Reachability Analysis Changelog

Socket's reachability analysis is powered by the Coana analysis engine, published as @coana-tech/cli. The version numbers on this page are that engine's versions, not Socket CLI versions.

The Socket CLI bundles a pinned engine version. Pass --reach-version to socket scan reach to run a different one.

This page covers the engine releases from 2026.

15.10.38 (Sep 7. 2026)

Support semver ranges on source location vulnerability patterns in the Rust reachability analysis, so a pattern only applies to crate versions in its range.

15.10.37 (Sep 7. 2026)

Fix a performance regression in the Rust reachability analysis introduced in 15.10.35, where dependencies with long chains of glob re-exports could make the analysis run out of time or memory.

15.10.36 (Sep 3. 2026)

Prefer uv over pyenv when a specific Python interpreter is required.

15.10.35 (Sep 3. 2026)

Improvements for the Rust/Cargo reachability analysis:

• Support for vulnerability patterns that identify vulnerable code by source location.
• Fix an issue where paths through grouped imports such as use serde::{Deserialize, Serialize} were missed, causing vulnerabilities to be reported unreachable.

15.10.34 (Sep 3. 2026)

Performance improvements for the Go reachability analysis, better handling of timeouts and improved support for push-style //go:linkname directives.

15.10.33 (Sep 2. 2026)

When compute-fixes-and-upgrade-purls cannot fix a vulnerability because this run's own policy removed the only patched version from the search, the failure now names the withheld version and the flag responsible, on a ↳ line under the existing ⚠ reason:

  • pkg:npm/[email protected]
    ⚠ pkg:npm/astro has a fix in 7.0.4, but it is a major update and major updates are disabled for this run.
      ↳ a fix in pkg:npm/[email protected] exists but was withheld by --disable-major-updates

The same attribution is reported as withheldFixes in the --dry-run --output-file JSON. Note that removing the flag is not guaranteed to produce a fix — other version constraints in the dependency tree may still block the withheld version.

15.10.32 (Sep 2. 2026)

Internal re-structuring to reduce the size of the NPM package.

15.10.31 (Sep 2. 2026)

socket fix now updates the version on an indirect Go dependency’s existing require line in go.mod instead of appending a replace directive, matching the change go get would make. Two related cases are also handled: a dependency that already has a replace directive has it updated in place rather than shadowed by a second one, and an exclude directive blocking the fixed version is removed.

15.10.30 (Sep 2. 2026)

Fix a crash when writing the reachability report for very large repositories. The report was serialized as a single JavaScript string, which fails past ~512 MiB with RangeError: Invalid string length. The analysis itself completed and only the final write failed, so the whole scan was lost. The report is now streamed to disk, and its size is limited only by available disk space.

Reachability results now carry at most 3 evidence stacks per alert, down from 10. The shortest stacks are kept, and results whose stacks were trimmed are still marked as truncated. This keeps the report to a reasonable size on repositories with many workspaces, where evidence is recorded once per workspace.

15.10.29 (Sep 1. 2026)

Soundness improvements for the PHP reachability analysis.

15.10.28 (Aug 31. 2026)

Performance improvements for the Python reachability analysis on projects that use 3rd party serializers like Pydantic.

15.10.27 (Aug 31. 2026)

The reachability analysis no longer looks up the bucket layout of the previous scan when analysis splitting is disabled. The cached layout describes how an earlier scan split the vulnerabilities across separate analysis runs, which cannot be acted on by a scan that is limited to one analysis run per workspace.

15.10.26 (Aug 28. 2026)

Fix an issue where JVM reachability analysis could throw an error for aggregator projects.

15.10.25 (Aug 27. 2026)

Improvements and bugfixes for dependency installation for JavaScript/TypeScript projects.

15.10.24 (Aug 25. 2026)

Soundness improvements for the JVM/Java reachability analysis:

• Improved parity between the source-based and bytecode-based analyses.
• Fix an issue related to static field reads and writes.
• Fix an issue related to values published through AtomicReferenceFieldUpdater.
• Fix an issue where an advisory whose vulnerable code lives outside the advisory's own package was always reported unreachable.
• Improved support for Kotlin and Scala constructs such as delegated properties and object declarations.

15.10.23 (Aug 24. 2026)

Fixed JS/TS dependency installation failing on npm v12.

15.10.22 (Aug 24. 2026)

Fix an issue where a transient network failure while downloading a package was reported as an installation error. Package downloads are now retried on failures that could plausibly succeed on a second attempt, and fail immediately on a missing package, a rejected certificate or an unresolvable host. A failed download now names its cause.

Maven artifact resolution now tries the remaining public repositories after a failed download instead of giving up after the first one.

15.10.21 (Aug 22. 2026)

Soundness improvements for the PHP reachability analysis.

15.10.20 (Aug 21. 2026)

Bugfixes and soundness improvements for the Python & Ruby reachability analyses.
The Python analysis now catches timeouts more consistently and can often yield partial analysis results under out-of-memory errors.

15.10.19 (Aug 20. 2026)

Fix silently under-reported npm reachability results. When a repository contained more than one independent npm project and only some of them had their dependencies installed, reachability analysis could run against a project with no resolvable dependencies and report every one of its vulnerabilities as unreachable, without any error or warning. The CLI now verifies that at least one of a project's declared dependencies actually resolves from the directory being analyzed, and halts with an actionable message and the customer-side exit code 3 when none do.

Projects that declare no dependencies, hoisted npm/pnpm/yarn workspaces (where node_modules lives at the workspace root), and projects whose dependencies Coana installs itself are unaffected.

15.10.18 (Aug 20. 2026)

Improvements to dependency installation for JavaScript/TypeScript projects.

15.10.17 (Aug 19. 2026)

Enable reachability analysis for PHP/Composer projects when running reachability analysis through the Socket CLI. A Composer project in a subdirectory is now also analyzed in its own directory rather than at the repository root.

15.10.16 (Aug 18. 2026)

Bugfixes for the Ruby reachability analysis.

15.10.15 (Aug 17. 2026)

Fix workspace discovery in repositories containing a directory symlink cycle (for example a .pnpm-store entry pointing back at an ancestor directory). The same workspace could previously be reported and analyzed up to 40 times — once per cycle depth — with the deepest duplicated paths failing to register with the dashboard. Manifest discovery no longer follows directory symlinks (manifests that are themselves file symlinks are still included), manifest paths that traverse symlinks are collapsed onto their real location before analysis, a workspace matched both directly and through a symlink alias is reported once under its real path, and manifest paths escaping the scanned directory are ignored with a warning.

15.10.14 (Aug 13. 2026)

The "available memory" figure in the debug log is no longer misleading on macOS. It previously reported only fully-free pages (via Node's os.freemem()), which routinely shows a few hundred MiB on a healthy machine with many GiB actually available. The log now reports memory the OS can actually make available (including reclaimable memory), alongside the machine's total memory, and honors container memory limits on Linux.

Log messages emitted early in a --socket-mode run no longer show printf-style placeholders literally (e.g. available memory: %i MiB 2904.671875) in the log file; placeholders are now interpolated the same way as in the console output.

15.10.13 (Aug 11. 2026)

Consistency fixes to how projects and their workspaces are identified throughout the CLI. --entry-points now applies only to the scanned project's own root instead of leaking into every discovered subproject, the "no source files detected" halt message names the exact workspace instead of collapsing workspaces of the same subproject, per-project log prefixes and progress messages now include the subproject, and the --socket-mode report built from Coana dependency trees now includes every subproject's dependency tree instead of only the last one scanned.

15.10.12 (Aug 11. 2026)

Fix a scan failure in repositories containing more than one Python project. Reachability analysis failed with spawn uv ENOENT for every Python project after the first one, and the whole scan then halted unless --reach-continue-on-analysis-errors was set. Pre-installed Python dependencies are also reused again instead of being installed a second time during analysis.

15.10.11 (Aug 11. 2026)

Internal changes to detect problems with reachability specifications for vulnerabilities affecting TypeScript/JavaScript.

15.10.10 (Aug 7. 2026)

Fix a scan failure on Cargo workspaces whose root Cargo.toml is a virtual manifest (a [workspace] section with no [package]). The workspace root was reported as a Rust project in addition to its members, and the scan then halted with "no source files detected" because the root contains no Rust code. Rust reachability analysis also now reads each workspace member's own Cargo.toml, so direct dependencies are resolved correctly.

15.10.9 (Aug 7. 2026)

Packages belonging to an npm, pnpm, or yarn workspace are now grouped and analyzed together under their workspace root when running reachability analysis via the Socket CLI.

15.10.8 (Aug 6. 2026)

Fix an issue where a scan could fail with an error when two independent Maven/Gradle/SBT build roots both incorporated the same module but disagreed on its name or version.

15.10.7 (Aug 6. 2026)

Bugfixes for the Ruby reachability analysis.

15.10.6 (Aug 6. 2026)

Soundness improvements & bugfixes for the Python reachability analysis.

15.10.5 (Aug 6. 2026)

Internal changes to JVM/Java reachability analysis to support scans containing multiple independent Maven/Gradle/SBT build roots.

15.10.4 (Aug 5. 2026)

Reachability scans now survive a transient Socket backend failure instead of failing the CI job on the
first occurrence. When the backend reports a retryable error while resolving the dependency data, the
CLI retries with exponential backoff before giving up.

If the backend stays unavailable, the CLI now reports it as a Socket-side outage — a short explanation
instead of a stack trace and crash report — and exits with the dedicated exit code 4, so the calling
tool can tell "Socket was temporarily unavailable" apart from "the analysis crashed". Partial results
are never used, so a completed scan is still always a complete scan.

15.10.3 (Aug 5. 2026)

Performance and memory usage improvements for the Go reachability analysis.

15.10.2 (Aug 3. 2026)

Updates to the JVM/Java reachability analysis:

• Fix an issue that could cause reachability results to depend on unrelated analysis ordering.
• Fix an issue related to classes defined in multiple locations (e.g. multi-release JARs).
• Fix an issue related to Map.putAll.

15.10.1 (Aug 3. 2026)

Fix an issue where socket fix did not upgrade Cargo dependencies declared with workspace = true inheritance.

15.10.0 (Aug 3. 2026)

Updates to the JavaScript/TypeScript reachability analysis:

• Unresolved dynamic property reads and calls (for example obj[key]() where key is not a constant) are now approximated instead of dropped, so reachable code behind dynamic dispatch is no longer missed.
• Improved modelling of built-in APIs: the Node.js fs and events modules, JSON.parse revivers and JSON.stringify replacers, Reflect.apply/Reflect.construct, Array.from mapping functions, the iteration protocol for user-defined iterables, and newer array, set, promise and iterator-helper methods.
• More reliable module resolution in monorepos and symlinked installs, including pnpm's virtual store, Yarn Berry's nodeLinker: pnpm, and workspace packages linked into each other's node_modules.
• More precise analysis of webpack bundles, avoiding spurious call edges through the bundle's module loader.
• Projects using Yarn Plug'n'Play, which the reachability analysis does not support, are now reported up front with a single error naming the workaround, instead of one unresolved-module error per dependency.

15.9.10 (Jul 31. 2026)

Fix crashes in the Ruby reachability analysis on method definitions using anonymous block forwarding (def foo(&)).

15.9.9 (Jul 30. 2026)

Internal changes to prepare for future improvements to JVM reachability analysis.

15.9.8 (Jul 29. 2026)

Fix an issue where --reach-use-only-pregenerated-sboms could drop transitive dependencies from .socket.facts.json, leaving dangling dependency ids and causing scan uploads to fail.

15.9.7 (Jul 29. 2026)

Internal change related to discovering vulnerabilities through the Socket CLI: find-vulnerabilities now accepts -o, --output-file <file> and writes a structured JSON result (GHSA IDs plus artifact counts), so callers no longer need to rely on parsing the final stdout line. The stdout output is unchanged.

15.9.6 (Jul 29. 2026)

Reachability analysis (Python): .python-version files are now parsed as pyenv does, so comments and multiple versions are supported.

15.9.5 (Jul 28. 2026)

Updates to the Go reachability analysis:

• Significant performance & memory usage improvements
• Increased precision for calls to runtime.SetFinalizer
• Fixed broken timer models in newer Go versions
• Support call resolution to //go:linkname function stubs (when the stub & target signatures are identical)

15.9.4 (Jul 27. 2026)

Fix issues related to Spring Framework modelling for JVM reachability analysis via the Socket CLI.

15.9.3 (Jul 27. 2026)

Reachability analysis (Cargo): when cargo fetch cannot pre-download dependencies (for example when the Cargo workspace cannot be resolved because a path dependency's manifest is missing), the CLI now reports a non-fatal warning and continues the scan instead of logging that all packages were installed successfully. Rust results may be incomplete in this case, but other ecosystems in the same scan are unaffected.

15.9.2 (Jul 27. 2026)

Reachability analysis (Python): the .cache directory is no longer traversed when searching for Python source files.

15.9.1 (Jul 24. 2026)

Reachability analysis (Cargo): cargo fetch is now run before resolving crate dependencies, so that .cargo/config.toml is respected — source replacement, mirrors, private registries, and vendored sources all work correctly. Previously the Coana CLI downloaded crates directly from crates.io via HTTP, bypassing the project's cargo registry configuration and failing in environments where crates.io is unreachable.

15.9.0 (Jul 23. 2026)

Fixing (Rush): socket fix now updates the globalOverrides in common/config/rush/pnpm-config.json in place — preserving comments and formatting — when a fix targets a package that is pinned by a pnpm override, so the fix is no longer reverted by rush update. Overrides that cannot be updated automatically (defined via .pnpmfile.cjs, unsupportedPackageJsonSettings, or as a non-version value) are reported with the reason instead of failing with a generic message.

15.8.9 (Jul 10. 2026)

Reachability analysis (Maven): fix an issue where intra-repo modules that appear as dependencies of sibling modules were resolved as external artifacts instead of being recognized as part of the project.

15.8.8 (Jul 10. 2026)

Fixing (npm): socket fix no longer risks corrupting package.json when the file has changed since the scan it is based on (for example after a previous socket fix run). Version upgrades are now validated against the file's actual content before being applied: dependencies already at the fixed version are skipped so re-runs are safe no-ops, declarations that have moved are re-located by name, and upgrades that cannot be located safely are reported and skipped instead of applied. Additionally, when a vulnerability cannot be fixed, socket fix now shows the specific reasons when available instead of a generic "Unknown error".

15.8.7 (Jul 10. 2026)

Reachability analysis (JVM, .NET, Cargo): --exclude-dirs is now respected — source files under an excluded directory no longer contribute reachability results. Previously the option only took effect for JavaScript/TypeScript and Python.

15.8.6 (Jul 9. 2026)

Reachability analysis (Cargo): dependencies flagged missingMetadata are resolved from crates.io again when the workspace's Cargo.lock pins that exact package version to the public crates.io index. This fixes dependency pre-installation failures for versions that have been yanked on crates.io (for example futures-util 0.3.30 and earlier), which lockfiles legitimately pin and crates.io continues to serve. Dependencies from private or alternate registries, git, or local paths are still never resolved from remote repositories.

15.8.5 (Jul 8. 2026)

Improved computation of call paths for memory-intensive Go call graphs. Very large modules that previously failed the Go reachability analysis with an out-of-memory error now complete with all reachability results.

15.8.4 (Jul 7. 2026)

Reachability analysis: a vulnerability location pattern that cannot be resolved in the installed version of the affected package no longer halts the scan. Such failures are also only reported when none of the vulnerability's locations could be resolved — in that case the vulnerability is reported as an analysis error and falls back to precomputed reachability results. When at least one location resolves, the vulnerability's analysis result is reported as usual, and other vulnerabilities are unaffected either way.

15.8.3 (Jul 7. 2026)

Reachability analysis (JVM): intra-repository modules listed as projects in .socket.facts.json (e.g. Gradle project(':...') dependencies) are no longer treated as dependencies or resolved from remote repositories — their code is already analyzed as part of the project.

15.8.2 (Jul 7. 2026)

Reachability analysis (JVM, .NET, Cargo): dependencies with missingMetadata are no longer resolved from remote repositories.

15.8.1 (Jul 3. 2026)

Reachability analysis (JavaScript/TypeScript): a problem with the analysis data of a single vulnerability no longer causes the whole analysis to fail. The affected vulnerability is now reported as an analysis error, and all other vulnerabilities are analyzed as usual.

15.8.0 (Jul 2. 2026)

Applying fixes is now supported for pnpm-based Rush monorepos in socket fix runs: direct dependency upgrades are applied to the affected projects' package.json files, the shared lockfile at common/config/rush/pnpm-lock.yaml is updated, and the lockfile is regenerated by running rush update (using a globally installed rush when available, falling back to the repository's own common/scripts/install-run-rush.js). Rush subspaces are not yet supported.

15.7.0 (Jul 2. 2026)

The CLI now uses distinct exit codes to communicate the type of failure. A successful run still exits 0. A failure caused by a Coana-side or analyzer problem exits 2, while a failure caused by a fixable, customer-side issue - for example a missing lock file, an unsupported platform, missing build tooling, an invalid manifest, or a failed dependency install - exits 3. An interrupted run continues to exit 128 + signal (130 for SIGINT, 143 for SIGTERM). Previously, every failure exited 1.

15.6.7 (Jul 1. 2026)

Diagnostics: expected-halt failures (for example a missing external tool for a detected ecosystem, or an unmet system requirement) now print their message to the terminal and log. Previously, in the Socket-managed run mode, these messages were only reported to the backend, so the run could exit without an error appearing in the local log.

15.6.6 (Jul 1. 2026)

Reachability analysis (JVM): dependencies not covered by the Socket CLI's pre-resolved paths are now resolved via the normal fallback instead of being reported as install failures.

15.6.5 (Jul 1. 2026)

Diagnostics: when a reachability analysis subprocess is killed by a signal or exits with a non-zero code, the terminating signal (or exit code) is now included in the reported failure. This distinguishes a hard crash — for example a native analyzer terminated by SIGSEGV/SIGKILL that prints nothing — from an ordinary non-zero exit.

15.6.4 (Jun 30. 2026)

Fixed crashes in the Ruby reachability analysis on scope resolution expressions with non-constant left-hand sides (<expr>::Constant).

15.6.3 (Jun 30. 2026)

Reachability analysis (JVM): build-tool dependency resolution for Gradle/SBT/Maven has moved to the Socket CLI, so the build tool runs only once — resolving dependency files while generating the .socket.facts.json file.

15.6.2 (Jun 29. 2026)

Reachability analysis: when the same advisory affects more than one package in the dependency tree (for example an umbrella package and the sub-package that contains the vulnerable code), reachability is now computed for every affected package. Previously, on runs that reused a prior analysis configuration, one of the affected packages could be left without a reachability result.

15.6.1 (Jun 26. 2026)

Reachability analysis (RubyGems): codeless gems on a vulnerability's dependency chain no longer cause the affected vulnerabilities to be reported as install failures.

15.6.0 (Jun 26. 2026)

Updated the JavaScript/TypeScript reachability analysis engine. This fixes a bug where the analysis would sometimes run out of memory under certain conditions.

15.5.11 (Jun 26. 2026)

Reachability analysis (RubyGems): a vendor/ directory that isn't a Bundler gem install no longer causes the analysis to fail with "No load paths found for the packages to analyze". The vulnerable gems are now downloaded and analyzed instead of assuming any vendor/ directory means the gems are already installed.

15.5.10 (Jun 25. 2026)

Progress and log lines now refer to the affected ecosystem instead of a package manager or programming language — for example (PyPI) instead of (PIP) and (Cargo) instead of (RUST) (likewise npm, Maven, NuGet, Go, RubyGems, and Composer). This applies across dependency pre-installation, reachability analysis, the per-ecosystem project summary, and the "missing external tools" report.

15.5.9 (Jun 23. 2026)

socket fix (npm): a dependency pinned through an overrides entry in package.json is now upgraded automatically — the override is rewritten to the fixed version instead of failing with "Automatic updating of npm overrides is not yet supported". This brings npm overrides in line with the existing handling of pnpm overrides.

15.5.8 (Jun 22. 2026)

Maven: generating Socket facts (coana manifest maven) no longer compiles the project — source and output directories are taken from the build model, on par with Gradle/SBT, so facts generation is faster and needs no build. Maven and Gradle now prefer the project's ./mvnw / ./gradlew wrapper over the executable on PATH, matching how the build is normally invoked.

15.5.7 (Jun 22. 2026)

Reachability results are now referred to by their full names in CLI output and --help text: "full application reachability" (previously "Tier 1") and "precomputed reachability" (previously "Tier 2"). This is a naming change only — analysis behavior is unchanged.

15.5.6 (Jun 19. 2026)

.NET/NuGet: generate Socket facts via native NuGet/MSBuild resolution (coana manifest dotnet).

15.5.5 (Jun 19. 2026)

Maven: generate Socket facts for Maven projects (coana manifest maven), on par with Gradle/SBT.

15.5.4 (Jun 19. 2026)

Reachability analysis: analysis errors are now categorized more accurately in the results summary. Failures whose error text merely mentions an analyzed symbol or project path (e.g. a Timeout or Memory identifier) are no longer mislabeled as timeout or out-of-memory errors, and dependency/module-resolution failures (such as a private module that cannot be fetched) now get their own actionable message instead of a misleading "increase the memory/timeout limit" hint.

15.5.3 (Jun 19. 2026)

Gradle/SBT: internal improvements to Socket facts generation.

15.5.2 (Jun 19. 2026)

Gradle/SBT: coana manifest now fails fast with a clear, actionable message when the build-tool wrapper or launcher is missing (e.g. no gradlew in the project directory), instead of a cryptic "gradle exited with an error".

15.5.1 (Jun 18. 2026)

Gradle/SBT: Include metadata and project structure in generated Socket facts (REA-561).

15.5.0 (Jun 18. 2026)

The -a, --analysis-timeout and --memory-limit options now accept unit suffixes: durations as s, m or h (e.g. --analysis-timeout 10m) and memory as MB or GB (e.g. --memory-limit 8GB). Plain numbers without a unit are still accepted for backward compatibility.

15.4.6 (Jun 17. 2026)

NuGet: reachability analysis no longer fails on packages that contain no analyzable code — analyzers, source generators, meta-packages, and native runtime packages. .NET-runtime-provided assemblies (e.g. System.*, netstandard) are now resolved from the installed runtime on disk.

15.4.5 (Jun 16. 2026)

Fix issues related to type-filtering and Spring Framework modelling for JVM reachability analysis via the Socket CLI.

15.4.4 (Jun 16. 2026)

Gradle/SBT: more accurate and complete dependency resolution when generating Socket facts (REA-558).

15.4.3 (Jun 16. 2026)

socket fix now reads go.mod directives via go mod edit -json when computing Go dependency upgrades, replacing a custom go.mod parser. No change to the fixes that are applied.

15.4.2 (Jun 15. 2026)

socket fix now applies Go dependency upgrades with go mod edit instead of editing go.mod as text. Edits to require, replace, and exclude directives go through the Go toolchain, which guarantees the resulting go.mod is always syntactically valid.

15.4.1 (Jun 12. 2026)

Gradle/SBT: apply the build-tool options from socket.json when resolving dependency files for reachability analysis via the Socket CLI (REA-547).

15.4.0 (Jun 11. 2026)

The JavaScript/TypeScript reachability analysis supports a new, improved way of specifying the vulnerable parts of a package: vulnerabilities can now be described by their location in the package's source code, in addition to the existing API-based descriptions. This improves reachability results for vulnerabilities that are hard to characterize in terms of the package's public API.

Also fixes a bug in the JavaScript/TypeScript analysis that caused some vulnerabilities to be classified as unreachable without being fully analyzed.

15.3.26 (Jun 10. 2026)

When applying fixes, the CLI now uploads the updated manifest and lock files to Socket to aid debugging of fix runs. Use --disable-analytics-sharing to opt out.

15.3.25 (Jun 8. 2026)

socket fix: when bumping a version in a hash-pinned requirements lockfile (such as those generated by pip-compile or Bazel's rules_python), the --hash= lines are now refreshed to the new version's artifact digests, fetched from PyPI. Previously only the version was updated while the hashes still pointed at the old release, so the next pip install failed under --require-hashes with a hash mismatch. If the new digests can't be retrieved, the upgrade is refused rather than producing a lockfile that won't install.

15.3.24 (Jun 8. 2026)

Fixed socket fix removing all require directives from manifest-style Go go.mod files (modules with no buildable packages) when applying a dependency upgrade.

15.3.23 (Jun 8. 2026)

Gradle/SBT: fix dependencies being silently dropped from reachability analysis when reached only through custom-named or legacy (compile/testCompile) classpath configurations. A name-based tooling heuristic mislabelled such dependencies as build tooling and excluded them; it has been removed, since reachability already filters out build-only dependencies on its own. --with-files now also scopes artifact downloads to the components actually present in the SBOM instead of fetching the build's entire dependency graph (REA-534).

15.3.22 (Jun 5. 2026)

Detect external tools such as npm by scanning PATH directly when the which/where binary is unavailable. Previously, runtimes that don't ship which — notably AWS Lambda's Amazon Linux 2023 and distroless containers — reported required tools as missing even when they were installed and on PATH, causing socket fix to produce no fix. The system which/where is still preferred when present, so behavior is unchanged elsewhere.

15.3.21 (Jun 4. 2026)

Gradle/SBT: when dependencies fail to resolve while generating Socket facts, group the failures by cause (variant ambiguity, not found, repository/network, …) with concise next steps and the failing configurations to --exclude-configs, and keep the build tool's verbose output behind --verbose (REA-516).

15.3.20 (Jun 3. 2026)

When running in socket mode, report scan completion and signal-kills (SIGINT/SIGTERM) to the Socket backend, so tier-1 reachability scans no longer appear stuck in progress after Coana exits.

15.3.19 (Jun 3. 2026)

Use Gradle/SBT build tools for resolving dependency files when running reachability analysis via the Socket CLI.

15.3.18 (Jun 1. 2026)

Surface the HTTP status code and response body when a Socket API request fails. Previously a failed request — such as a 403 Forbidden from an API token missing a required scope — was reported only as a generic error, hiding the server's explanation (e.g. "Insufficient permissions"). The status and response body are now included so the failure can be diagnosed.

15.3.17 (May 30. 2026)

Ruby: dependency frames in scan evidence are now correctly labelled with package@version and show the lib/-relative file path within the gem, instead of being labelled as the application with a leaked temp-directory path.

15.3.16 (May 29. 2026)

Classify tier-1 reachability CLI failures as COANA_ERROR or CUSTOMER_ERROR when reporting them to the Socket dashboard. CUSTOMER_ERROR covers customer-fixable pre-flight issues — package install failures, missing Gradle/SBT lock files, workspaces with no source files, missing external build tools, and unsupported platforms (Windows). Anything else defaults to COANA_ERROR so analyzer-side bugs stay loud rather than being silently blamed on the customer.

15.3.15 (May 29. 2026)

Honor --purl-types when checking for missing Gradle/SBT lock files: a scan filtered to other ecosystems (e.g. --purl-types npm) no longer fails with a Gradle/SBT "Missing Lock Files" error.

15.3.14 (May 29. 2026)

Fix socket fix not applying upgrades in some SBT and Gradle projects, by correctly recognizing their auto-generated pom.xml files (REA-485).

15.3.13 (May 28. 2026)

Skip unreadable subdirectories with a warning instead of aborting the scan when project discovery hits a permission-denied directory.

15.3.12 (May 27. 2026)

Fix socket fix failing with a duplicate-key error when a transitive crate being upgraded was already declared in the same Cargo.toml.

15.3.11 (May 27. 2026)

Maven: vulnerabilities in build-tooling dependencies (e.g. Gradle plugins) are now reported as unknown reachability instead of failing the reachability analysis.

15.3.10 (May 26. 2026)

Fix two issues in the spar-jvm reachability analysis: JDK frames could be attributed to the application in callstacks, and a single callstack could contain more than one application frame. Also includes performance improvements and bug fixes for spar-jvm.

15.3.9 (May 26. 2026)

Fix an issue where, under some conditions, JavaScript reachability analysis could incorrectly mark vulnerabilities as unreachable.

15.3.8 (May 22. 2026)

Accept .socket.facts.json uploads as a Gradle/SBT lock-file substitute, and honor tooling: true on socket-facts artifacts so the Maven analyser skips resolution and install-error reporting for build-tooling components like Gradle plugins (REA-446).

15.3.7 (May 21. 2026)

Stop stripping missingMetadata: true artifacts from .socket.facts.json before upload (REA-455). The depscan backend now accepts the missingMetadata flag on socket-facts components and handles these private-namespace dependencies natively, which preserves reachability evidence on traces that flow through private packages. Also removes the post-strip orphan-cleanup pass added in 15.3.3, which is no longer needed now that the strip itself is gone.

15.3.6 (May 21, 2026)

Fix an issue where Maven dependencies were attempted resolved with incorrectly cased groupId and artifactId when running reachability analysis via the Socket CLI.

15.3.5 (May 21. 2026)

For Poetry-managed Python projects, locate the active venv via poetry env info --path instead of relying solely on the <projectDir>/.venv heuristic. When dependencies are pre-installed for the scan, Poetry typically places the venv outside the project tree (e.g. ~/.cache/pypoetry/virtualenvs/<name>-<hash>-py<ver>/); previously the heuristic missed it and coana built a temporary venv from scratch. Falls back to the existing behavior when Poetry isn't on PATH or the command fails.

15.3.4 (May 21, 2026)

Performance and soundness improvements for the JavaScript/TypeScript reachability analysis.

15.3.3 (May 20. 2026)

Fix a high volume of "orphaned component" alerts produced when a project declares a private-namespace package (no public registry metadata) as a direct dependency. The missing-metadata strip was removing the parent without re-checking reachability, leaving its transitives orphaned in the SBOM. A second orphan-filter pass after the strip now drops them before the facts.json is written.

15.3.2 (May 20. 2026)

Improve robustness of Maven artifact resolution when preparing dependencies for jvm reachability analysis.

15.3.1 (May 20. 2026)

Set a descriptive User-Agent header on outbound requests to Coana and Socket APIs (coana-tech-cli/<version> node/<nodeVersion> <platform>/<arch>), optionally appending the caller's UA when invoked by the Socket CLI.

15.3.0 (May 18. 2026)

Introduce spar-jvm as a new function-level JVM reachability analysis when running through the Socket CLI.

15.2.9 (May 18. 2026)

Surface a clear error when the Socket backend's compute-artifacts stream fails after the response has already started. Previously a mid-stream backend failure was indistinguishable from a project with no dependencies — the CLI silently reported zero artifacts. Paired with the corresponding Socket backend change, the CLI now detects the backend's terminal error record and aborts with a descriptive message instead.

15.2.8 (May 15. 2026)

Fix --package-managers not being respected by Socket Fix's pre-flight tool-availability check. Previously a project containing both package-lock.json and pnpm-lock.yaml would still require pnpm to be installed even when the user passed --package-managers NPM, causing the upgrade flow to fail on machines without pnpm. The check now skips per-tool validation for package managers excluded by the filter (pnpm, yarn, and uv).

15.2.7 (May 14. 2026)

Improve error reporting when Socket Fix fails to finalize a pnpm lockfile. The specific ERR_PNPM_TRUST_DOWNGRADE error now produces a focused message that names the offending package and points at the pnpm-workspace.yaml settings that unblock it. Other pnpm finalize failures now surface pnpm's stdout/stderr in the user-visible report instead of being buried only in the debug log.

15.2.6 (May 14. 2026)

Add debug logging for Maven dependency pre-installation. Previously a failed pre-install would surface only a list of packages that failed to install, with no indication of why. The debug log (in coana-log.txt) now records the underlying mvn help:evaluate and mvn dependency:get errors, the HTTP status codes from public-repository fallbacks, and which resolution path served each artifact, making install failures diagnosable without re-running the scan.

15.2.5 (May 13. 2026)

Fix Socket Fix failing to finalize the lockfile when npm is provided by a per-project version-manager shim (e.g. aqua, mise). The npm-binary lookup now falls back to which npm when npm config get prefix fails, so the shim is still used to resolve npm once invoked from the project directory.

15.2.4 (May 8. 2026)

Fix --package-managers not being respected during fix application. Previously the flag filtered fix computation but did not propagate to the upgrade layer, so a directory containing both package-lock.json and pnpm-lock.yaml could still have the pnpm lockfile updated when --package-managers NPM was set. The flag now strictly scopes which lockfiles are touched across the npm, pip, and maven upgrade managers.

15.2.3 (May 7. 2026)

Performance improvements for the JavaScript/TypeScript reachability analysis.

15.2.2 (May 5. 2026)

Fix Socket Fix failing to upgrade packages in cargo and pip uv-managed monorepos where the workspace lockfile is not at the project root.

15.2.1 (May 4. 2026)

Fix an issue where Maven classifier was not properly respected when preparing dependencies for jvm reachability analysis.

15.2.0 (Apr 30. 2026)

Add --package-managers <pms...> to compute-fixes-and-upgrade-purls and find-vulnerabilities to narrow fix computation/application to specific package managers within an ecosystem (e.g., only PNPM in a monorepo that mixes pnpm/yarn/npm). Accepts any value from PackageManagerEnum (NPM, PNPM, YARN, MAVEN, GRADLE, SBT, POETRY, PIP_REQUIREMENTS, PIPENV, GO, CARGO, NUGET, RUBYGEMS, COMPOSER, RUSH). When combined with --purl-types, both filters must match.

15.1.1 (Apr 30. 2026)

Major refactoring to fix computation.

15.1.0 (Apr 28. 2026)

First GA / non-prerelease version of the v15 line.

15.0.14 (Apr 28. 2026)

Expand the PHP --include-packages set to include runtime-companion packages (e.g. guzzlehttp/promises alongside guzzlehttp/guzzle) so that middleware/callback dispatch chains are not truncated by install-time filtering.

15.0.13 (Apr 27. 2026)

Update with improvements from v14.

15.0.12 (Apr 23. 2026)

Update spar to v0.1.0-26.

15.0.11 (Apr 23. 2026)

Update spar to v0.1.0-25.

15.0.10 (Apr 23. 2026)

Update spar to v0.1.0-24. Also fixes PHP reachability source locations so that file paths for dependency frames are relative to the package root (e.g., src/Cookie/CookieJar.php) instead of including the absolute coana-preinstall temp directory path.

15.0.9 (Apr 22. 2026)

The CLI now halts by default in socket mode when a Gradle or SBT project is missing the inputs that make MAVEN reachability analysis deterministic. A project is accepted when it has a gradle.lockfile, a libs.versions.toml version catalog (at the project or any ancestor directory), a build.sbt.lock, or a Socket-recognized CycloneDX / SPDX SBOM anywhere under the project root. Use --reach-continue-on-missing-lock-files to bypass the check.

15.0.8 (Apr 22. 2026)

Update spar to v0.1.0-23, which improves handling of magic methods and container patterns in the PHP reachability analysis.

15.0.7 (Apr 22. 2026)

Fix PHP/Composer reachability analysis in the published CLI package. The npm package build had stopped shipping the sparphp binaries, and the binary-path resolver used a filename that did not match the release artifacts, so running PHP reachability on a deployed CLI failed with spar-php binary not found.

15.0.6 (Apr 22. 2026)

The CLI now halts by default in socket mode when a workspace reports no source files for its ecosystem, instead of silently exiting 0 with a near-empty report. Use --reach-continue-on-no-source-files to bypass the check (e.g., for an empty subproject in a monorepo).

15.0.5 (Apr 22. 2026)

Skip pre-installing dependencies for ecosystems disabled via --purl-types and workspaces in excluded folders, avoiding unnecessary downloads during the pre-install phase.

15.0.4 (Apr 16. 2026)

Port v14 fixes to v15.

15.0.1 (Mar 30. 2026)

The CLI now halts by default on all analysis errors (install failures, timeouts, OOM, parse errors, low confidence results, etc.) in socket mode. Use --reach-continue-on-install-errors or --reach-continue-on-analysis-errors to fall back to precomputed (Tier 2) results.

14.12.223 (Apr 28. 2026)

The more performant JavaScript/TypeScript analysis engine is now the default. Differences in results should be minor, but a new --legacy-js-analysis-engine flag is available to keep current behavior.

14.12.222 (Apr 27. 2026)

Strip components flagged missingMetadata: true from the depscan compute-artifacts response (see depscan PR #19451) before writing .socket.facts.json. Surviving components keep their declared direct/dev/dead/toplevelAncestors fields (minus pruned dangling IDs); only dependencies edges are rewritten so the stripped scaffolding behaves as a transparent pass-through. This restores tier-1 reachability for transitive vulnerabilities behind private-registry/git/workspace wrappers, which were previously erased when the chain was broken.

14.12.221 (Apr 27. 2026)

Fixes for the JavaScript/TypeScript reachability analysis engine experiment.

14.12.220 (Apr 21. 2026)

Fixes for the JavaScript/TypeScript reachability analysis engine experiment.

14.12.219 (Apr 20. 2026)

Fixed silent dropping of symlinked manifest files during directory traversal. Symlinks pointing to regular files (e.g., pyproject.toml or uv.lock in monorepos) are now included, eliminating spurious "No workspace found for manifest file" warnings.

14.12.218 (Apr 17. 2026)

Fix Socket Fix corrupting Yarn Berry (Yarn 4) lockfiles when upgrading packages. The yarn.lock patcher now renames the stanza key to match the upgraded version and emits dependency ranges with the npm: descriptor prefix required by lockfile v8, so yarn install --mode=update-lockfile no longer fails with "isn't supported by any available resolver".

14.12.217 (Apr 16. 2026)

Improved error message when attempting to upgrade packages in Poetry projects. Instead of a generic "Unhandled manifest file" message, the CLI now clearly reports that the Poetry package manager is not currently supported for upgrades.

14.12.216 (Apr 16. 2026)

Use SIGTERM before SIGKILL when terminating long-running reachability analyses, giving processes a chance to clean up before being forcefully killed.

14.12.215 (Apr 14. 2026)

Fixes for the JavaScript/TypeScript reachability analysis engine experiment.

14.12.214 (Apr 13. 2026)

Fixes for the JavaScript/TypeScript reachability analysis engine experiment.

14.12.212 (Apr 11. 2026)

Fix log upload when autofix run succeeds and handle edge case when no fixes are applied in autofix finalization.

14.12.211 (Apr 10. 2026)

Fix pre-installed node_modules not being detected for npm projects nested inside multi-ecosystem repositories (e.g. a Node.js project inside a .NET solution), causing the CLI to unnecessarily re-download all packages.

14.12.210 (Apr 10. 2026)

Fixes for the JavaScript/TypeScript reachability analysis engine experiment.

14.12.209 (Apr 10. 2026)

Improvements to the telemetry produced by the JavaScript/TypeScript reachability analysis.

14.12.208 (Apr 09. 2026)

Fix TLS errors when running behind the Socket Firewall by properly handling proxy environment variables and CA certificates.

14.12.207 (Apr 09. 2026)

Bugfix for the JavaScript/TypeScript reachability analysis engine experiment.

14.12.205 (Apr 08. 2026)

Fix reachability analysis failing for all npm projects when running on Node.js 22 or later.

14.12.204 (Apr 08. 2026)

Experiment for a more performant implementation of the JavaScript/TypeScript reachability analysis engine.

14.12.203 (Apr 07. 2026)

Respect projectIgnorePaths from socket.yml in the compute-fixes-and-upgrade-purls command. Manifests on ignored paths are now excluded when applying fixes. Also fix YAML parsing of glob patterns like **/fixtures which were misinterpreted as YAML alias references.

14.12.202 (Apr 07. 2026)

Respect --purl-types when validating external tool dependencies and discovering projects. Previously, specifying --purl-types npm would still detect Python projects and fail if Python tooling (e.g. uv) was not installed.

14.12.201 (Mar 19. 2026)

Resolve .NET standard library packages from locally installed .NET runtimes for reachability analysis in socket mode.

14.12.200 (Mar 18. 2026)

In socket mode, validate required external tools before calling the compute-artifacts API, using the manifest file list to infer ecosystems early. External tool checks for the local (non-socket) run mode are disabled as they are not needed.

14.12.199 (Mar 17. 2026)

Fix issue where sbt projects with generated pom files where not handle correctly when applying dependency upgrades via Socket CLI.

14.12.198 (Mar 16. 2026)

Performance improvements for the Go reachability analysis.

14.12.197 (Mar 13. 2026)

Fixed a bug where Maven pom.xml file paths were doubled when recomputing Socket artifacts, causing upgrades to fail for Maven projects.

14.12.196 (Mar 12. 2026)

Require Node.js version 20 or higher for the run command.

14.12.195 (Mar 11. 2026)

Fix potential false positives in the JavaScript reachability analysis by fixing a bug where a safe version of a package could be incorrectly marked as vulnerable if another package in the dependency tree had a vulnerable version of the same package.

14.12.194 (Mar 11. 2026)

Fail the CLI early if required external dependencies like Python or specific required package managers are missing.

14.12.193 (Mar 10. 2026)

Fix a crash in the Go reachability analysis when no analysis runs are performed.

14.12.192 (Mar 10. 2026)

Make the set-up of the Python reachability analysis more robust.

14.12.191 (Mar 09. 2026)

Upgrade the Java reachability analysis to handle a bug where string class references were not handled correctly in decompiled class files.

14.12.190 (Mar 04. 2026)

Propagate activation_status from the compute-artifacts API response to tier 1 reachability entries in .socket.facts.json, allowing the Socket dashboard to display pattern quality levels for tier 1 results.

14.12.189 (Mar 02. 2026)

Filter out orphaned components not reachable from any direct dependency before writing .socket.facts.json.
This fixes validation errors on the Socket backend caused by platform-specific optional dependencies
(e.g. @rollup/rollup-freebsd-x64) that are resolved in lockfiles but not connected in the dependency graph.

14.12.188 (Mar 02. 2026)

Show a summary of how many workspaces were upgraded successfully and how many failed when using socket fix.

14.12.187 (Feb 26. 2026)

Fix error banner incorrectly attributing all analysis errors to the root project in socket mode.
The error banner now correctly shows which workspace each analysis error originated from.

14.12.186 (Feb 17. 2026)

Tweaks to the splitting logic in the Go reachability analysis to improve performance.

14.12.185 (Feb 13. 2026)

The Go reachability analysis can now split and analyze projects in multiple smaller chunks, which can improve performance and reduce memory usage.
Splitting is only performed if the project's package import graph easily decomposes into chunks with low overlap that are significantly smaller than the whole project.

14.12.184 (Feb 10. 2026)

Improvements to the telemetry produced by the Go reachability analysis.

14.12.183 (Feb 06. 2026)

Exclude application packages that do not directly or transitively import vulnerable packages in the Go reachability analysis.

14.12.182 (Feb 05. 2026)

Precision and soundness improvements for the Python reachability analysis.

14.12.181 (Feb 05. 2026)

Fix a crash in the Go reachability analysis caused by a bug in Go's type checker in Go 1.25.

14.12.180 (Feb 04. 2026)

Fix results summary to correctly categorize vulnerabilities without analysis checks as undeterminable instead of reachable.

14.12.179 (Feb 02. 2026)

Make termination checks (OOM/timeout) more consistent in the JavaScript/TypeScript reachability analysis.
The analysis now also ignores files larger than 512KiB.

14.12.178 (Jan 30. 2026)

--lazy-mode is now the default for JavaScript/Typescript reachability analysis. It can significantly speed up analysis by only analyzing code that is actually relevant for the vulnerabilities being analyzed.

14.12.177 (Jan 30. 2026)

Add early failure on Windows with an error message directing users to Linux, macOS, Docker, or WSL.

14.12.176 (Jan 30. 2026)

Increase --max-semi-space-size (garbage collector nursery size) to 128 MB for JavaScript/TypeScript analysis to improve performance on large codebases.

14.12.175 (Jan 29. 2026)

Improve JavaScript/TypeScript reachability analysis error handling and performance.

14.12.174 (Jan 29. 2026)

Fix bug where computeSocketFactArtifacts was called with absolute paths.

14.12.173 (Jan 27. 2026)

Add system information (OS, node version, memory limits) to telemetry data sent with scan reports.

14.12.172 (Jan 27. 2026)

Add system requirements check for vm.max_map_count on Linux to prevent analysis failures due to memory mapping limits.

14.12.171 (Jan 27. 2026)

Add OS free memory tracking to telemetry metrics.

14.12.170 (Jan 26. 2026)

Fix a performance bottleneck in vulnerable path computation in the Go reachability analysis.

14.12.169 (Jan 23. 2026)

Add free memory tracking to analyzer telemetry events.

14.12.168 (Jan 23. 2026)

Fix a bug in the JavaScript/TypeScript reachability analysis that could lead to re-analysis of modules when the containing package was installed in multiple locations.

14.12.167 (Jan 23. 2026)

Added GC logging to the detailed JavaScript/TypeScript analysis log file to help diagnose memory issues during analysis.

14.12.166 (Jan 22. 2026)

Add optional strace support for JavaScript/TypeScript analysis debugging. Set COANA_ANALYSIS_ENABLE_STRACE=true to capture system call traces to strace-output.txt.

14.12.165 (Jan 21. 2026)

Improved JavaScript/TypeScript analysis logging by capturing output in real-time when requesting the detailed analysis log file.

14.12.164 (Jan 20. 2026)

Add support for JELLY_ADDITIONAL_FLAGS environment variable to pass custom flags to the JavaScript/TypeScript reachability analysis.

14.12.163 (Jan 19. 2026)

Remove vulnerability reachability data from .socket.facts.json output.

14.12.162 (Jan 19. 2026)

Fix --include and --exclude patterns with trailing slashes not matching in socket fix command.

14.12.161 (Jan 18. 2026)

Fix telemetry collection on Alpine Linux and add Windows support for CPU/memory metrics.

14.12.160 (Jan 16. 2026)

Enforce a hard memory limit for the Go reachability analysis.
Previously, the memory limit was controlled by GOMEMLIMIT only, which can be exceeded in some cases.

14.12.159 (Jan 16. 2026)

Improvements for the JavaScript/TypeScript reachability analysis:

• General performance & precision improvements.
• Fixed a bug that made the analysis analyze files in explicitly excluded directories.

14.12.158 (Jan 16. 2026)

Fix incorrect classification of JavaScript/TypeScript reachability analysis crashes as "install errors" instead of "analysis errors".

14.12.157 (Jan 15. 2026)

Improve scalability for the JavaScript/TypeScript reachability analysis in --lazy-mode

14.12.156 (Jan 15. 2026)

Improvements for the Ruby reachability analysis:

• Fix Node v20 support.
• Fix installation of gems without source files (such as rails).

14.12.155 (Jan 15. 2026)

Fix a crash in the JavaScript/TypeScript reachability analysis when analyzing very large projects.

14.12.154 (Jan 14. 2026)

Mark NPM vulnerabilities with reachability UNKNOWN if analysis has low confidence in the result.

14.12.153 (Jan 14. 2026)

Minor update to diagnostics shared with the Socket backend when running reachability analysis for JavaScript/TypeScript projects through the Socket CLI.

14.12.152 (Jan 14. 2026)

Preparation for making --lazy-mode the default for JavaScript/TypeScript reachability analysis.
No user visible changes through the Socket CLI.

14.12.151 (Jan 13. 2026)

Share analysis progress with the Socket backend while running reachability analysis for Ruby projects through the Socket CLI.

14.12.150 (Jan 13. 2026)

Share analysis progress with the Socket backend while running reachability analysis for Go projects through the Socket CLI.

14.12.149 (Jan 9. 2026)

Share analysis progress with the Socket backend while running reachability analysis for Python projects through the Socket CLI.

14.12.148 (Jan 9. 2026)

Fix pip requirements.txt parsing to handle multi-line entries with backslash continuation and --hash options.
This fixes dependency upgrades for pip-compile generated requirements files.

14.12.147 (Jan 9. 2026)

Fix a bug where the excludeDirs option would only exclude subfolders of the specified directory, not the directory itself.

14.12.146 (Jan 9. 2026)

Share analysis progress with the Socket backend while running reachability analysis for JavaScript/TypeScript projects through the Socket CLI.

14.12.145 (Jan 8. 2026)

Soundness improvements for the Python reachability analysis.

14.12.144 (Jan 8. 2026)

Share memory and CPU usage metrics with the Socket backend while running reachability analysis through the Socket CLI.

14.12.143 (Jan 8. 2026)

Improved error logging when lockfile finalization fails during dependency upgrades.

14.12.142 (Jan 6. 2026)

Performance improvements for the JavaScript/TypeScript reachability analysis in --lazy-mode:
The analysis can now exclude even more modules that are guaranteed to be irrelevant for the vulnerabilities being analyzed.

14.12.141 (Jan 5. 2026)

Add heartbeat logging for long-running operations in the CLI.

14.12.140 (Jan 5. 2026)

Fix a bug where the CLI would crash when encountering NPM lock files in projects with no root package.json file.