Skip to content

deps(engine): bump @socketsecurity/cli from 1.8.3 to 1.10.0 - #216

Merged
underpostnet merged 1 commit into
masterfrom
dependabot/npm_and_yarn/socketsecurity/cli-1.10.0
Oct 27, 2026
Merged

underpostnet merged 1 commit into
masterfrom
dependabot/npm_and_yarn/socketsecurity/cli-1.10.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 26, 2026

Copy link
Copy Markdown
Contributor

Bumps @socketsecurity/cli from 1.8.3 to 1.10.0.

Release notes

Sourced from @​socketsecurity/cli's releases.

v1.10.0

What's Changed

Full Changelog: SocketDev/socket-cli@v1.9.1...v1.10.0

v1.9.1

What's Changed

Full Changelog: SocketDev/socket-cli@v1.9.0...v1.9.1

v1.9.0

What's Changed

Full Changelog: SocketDev/socket-cli@v1.8.4...v1.9.0

v1.8.4

What's Changed

Full Changelog: SocketDev/socket-cli@v1.8.3...v1.8.4

Changelog

Sourced from @​socketsecurity/cli's changelog.

1.10.0 - 2026-10-22

Added

  • socket manifest dynamic-sbom-inference --ignore-unresolved keeps going past unresolved JVM dependencies in every discovered build.

Fixed

  • --dynamic-sbom-inference honors each build's verbose setting in socket.json.
  • JVM resolution failures name the dependency that failed, the subproject and scope that needed it, and suggest only options the command you ran accepts, pointing at the failing build's own socket.json.
  • Unresolved JVM dependencies are reported and left out of the Socket facts for Maven, Gradle and sbt alike, as far as each build tool identifies them; a Maven dependency in an excluded scope no longer blocks the run.
  • An sbt project with an unresolved dependency keeps the rest of its dependencies instead of silently losing all of them.
  • socket scan create and socket scan reach warn about --ignore-unresolved, --exclude-configs, --include-configs and --verbose, which they read from socket.json instead.
  • When a build tool cannot be started, the error says why, for example a missing mvn.

1.9.1 - 2026-10-21

Changed

  • Updated the Coana CLI to v 15.12.11.

1.9.0 - 2026-10-20

Changed

  • The Coana CLI is now downloaded from Socket's servers instead of npm, and is now cached in $XDG_CACHE_HOME/socket/coana (~/.cache/socket/coana by default).
  • Updated the Coana CLI to v 15.12.10.

Removed

  • The SOCKET_CLI_COANA_LAUNCHER environment variable no longer has an effect.

1.8.4 - 2026-10-16

Changed

  • socket fix now exits with code 5 when it computed fixes it could not apply, matching the Coana CLI. Automation can tell this apart from a failed run, which still exits with 1. The --output-file JSON lists the unapplied fixes under notApplied.
  • Updated the Coana CLI to v 15.12.9.
Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [@socketsecurity/cli](https://github.com/SocketDev/socket-cli) from 1.8.3 to 1.10.0.
- [Release notes](https://github.com/SocketDev/socket-cli/releases)
- [Changelog](https://github.com/SocketDev/socket-cli/blob/v1.10.0/CHANGELOG.md)
- [Commits](SocketDev/socket-cli@v1.8.3...v1.10.0)

---
updated-dependencies:
- dependency-name: "@socketsecurity/cli"
  dependency-version: 1.10.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Oct 26, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: dependencies, engine. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@socket-security

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Updated@​socketsecurity/​cli@​1.8.3 ⏵ 1.10.098 -110010098 +1100

View full report

@underpostnet
underpostnet merged commit b2b6f8a into master Oct 27, 2026
14 checks passed
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/socketsecurity/cli-1.10.0 branch October 27, 2026 18:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant