Skip to content

deps(engine): bump @socketsecurity/cli from 1.1.66 to 1.14.0 - #231

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/socketsecurity/cli-1.14.0
Open

deps(engine): bump @socketsecurity/cli from 1.1.66 to 1.14.0#231
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/socketsecurity/cli-1.14.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 9, 2026

Copy link
Copy Markdown
Contributor

Bumps @socketsecurity/cli from 1.1.66 to 1.14.0.

Release notes

Sourced from @​socketsecurity/cli's releases.

v1.14.0

What's Changed

Full Changelog: SocketDev/socket-cli@v1.13.1...v1.14.0

v1.13.1

What's Changed

Full Changelog: SocketDev/socket-cli@v1.13.0...v1.13.1

v1.13.0

What's Changed

Full Changelog: SocketDev/socket-cli@v1.12.2...v1.13.0

v1.12.2

What's Changed

Full Changelog: SocketDev/socket-cli@v1.12.1...v1.12.2

v1.12.1

What's Changed

Full Changelog: SocketDev/socket-cli@v1.12.0...v1.12.1

v1.12.0

What's Changed

... (truncated)

Changelog

Sourced from @​socketsecurity/cli's changelog.

1.14.0 - 2026-11-05

Added

  • Choose which ecosystems --dynamic-sbom-inference covers with --dynamic-sbom-inference-ecosystems (maven for Gradle, sbt and Maven; nuget for .NET) on socket scan create, socket scan reach and socket fix. Ecosystems left out keep their manifest files as they are.

Changed

  • With --dynamic-sbom-inference, reachability analysis and socket fix now take the dependencies of every Gradle, sbt, Maven and .NET build they find from Socket facts only, so results no longer depend on which other builds produced facts.
  • socket manifest auto, --auto-manifest and --dynamic-sbom-inference (with its setup) now fail a .NET build that has no usable .NET SDK, as they do a Maven build without Maven, instead of skipping it. With --dynamic-sbom-inference, reachability analysis and socket fix warn that builds skipped in socket.json are left out, and reachability analysis stops with next steps when no build produced Socket facts.

1.13.1 - 2026-11-03

Fixed

  • Reachability scans of .NET projects now read your projects without running any of their build targets, so builds with compiler-less projects such as Microsoft.Build.Traversal aggregators no longer fail.

1.13.0 - 2026-11-03

Added

  • socket manifest dotnet [beta] generates Socket facts files for .NET solutions and projects from your own dotnet restore, covering PackageReference (central package management and lock files included) and packages.config projects.
  • socket manifest auto, socket manifest setup and --auto-manifest now detect .NET solutions and projects, and skip them with a warning where no .NET SDK is installed.

Changed

  • Modules outside the scan root can no longer be excluded with --exclude-paths; **/x used to match a ../x module by accident. Single-root runs whose Maven or Gradle options relocate the build root (-f, -p) now match patterns relative to the current directory, as documented.
  • Updated the Coana CLI to v 15.14.1.

Fixed

  • --exclude-paths patterns are now matched relative to the scan root in every build root. They now also exclude modules a build reaches outside its own directory (Maven ../ modules, relocated Gradle projects) and modules matched by wildcards that span a build-root boundary, such as */core.
  • --exclude-paths patterns written with Windows \ separators now exclude JVM build modules in single-root runs too.
  • Maven SBOMs keep the dependencies a module reaches through a sibling module's test-jar.
  • sbt SBOMs now generate for builds with relocated Maven dependencies, such as mysql:mysql-connector-java.

1.12.2 - 2026-10-30

Changed

  • Updated the Coana CLI to v 15.14.0.

1.12.1 - 2026-10-29

Changed

  • Updated the Coana CLI to v 15.13.3.

1.12.0 - 2026-10-29

Added

  • --reach-disable-dependency-downloads limits reachability analysis to already-installed dependencies.

1.11.2 - 2026-10-29

Changed

  • Updated the Coana CLI to v 15.13.2.
  • socket scan reach now shows up in socket scan --help.

... (truncated)

Commits
  • 74de5be chore(release): 1.14.0 (#1699)
  • a6b221e feat(scan): add --dynamic-sbom-inference-ecosystems to choose which ecosystem...
  • ed7c4fe fix(scan): make every discovered ecosystem facts-only under --dynamic-sbom-in...
  • 7de3bc7 chore(release): 1.13.1 (#1695)
  • 5390ed4 fix(manifest): read .NET projects without running their targets (#1694)
  • df2bac3 chore(release): 1.13.0 (#1693)
  • 9f34b7f upgrading coana to version 15.14.1 (#1692)
  • d484802 docs(manifest): name .NET in help text, messages and comments (#1682)
  • 9fc07de test(manifest): cover the .NET facts producer (#1681)
  • 254e011 feat(manifest): generate Socket facts for .NET solutions and projects (#1678)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
deps(engine): bump @socketsecurity/cli from 1.1.66 to 1.14.0
8939305 
Bumps [@socketsecurity/cli](https://github.com/SocketDev/socket-cli) from 1.1.66 to 1.14.0.
- [Release notes](https://github.com/SocketDev/socket-cli/releases)
- [Changelog](https://github.com/SocketDev/socket-cli/blob/v1.x/CHANGELOG.md)
- [Commits](SocketDev/socket-cli@v1.1.66...v1.14.0)

---
updated-dependencies:
- dependency-name: "@socketsecurity/cli"
  dependency-version: 1.14.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Nov 9, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: dependencies, engine. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@socket-security

socket-security Bot commented Nov 9, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updated@​socketsecurity/​cli@​1.1.66 ⏵ 1.14.099 -110010098 -2100 +10

View full report

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants