Merge remote-tracking branch 'origin/main' into lelia/ruff-ci-precommit-mccabe

# Conflicts:
#	CHANGELOG.md
#	socketsecurity/__init__.py

Author: lelia

.github/actions/setup-docker/action.yml

@@ -21,7 +21,7 @@ runs:
   steps:
     - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
       if: inputs.enable-qemu == 'true'
-    - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+    - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
     - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
       with:
         username: ${{ inputs.dockerhub-username }}

CHANGELOG.md

@@ -1,6 +1,6 @@
 # Changelog
 
-## 2.7.2
+## 2.7.3
 
 ### Fixed: package timestamps were truncated
 
@@ -35,6 +35,14 @@
   the configured log level and format. They now use the `socketcli` logger like
   the rest of the CLI.
 
+## 2.7.2
+
+### Changed: bump pinned @coana-tech/cli to 15.10.39
+
+- Bumped the pinned reachability engine (`@coana-tech/cli`) from `15.10.36` to
+  `15.10.39`. See the [Coana changelogs](https://docs.coana.tech/changelogs) for
+  engine changes.
+
 ## 2.7.1
 
 ### Changed: bump pinned @coana-tech/cli to 15.10.36

docs/cli-reference.md

@@ -275,7 +275,7 @@ If you don't want to provide the Socket API Token every time then you can use th
 | Parameter                        | Required | Default | Description                                                                                                                |
 |:---------------------------------|:---------|:--------|:---------------------------------------------------------------------------------------------------------------------------|
 | `--reach`                          | False    | False   | Enable reachability analysis to identify which vulnerable functions are actually called by your code. Creates a full application reachability scan (`scan_type=socket_tier1`). |
-| `--reach-version`                  | False    | 15.10.36 | Version of @coana-tech/cli to use. Defaults to the pinned version that ships with this CLI release, so the engine only changes when you upgrade the Socket CLI. Pass `latest` to always use the newest published version (opt-in auto-update), or an explicit version (e.g. `1.2.3`) to pin it. |
+| `--reach-version`                  | False    | 15.10.39 | Version of @coana-tech/cli to use. Defaults to the pinned version that ships with this CLI release, so the engine only changes when you upgrade the Socket CLI. Pass `latest` to always use the newest published version (opt-in auto-update), or an explicit version (e.g. `1.2.3`) to pin it. |
 | `--reach-analysis-timeout`         | False    | 10m     | Timeout for each reachability analysis run, e.g. `90s`, `10m` or `1h`. Omitted by default, so coana applies its own default (`10m`). Alias: `--reach-timeout` |
 | `--reach-analysis-memory-limit`    | False    | 8GB     | Memory limit for each reachability analysis run, e.g. `512MB` or `8GB`. Omitted by default, so coana applies its own default (`8GB`). Alias: `--reach-memory-limit` |
 | `--reach-concurrency`              | False    | 1       | Control parallel analysis execution (must be >= 1). Omitted by default, so coana applies its own default.                  |

pyproject.toml

@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.7.2"
+version = "2.7.3"
 requires-python = ">= 3.11"
 license = {"file" = "LICENSE"}
 dependencies = [
@@ -20,7 +20,7 @@ dependencies = [
     "beautifulsoup4==4.15.0",
     "markdown==3.10.3",
     "brotli==1.2.0; platform_python_implementation == 'CPython'",
-    "brotlicffi==1.2.0.1; platform_python_implementation != 'CPython'",
+    "brotlicffi==1.2.0.2; platform_python_implementation != 'CPython'",
 ]
 readme = "README.md"
 description = "Socket Security CLI for CI/CD"
@@ -47,9 +47,9 @@ test = [
     "pytest-watch==4.2.0"
 ]
 dev = [
-    "ruff==0.16.4",
+    "ruff==0.16.5",
     "twine==7.0.0", # for building
-    "uv==0.12.5",  # for dependency management
+    "uv==0.12.8",  # for dependency management
     "pre-commit==4.6.2",
     "hatch==1.18.0"
 ]

socketsecurity/__init__.py

@@ -1,3 +1,3 @@
 __author__ = "socket.dev"
-__version__ = "2.7.2"
+__version__ = "2.7.3"
 USER_AGENT = f"SocketPythonCLI/{__version__}"

socketsecurity/core/tools/reachability.py

@@ -19,7 +19,7 @@
 # Pinned @coana-tech/cli version. Bumped deliberately per Python CLI release so the
 # reachability engine version only changes through a standard pip upgrade (advance notice).
 # Pass --reach-version latest to opt into the newest published version instead.
-DEFAULT_COANA_CLI_VERSION: Final = "15.10.36"
+DEFAULT_COANA_CLI_VERSION: Final = "15.10.39"
 
 # Resolved @coana-tech/cli script paths from the npm-install fallback, keyed by version.
 # Lives for the process lifetime so repeated fallback invocations install only once
@@ -56,7 +56,7 @@ def __init__(self, sdk: socketdev, api_token: str):
 
     def _resolve_coana_package_spec(self, version: str | None = None) -> str:
         """
-        Resolve the @coana-tech/cli package spec to run (e.g. '@coana-tech/cli@15.10.36').
+        Resolve the @coana-tech/cli package spec to run (e.g. '@coana-tech/cli@15.10.39').
 
         Args:
             version: Coana CLI version to use.
@@ -65,7 +65,7 @@ def _resolve_coana_package_spec(self, version: str | None = None) -> str:
                 - '<semver>': that exact version.
 
         Returns:
-            str: The package specifier to use with npx (e.g. '@coana-tech/cli@15.10.36').
+            str: The package specifier to use with npx (e.g. '@coana-tech/cli@15.10.39').
         """
         return f"@coana-tech/cli@{self._resolve_coana_version(version)}"