsecurity/__init__.py index c4c8bad..88ac823 100644 --- a/socketsecurity/__init__.py +++ b/socketsecurity/__init__.py @@ -1,3 +1,3 @@ __author__ = 'socket.dev' -__version__ = '2.6.2' +__version__ = '2.6.3' USER_AGENT = f'SocketPythonCLI/{__version__}' diff --git a/uv.lock b/uv.lock index 5851670..ffc1224 100644 --- a/uv.lock +++ b/uv.lock @@ -1282,7 +1282,7 @@ wheels = [ [[package]] name = "socketsecurity" -version = "2.6.2" +version = "2.6.3" source = { editable = "." } dependencies = [ { name = "beautifulsoup4" }, From 6a30e17881f71afd619260d1d76fccda97ba13b9 Mon Sep 17 00:00:00 2001 From: lelia <2418071+lelia@users.noreply.github.com> Date: Thu, 6 Aug 2026 22:01:04 -0400 Subject: [PATCH 3/3] Trim dependency-update specifics in the 2.6.3 changelog entry Co-Authored-By: Claude Fable 5 --- CHANGELOG.md | 15 ++++++--------- 1 file changed, 6 insertions(+), 9 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 08eac10..eabbddf 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -21,15 +21,12 @@ ### Changed: dependency updates and dev/test dependency pinning -- Bumped pinned runtime dependencies: `beautifulsoup4` `4.14.3` → `4.15.0` and - `markdown` `3.10.2` → `3.10.3`. -- Pinned the `test` and `dev` optional dependency groups to exact versions - (previously open ranges or unpinned), extending the exact-pinning policy - introduced in 2.6.0 to all dependency groups. This includes a major `twine` - bump (`6.2.0` → `7.0.0`), which only affects package publishing, not the - installed CLI. -- Bumped GitHub Actions used in CI workflows (`actions/setup-python` to - `7.0.0`, plus minor/patch updates). No effect on the installed CLI. +- Bumped pinned runtime dependencies (`beautifulsoup4` `4.15.0`, + `markdown` `3.10.3`). +- Pinned the `test` and `dev` dependency groups to exact versions, extending + the exact-pinning policy introduced in 2.6.0 to all dependency groups. +- Updated GitHub Actions used in CI workflows. No effect on the installed + CLI. ## 2.6.1