[dependabot]

Bumps @socketsecurity/cli from 1.6.0 to 1.7.0.

Release notes

Sourced from @​socketsecurity/cli's releases.

v1.7.0

What's Changed

• upgrading coana to version 15.12.4 by @​socket-pr-bot[bot] in SocketDev/socket-cli#1598
• feat(manifest): name JVM Socket facts files after their build by @​jfblaa in SocketDev/socket-cli#1587
• chore(release): 1.7.0 by @​socket-release-bot[bot] in SocketDev/socket-cli#1599

Full Changelog: SocketDev/socket-cli@v1.6.2...v1.7.0

v1.6.2

What's Changed

• feat(scan): recognise any *.socket.facts.json by @​jfblaa in SocketDev/socket-cli#1589
• fix(manifest): write JVM Socket facts into the build's own root by @​jfblaa in SocketDev/socket-cli#1590
• feat(manifest): give each JVM build project its own id and facts component by @​jfblaa in SocketDev/socket-cli#1591
• feat(manifest): attribute Gradle direct dependencies to their declaring build script by @​jfblaa in SocketDev/socket-cli#1593
• test(manifest): key Maven repo-inheritance roots by project id by @​jfblaa in SocketDev/socket-cli#1594
• upgrading coana to version 15.12.3 by @​socket-pr-bot[bot] in SocketDev/socket-cli#1595
• chore(release): 1.6.2 by @​socket-release-bot[bot] in SocketDev/socket-cli#1597

Full Changelog: SocketDev/socket-cli@v1.6.1...v1.6.2

v1.6.1

What's Changed

• fix(fix): fail when Coana leaves computed fixes unapplied by @​mtorp in SocketDev/socket-cli#1584
• chore(release): 1.6.1 by @​socket-release-bot[bot] in SocketDev/socket-cli#1588

Full Changelog: SocketDev/socket-cli@v1.6.0...v1.6.1

Changelog

Sourced from @​socketsecurity/cli's changelog.

1.7.0 - 2026-10-09

Changed

• Socket facts for Maven, Gradle and sbt builds are now written per build — pom.xml.socket.facts.json (named after the POM Maven runs on, so -f other-pom.xml gets its own), gradle.socket.facts.json and sbt.socket.facts.json — so builds sharing a directory no longer overwrite each other. Delete any .socket.facts.json an earlier run left behind.
• Reachability scans no longer feed a leftover .socket.facts.json report from an earlier run back into the analysis.
• Updated the Coana CLI to v 15.12.4.

1.6.2 - 2026-10-09

Changed

• Updated the Coana CLI to v 15.12.3.

Fixed

• Socket facts no longer merge build projects into one: Maven modules sharing a directory and Gradle or sbt projects sharing a coordinate each keep their own dependencies and build files.
• Socket facts for a Maven or Gradle build pointed elsewhere with -f or -p are now written into that build's own directory, where their paths resolve.

1.6.1 - 2026-10-08

Changed

• Updated the Coana CLI to v 15.12.2.

Commits

• 6381f50 chore(release): 1.7.0 (#1599)
• 5f773c9 feat(manifest): name JVM Socket facts files after their build (#1587)
• c27fb50 upgrading coana to version 15.12.4 (#1598)
• a4e6c28 chore(release): 1.6.2 (#1597)
• 8132456 upgrading coana to version 15.12.3 (#1595)
• c1f7c35 test(manifest): key Maven repo-inheritance roots by project id (#1594)
• 22a924e feat(manifest): attribute Gradle direct dependencies to their declaring build...
• b779708 feat(manifest): give each JVM build project its own id and facts component (#...
• 0b1e8ca fix(manifest): write JVM Socket facts into the build's own root (#1590)
• 040b7aa feat(scan): recognise any *.socket.facts.json (#1589)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: dependencies, engine. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​socketsecurity/​cli@​1.6.0 ⏵ 1.7.0				+1

View full report

[dependabot]

Looks like @socketsecurity/cli is up-to-date now, so this is no longer needed.