deps(engine): bump @socketsecurity/cli from 1.1.179 to 1.4.1

[dependabot]

Bumps @socketsecurity/cli from 1.1.179 to 1.4.1.

Release notes

Sourced from @​socketsecurity/cli's releases.

v1.4.1

What's Changed

• fix(fix): commit every file a fix changes in PR mode by @​jfblaa in SocketDev/socket-cli#1571
• upgrading coana to version 15.11.5 by @​socket-pr-bot[bot] in SocketDev/socket-cli#1572

Full Changelog: SocketDev/socket-cli@v1.4.0...v1.4.1

v1.4.0

What's Changed

• upgrading coana to version 15.11.4 by @​socket-pr-bot[bot] in SocketDev/socket-cli#1570
• feat(manifest): mark build modules as firstParty in facts components by @​jfblaa in SocketDev/socket-cli#1569

Full Changelog: SocketDev/socket-cli@v1.3.0...v1.4.0

v1.3.0

What's Changed

• feat(scan): scan selected uv workspace members with dependency graphs by @​mtorp in SocketDev/socket-cli#1565

Full Changelog: SocketDev/socket-cli@v1.2.1...v1.3.0

v1.2.1

What's Changed

• upgrading coana to version 15.11.3 by @​socket-pr-bot[bot] in SocketDev/socket-cli#1568

Full Changelog: SocketDev/socket-cli@v1.2.0...v1.2.1

v1.2.0

What's Changed

• upgrading coana to version 15.11.0 by @​jfblaa in SocketDev/socket-cli#1564
• feat(fix): add --dynamic-sbom-inference by @​jfblaa in SocketDev/socket-cli#1563

Full Changelog: SocketDev/socket-cli@v1.1.180...v1.2.0

v1.1.180

What's Changed

• fix(manifest): auto-manifest reads the Conda file it actually detected by @​jfblaa in SocketDev/socket-cli#1562

Full Changelog: SocketDev/socket-cli@v1.1.179...v1.1.180

Changelog

Sourced from @​socketsecurity/cli's changelog.

1.4.1 - 2026-09-30

Changed

• Updated the Coana CLI to v 15.11.5.

Fixed

• socket fix pull requests now include every file a fix changes, such as package.json override bumps, and work when run from a subdirectory of the repository.

1.4.0 - 2026-09-29

Changed

• Updated the Coana CLI to v 15.11.4.

1.3.0 - 2026-09-29

Added

• socket scan create --uv-members <dir...> scans selected uv workspace members with the versions and dependency relationships pinned in their shared uv.lock, leaving unrelated members out of the scan. Dependencies used only by dependency groups are marked as development dependencies. Requires uv with CycloneDX export support.

1.2.1 - 2026-09-28

Changed

• Updated the Coana CLI to v 15.11.3.

1.2.0 - 2026-09-27

Added

• socket fix --dynamic-sbom-inference generates Socket facts for each Gradle, sbt and Maven build and fixes a vulnerable dependency only in the projects/modules that resolve it. The generated files are removed afterwards.

Changed

• Updated the Coana CLI to v 15.11.0.

Fixed

• Fixes opened as pull requests now include edits to build files that are not uploaded manifests, such as gradle.properties or sbt project/*.scala files, and the files a fix creates.

1.1.180 - 2026-09-25

Changed

• A failed Conda manifest step now stops --auto-manifest instead of uploading a scan that under-reports your pip: dependencies, matching how Gradle, Maven and sbt already behave.

Fixed

• --auto-manifest now reads whichever Conda environment file your project uses, environment.yml or environment.yaml. Repos on the .yaml spelling no longer need a socket.json workaround.
• The Conda requirements.txt now lands in the directory you targeted, so scans pick it up even when you run the CLI from somewhere else.

Commits

• c9c8931 chore(release): 1.4.1
• 85faa1c upgrading coana to version 15.11.5 (#1572)
• ff18ef1 fix(fix): commit every file a fix changes in PR mode (#1571)
• d094036 chore(release): 1.4.0
• 6c64cc2 feat(manifest): mark build modules as firstParty in facts components (#1569)
• 3840719 upgrading coana to version 15.11.4 (#1570)
• 4645652 chore(release): 1.3.0
• 9d721ef feat(scan): scan selected uv workspace members with dependency graphs (#1565)
• 4400e0e chore(release): 1.2.1
• c2a5a02 upgrading coana to version 15.11.3 (#1568)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: dependencies, engine. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​socketsecurity/​cli@​1.1.179 ⏵ 1.4.1	+1			+1

View full report