From 89e28ebddc9c8781f5e87df2d99b83548ac200b7 Mon Sep 17 00:00:00 2001 From: "socket-pr-bot[bot]" <294242679+socket-pr-bot[bot]@users.noreply.github.com> Date: Wed, 21 Oct 2026 08:03:10 +0000 Subject: [PATCH 1/3] Bump pinned Coana CLI to 15.12.11 --- CHANGELOG.md | 9 +++++++++ docs/cli-reference.md | 2 +- pyproject.toml | 2 +- socketsecurity/__init__.py | 2 +- socketsecurity/core/tools/reachability.py | 2 +- uv.lock | 4 ++-- 6 files changed, 15 insertions(+), 6 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 87550dc..5f61020 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,14 @@ # Changelog +## 2.11.2 + +### Changed: bump pinned Coana CLI to 15.12.11 + +- Bumped the pinned reachability engine (the Coana CLI) from `15.12.10` to + `15.12.11`. See the + [reachability analysis changelog](https://docs.socket.dev/docs/reachability-analysis-changelog) + for engine changes. + ## 2.11.1 ### Changed: bump pinned Coana CLI to 15.12.10 diff --git a/docs/cli-reference.md b/docs/cli-reference.md index 547542a..de81239 100644 --- a/docs/cli-reference.md +++ b/docs/cli-reference.md @@ -338,7 +338,7 @@ If you don't want to provide the Socket API Token every time then you can use th | Parameter | Required | Default | Description | |:---------------------------------|:---------|:--------|:---------------------------------------------------------------------------------------------------------------------------| | `--reach` | False | False | Enable reachability analysis to identify which vulnerable functions are actually called by your code. Creates a full application reachability scan (`scan_type=socket_tier1`). | -| `--reach-version` | False | 15.12.10 | Version of the Coana CLI to use. Defaults to the pinned version that ships with this CLI release, so the engine only changes when you upgrade the Socket CLI. Pass `latest` to always use the newest published version (opt-in auto-update), or an explicit version (e.g. `1.2.3`) to pin it. | +| `--reach-version` | False | 15.12.11 | Version of the Coana CLI to use. Defaults to the pinned version that ships with this CLI release, so the engine only changes when you upgrade the Socket CLI. Pass `latest` to always use the newest published version (opt-in auto-update), or an explicit version (e.g. `1.2.3`) to pin it. | | `--reach-analysis-timeout` | False | 10m | Timeout for each reachability analysis run, e.g. `90s`, `10m` or `1h`. Omitted by default, so coana applies its own default (`10m`). Alias: `--reach-timeout` | | `--reach-analysis-memory-limit` | False | 8GB | Memory limit for each reachability analysis run, e.g. `512MB` or `8GB`. Omitted by default, so coana applies its own default (`8GB`). Alias: `--reach-memory-limit` | | `--reach-concurrency` | False | 1 | Control parallel analysis execution (must be >= 1). Omitted by default, so coana applies its own default. | diff --git a/pyproject.toml b/pyproject.toml index 27f5996..6880d95 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -6,7 +6,7 @@ build-backend = "hatchling.build" [project] name = "socketsecurity" -version = "2.11.1" +version = "2.11.2" requires-python = ">= 3.11" license = {"file" = "LICENSE"} dependencies = [ diff --git a/socketsecurity/__init__.py b/socketsecurity/__init__.py index 4b0b8f4..753c46e 100644 --- a/socketsecurity/__init__.py +++ b/socketsecurity/__init__.py @@ -1,3 +1,3 @@ __author__ = 'socket.dev' -__version__ = '2.11.1' +__version__ = '2.11.2' USER_AGENT = f'SocketPythonCLI/{__version__}' diff --git a/socketsecurity/core/tools/reachability.py b/socketsecurity/core/tools/reachability.py index 75593d6..fa04efb 100644 --- a/socketsecurity/core/tools/reachability.py +++ b/socketsecurity/core/tools/reachability.py @@ -22,7 +22,7 @@ # Pinned Coana CLI version. Bumped deliberately per Python CLI release so the # reachability engine version only changes through a standard pip upgrade (advance notice). # Pass --reach-version latest to opt into the newest published version instead. -DEFAULT_COANA_CLI_VERSION: Final = "15.12.10" +DEFAULT_COANA_CLI_VERSION: Final = "15.12.11" # Vendored from coana-package-manager, where it is generated; the only code that may read or # write the cache Coana shares with the Socket CLIs. See "Launching Coana" in that repo's diff --git a/uv.lock b/uv.lock index a714002..397a002 100644 --- a/uv.lock +++ b/uv.lock @@ -1,5 +1,5 @@ version = 1 -revision = 3 +revision = 5 requires-python = ">=3.11" resolution-markers = [ "python_full_version >= '3.13'", @@ -1292,7 +1292,7 @@ wheels = [ [[package]] name = "socketsecurity" -version = "2.11.1" +version = "2.11.2" source = { editable = "." } dependencies = [ { name = "beautifulsoup4" }, From 598bc438ed64fbe1389288f249f9cc7d0902a874 Mon Sep 17 00:00:00 2001 From: lelia <2418071+lelia@users.noreply.github.com> Date: Wed, 21 Oct 2026 15:36:58 -0400 Subject: [PATCH 2/3] Run reachability e2e on Node 22 and document the new minimum Coana CLI 15.12.11 requires Node.js 22.13 or later. The e2e-reachability job pinned Node 20, so the engine exited 3 before producing a facts file. --- .github/workflows/e2e-test.yml | 2 +- CHANGELOG.md | 4 ++++ docs/cli-reference.md | 2 +- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.github/workflows/e2e-test.yml b/.github/workflows/e2e-test.yml index 2cb3c9f..24cf38f 100644 --- a/.github/workflows/e2e-test.yml +++ b/.github/workflows/e2e-test.yml @@ -87,7 +87,7 @@ jobs: - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 if: matrix.setup-node == 'true' with: - node-version: '20' + node-version: '22' - name: Install CLI from local repo run: | diff --git a/CHANGELOG.md b/CHANGELOG.md index 5f61020..b4c8aa2 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -8,6 +8,10 @@ `15.12.11`. See the [reachability analysis changelog](https://docs.socket.dev/docs/reachability-analysis-changelog) for engine changes. +- Coana CLI `15.12.11` requires Node.js 22.13 or later (previously 20). On an older Node, + `--reach` fails with exit code 3 (with `--disable-blocking`, the scan continues without + reachability results). The Docker image already ships a newer Node, but if you run the CLI + directly (for example in CI), upgrade Node before upgrading the Socket CLI. ## 2.11.1 diff --git a/docs/cli-reference.md b/docs/cli-reference.md index de81239..43e221a 100644 --- a/docs/cli-reference.md +++ b/docs/cli-reference.md @@ -359,7 +359,7 @@ If you don't want to provide the Socket API Token every time then you can use th **Reachability Analysis Requirements:** The Python CLI verifies the following **up front** (before invoking the analysis engine) and exits with code **3** if any are unmet: -- `node` - Required to run the analysis engine (the Coana CLI). The engine needs Node.js 20 or later. +- `node` - Required to run the analysis engine (the Coana CLI). The engine needs Node.js 22.13 or later. - `uv` - Required by the analysis engine - An **Enterprise** Socket organization plan (any `enterprise*` plan, including Enterprise trials) From e4865a55dc214702ffd2416b1f153afc44a2cee8 Mon Sep 17 00:00:00 2001 From: lelia <2418071+lelia@users.noreply.github.com> Date: Wed, 21 Oct 2026 15:41:02 -0400 Subject: [PATCH 3/3] Bump virtualenv to 21.14.12 to clear new pip-audit advisories virtualenv is a dev-only transitive dependency (pre-commit, hatch). Four advisories published against 21.12.1 failed the required dependency-audit check. distlib moves with it. --- uv.lock | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/uv.lock b/uv.lock index 397a002..aa5510c 100644 --- a/uv.lock +++ b/uv.lock @@ -4,7 +4,7 @@ requires-python = ">=3.11" resolution-markers = [ "python_full_version >= '3.13'", "python_full_version == '3.12.*' and sys_platform == 'emscripten'", - "(python_full_version < '3.13' and sys_platform != 'emscripten') or (python_full_version < '3.12' and sys_platform == 'emscripten')", + "python_full_version < '3.12' or (python_full_version == '3.12.*' and sys_platform != 'emscripten')", ] [[package]] @@ -521,11 +521,11 @@ wheels = [ [[package]] name = "distlib" -version = "0.4.0" +version = "0.4.4" source = { registry = "https://pypi.org/simple" } -sdist = { url = "https://files.pythonhosted.org/packages/96/8e/709914eb2b5749865801041647dc7f4e6d00b549cfe88b65ca192995f07c/distlib-0.4.0.tar.gz", hash = "sha256:feec40075be03a04501a973d81f633735b4b69f98b05450592310c0f401a4e0d", size = 614605, upload-time = "2025-07-17T16:52:00.465Z" } +sdist = { url = "https://files.pythonhosted.org/packages/68/bc/d36966de7304047a1001a7559fbf266c464bb5d8cc85464536ef8c9bcc32/distlib-0.4.4.tar.gz", hash = "sha256:ca4175b4ac7f71223cc30ed7248c45d2b38c2439d8ee6e498ab67ed63cf3508d", size = 621304, upload-time = "2026-10-16T13:56:34.203Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/33/6b/e0547afaf41bf2c42e52430072fa5658766e3d65bd4b03a563d1b6336f57/distlib-0.4.0-py2.py3-none-any.whl", hash = "sha256:9659f7d87e46584a30b5780e43ac7a2143098441670ff0a49d5f9034c54a6c16", size = 469047, upload-time = "2025-07-17T16:51:58.613Z" }, + { url = "https://files.pythonhosted.org/packages/c1/2b/238f02a4927fa2e27aa995371d240a468b52e42eae44a678434aff736b38/distlib-0.4.4-py2.py3-none-any.whl", hash = "sha256:cf09d55b1e85a89576b036aeb71550bfd68320f3f21761ca329eadadad918638", size = 472099, upload-time = "2026-10-16T13:56:32.053Z" }, ] [[package]] @@ -1530,17 +1530,18 @@ wheels = [ [[package]] name = "virtualenv" -version = "21.12.1" +version = "21.14.12" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "distlib" }, { name = "filelock" }, + { name = "packaging" }, { name = "platformdirs" }, { name = "python-discovery" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/ad/3b/02608bb39c6b6f7d59ca62b04d704cf61e85361a7123b6394bca275661e1/virtualenv-21.12.1.tar.gz", hash = "sha256:be5a0a62cb2d1529ff6999652e2e7826f95bf7faa9b96b88cc39847c023d90a0", size = 5397187, upload-time = "2026-09-24T19:03:48.546Z" } +sdist = { url = "https://files.pythonhosted.org/packages/c9/2c/1a69b3346931e9a7db9cc00cc0fa847c843a85fa7cf52a598f57261c68df/virtualenv-21.14.12.tar.gz", hash = "sha256:bbcfb78e36c22ad70c6917c4aecb5e63477d3c138e9f88c946f320e31859c76a", size = 5562800, upload-time = "2026-10-21T01:58:51.724Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/f5/8c/692cf235722ee45c612630d2b49b3d1765892f7e440055365ea1b59c659e/virtualenv-21.12.1-py3-none-any.whl", hash = "sha256:878db9e963d0ef0b38561a344a4f9b12dc5c7741b6245d7ed10e9291cfea28bc", size = 5486096, upload-time = "2026-09-24T19:03:45.985Z" }, + { url = "https://files.pythonhosted.org/packages/a0/92/f3b8af2d36ddec4dc61dc25655dc010e419ff456cb4ca0e720c8112f1047/virtualenv-21.14.12-py3-none-any.whl", hash = "sha256:7820aeaef23f1f59a96458edfc7f9d3deac937155718de15f1c9a64471e15551", size = 5556824, upload-time = "2026-10-21T01:58:48.505Z" }, ] [[package]]