upgrading coana to version 15.10.25 by socket-pr-bot[bot] · Pull Request #1516 · SocketDev/socket-cli

socket-pr-bot · 2026-08-27T12:43:24Z

Summary

Upgrades @coana-tech/cli from 15.10.24 to 15.10.25 and bumps the Socket CLI version to 1.1.161.
This PR was created automatically by a bot.

Coana Changelog

For details on what's included in this Coana release, see the Coana Changelogs.

Note

Low Risk
Dependency-only version bump with no application code changes; risk is limited to regressions inside the bundled Coana CLI.

Overview
Routine release bump that pins @coana-tech/cli from 15.10.24 to 15.10.25 and publishes Socket CLI 1.1.161. CHANGELOG.md, package.json, and pnpm-lock.yaml are updated; there are no Socket CLI source changes in this diff.

Coana behavior for reachability, manifest generation, and socket fix follows whatever is in the new Coana release—see Coana changelogs for details.

^{Reviewed by Cursor Bugbot for commit 2eeaf9c. Configure here.}

cursor

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issue.}

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 2eeaf9c. Configure here.}

…tion 1.1.161 never reached npm — 1.1.160 is still latest there — so no user can install what that section describes. Its tag and GitHub release are immutable and stay; the changelog documents the published package, and GitHub generates its own release notes from the PR list, so the two need not agree. The next bump derives 1.1.162 from the reachable tag either way, so nothing here affects the release tooling. How the section got there: #1516 wrote its heading as `## [Unreleased] - 2026-08-27`, and unreleasedRange() in scripts/release/changelog.mts locates the block by comparing the trimmed, lowercased heading for equality with `## [unreleased]`. The trailing date made it miss, so the release found nothing accrued, fell back to the commit-derived section, and inserted its own heading above the block it could not see — stranding `[Unreleased]` below a released version. - Drops the 1.1.161 section and returns the Coana 15.10.25 note to `## [Unreleased]`, to be promoted by the next release that ships. - Puts `## [Unreleased]` back at the top, without a date. - Leaves out "stop the coana bump from hand-writing versions": a release-workflow change with nothing for a user of the package to act on, which only appeared because the commit-derived fallback ran. - Files the Maven resolver fix under `[Unreleased]`. The locator's intolerance of a trailing date is left alone here; it wants its own change.

The rule against writing a `## [<version>]` heading did not say what the heading may look like when it is recreated, and #1516 shows why that matters. The bump wrote `## [1.1.161](...) - 2026-08-27`; the follow-up correction changed the version to `Unreleased` but kept the date, leaving `## [Unreleased] - 2026-08-27`. unreleasedRange() in scripts/release/changelog.mts matches that heading for equality — case-insensitively, but otherwise exactly — so the dated form is invisible to it. The release promoted nothing, fell back to the section derived from the commits in range, and inserted its own heading above the block it could not see. The note sat below a released version where no release would pick it up, and the version it named never reached npm. Pins the recreated heading to exactly `## [Unreleased]` and says why a date breaks promotion, so the next correction of a malformed heading lands on the form the release can actually find.

#1519) * fix(manifest): resolve Maven dependencies through Maven's own resolver The Maven facts extension collected the dependency graph with maven-dependency-tree, then re-resolved each artifact itself, passing the root module's repository list for every node in the tree. Maven resolves each node against the repositories that node's own descriptor lineage contributes, so a dependency served only by a repository declared in one module of a reactor could not be materialized for any other module that reached it. Aether's local repository also records which repository each cached file came from, so not even an already-downloaded copy counted as available, and --with-files aborted the scan on a dependency the build itself resolves without trouble. Resolution now goes through ProjectDependenciesResolver, the component Maven's own lifecycle uses to build a project's classpath. Per-node repositories, dependency management, scope derivation and reactor substitution are Maven's rather than a re-implementation of them, and failures are reported from Maven's own per-dependency errors. Which artifacts get fetched is expressed as a DependencyFilter, so a plain --facts run collects without downloading anything and a reactor sibling's jar is never requested at the validate phase the CLI runs, where nothing has been packaged. A filtered-out node yields no ArtifactResult, so it can never be mistaken for a resolution failure. Coordinate ids keep Maven's `type` rather than Aether's file extension, and versions use the base version so a resolved remote snapshot cannot leak a timestamped coordinate no manifest names. Conflict-losing nodes, which a verbose collect leaves in the graph, are skipped. Records are byte-identical to the previous output on the projects exercised here. Drops the bundled maven-dependency-tree; the extension jar goes 67K -> 26K. Adds two compat fixtures. repo-inheritance covers a dependency reachable only through a repository a sibling module declares, plus the fail-closed half: an unresolvable dependency must still be reported, since a silently missing jar leaves reachability blind to what it contains. duplicate-failure covers several modules failing on the same dependency, whose identical failures collapse in the value-equality accumulator shared across the reactor. The Maven matrix now spans 3.2.5 through 4.0.0-rc-6, the range the extension claims to support. * docs(changelog): restore [Unreleased] and drop the burned 1.1.161 section 1.1.161 never reached npm — 1.1.160 is still latest there — so no user can install what that section describes. Its tag and GitHub release are immutable and stay; the changelog documents the published package, and GitHub generates its own release notes from the PR list, so the two need not agree. The next bump derives 1.1.162 from the reachable tag either way, so nothing here affects the release tooling. How the section got there: #1516 wrote its heading as `## [Unreleased] - 2026-08-27`, and unreleasedRange() in scripts/release/changelog.mts locates the block by comparing the trimmed, lowercased heading for equality with `## [unreleased]`. The trailing date made it miss, so the release found nothing accrued, fell back to the commit-derived section, and inserted its own heading above the block it could not see — stranding `[Unreleased]` below a released version. - Drops the 1.1.161 section and returns the Coana 15.10.25 note to `## [Unreleased]`, to be promoted by the next release that ships. - Puts `## [Unreleased]` back at the top, without a date. - Leaves out "stop the coana bump from hand-writing versions": a release-workflow change with nothing for a user of the package to act on, which only appeared because the commit-derived fallback ran. - Files the Maven resolver fix under `[Unreleased]`. The locator's intolerance of a trailing date is left alone here; it wants its own change. * docs(bump-coana): forbid a date on the [Unreleased] heading The rule against writing a `## [<version>]` heading did not say what the heading may look like when it is recreated, and #1516 shows why that matters. The bump wrote `## [1.1.161](...) - 2026-08-27`; the follow-up correction changed the version to `Unreleased` but kept the date, leaving `## [Unreleased] - 2026-08-27`. unreleasedRange() in scripts/release/changelog.mts matches that heading for equality — case-insensitively, but otherwise exactly — so the dated form is invisible to it. The release promoted nothing, fell back to the section derived from the commits in range, and inserted its own heading above the block it could not see. The note sat below a released version where no release would pick it up, and the version it named never reached npm. Pins the recreated heading to exactly `## [Unreleased]` and says why a date breaks promotion, so the next correction of a malformed heading lands on the form the release can actually find.

upgrading coana to version 15.10.25

2eeaf9c

cursor Bot reviewed Aug 27, 2026

View reviewed changes

Comment thread CHANGELOG.md

Fix

0cdd075

Oskar Haarklou Veileborg (BarrensZeppelin) approved these changes Aug 27, 2026

View reviewed changes

Oskar Haarklou Veileborg (BarrensZeppelin) merged commit c4d76ae into v1.x Aug 27, 2026
8 checks passed

Oskar Haarklou Veileborg (BarrensZeppelin) deleted the coana-15.10.25 branch August 27, 2026 12:53

Jeppe Fredsgaard Blaabjerg (jfblaa) mentioned this pull request Aug 28, 2026

fix(manifest): resolve Maven dependencies through Maven's own resolver #1519

Merged

Navigation Menu

Uh oh!

upgrading coana to version 15.10.25 - #1516

upgrading coana to version 15.10.25#1516
Oskar Haarklou Veileborg (BarrensZeppelin) merged 2 commits into
v1.xfrom
coana-15.10.25

socket-pr-bot Bot commented Aug 27, 2026 •

edited by cursor Bot

Loading

Uh oh!

cursor Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

socket-pr-bot Bot commented Aug 27, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Coana Changelog

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

1 participant

socket-pr-bot Bot commented Aug 27, 2026 •

edited by cursor Bot

Loading