SocketDev · Jeppe Fredsgaard Blaabjerg (jfblaa) · Jul 31, 2026 · Jul 30, 2026 · Jul 30, 2026 · Jul 31, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -7,7 +7,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 ## [Unreleased]
 
 ### Changed
-- Updated the Coana CLI to v `15.9.7`.
+- Updated the Coana CLI to v `15.9.9`.
 - `socket scan view` now reads completed scans from Socket's cached immutable results, retrying briefly while a fresh scan finalizes; `--stream` keeps streaming live results.
 - `socket fix` vulnerability discovery now reads Coana's structured `--output-file` JSON result instead of parsing stdout, and warns when the Socket backend resolved 0 artifacts so an incomplete server-side resolve is surfaced instead of silently reporting "Finished!".
 

diff --git a/package.json b/package.json
@@ -97,7 +97,7 @@
     "@babel/preset-typescript": "7.27.1",
     "@babel/runtime": "7.28.4",
     "@biomejs/biome": "2.2.4",
-    "@coana-tech/cli": "15.9.7",
+    "@coana-tech/cli": "15.9.9",
     "@cyclonedx/cdxgen": "12.1.2",
     "@dotenvx/dotenvx": "1.49.0",
     "@eslint/compat": "1.3.2",

diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
diff --git a/src/commands/ci/handle-ci.mts b/src/commands/ci/handle-ci.mts
@@ -51,6 +51,7 @@ export async function handleCi(autoManifest: boolean): Promise<void> {
     pendingHead: true,
     pullRequest: 0,
     reach: {
+      dynamicSbomInference: false,
       excludePaths: [],
       reachAnalysisMemoryLimit: '',
       reachAnalysisTimeout: '',

diff --git a/src/commands/manifest/scripts/assemble.mts b/src/commands/manifest/scripts/assemble.mts
@@ -379,8 +379,8 @@ function buildArtifactPaths(
     }
     coords.add(coordKey)
     const pi = projectsByGav.get(gav(c.group, c.name, c.version ?? ''))
-    const sources = (pi?.sources ?? []).filter(fileExists)
-    const targets = [...new Set([...fn.targets, ...(pi?.targets ?? [])])]
+    const sources = (pi?.sources ?? []).filter(fileExists).sort()
+    const targets = [...new Set(pi ? pi.targets : fn.targets)]
       .filter(fileExists)
       .sort()
     if (sources.length) {

diff --git a/src/commands/scan/cmd-scan-create.mts b/src/commands/scan/cmd-scan-create.mts
@@ -241,6 +241,7 @@ async function run(
     committers,
     cwd: cwdOverride,
     defaultBranch,
+    dynamicSbomInference,
     interactive = true,
     json,
     markdown,
@@ -275,6 +276,7 @@ async function run(
     committers: string
     cwd: string
     defaultBranch: boolean
+    dynamicSbomInference: boolean
     interactive: boolean
     json: boolean
     markdown: boolean
@@ -353,6 +355,11 @@ async function run(
       autoManifest = false
     }
   }
+  // --dynamic-sbom-inference requires auto-manifest to generate the
+  // per-workspace facts it feeds to Coana.
+  if (dynamicSbomInference) {
+    autoManifest = true
+  }
   if (!branchName) {
     if (sockJson.defaults?.scan?.create?.branch) {
       branchName = sockJson.defaults.scan.create.branch
@@ -505,6 +512,7 @@ async function run(
     reachVersion !== reachabilityFlags['reachVersion']?.default
 
   const isUsingAnyReachabilityFlags =
+    dynamicSbomInference ||
     hasReachEcosystems ||
     hasReachExcludePaths ||
     isUsingNonDefaultAnalytics ||
@@ -625,6 +633,7 @@ async function run(
     pendingHead: Boolean(pendingHead),
     pullRequest: Number(pullRequest),
     reach: {
+      dynamicSbomInference: Boolean(dynamicSbomInference),
       excludePaths,
       reachAnalysisMemoryLimit,
       reachAnalysisTimeout,

diff --git a/src/commands/scan/cmd-scan-reach.mts b/src/commands/scan/cmd-scan-reach.mts
@@ -267,6 +267,9 @@ async function run(
     outputKind,
     outputPath: outputPath || '',
     reachabilityOptions: {
+      // Not exposed here: it relies on --auto-manifest generating per-workspace
+      // Socket facts first, which `socket scan reach` never runs.
+      dynamicSbomInference: false,
       excludePaths,
       reachAnalysisMemoryLimit,
       reachAnalysisTimeout,

diff --git a/src/commands/scan/create-scan-from-github.mts b/src/commands/scan/create-scan-from-github.mts
@@ -253,6 +253,7 @@ async function scanOneRepo(
     pendingHead: true,
     pullRequest: 0,
     reach: {
+      dynamicSbomInference: false,
       excludePaths: [],
       reachAnalysisMemoryLimit: '',
       reachAnalysisTimeout: '',

diff --git a/src/commands/scan/exclude-paths.test.mts b/src/commands/scan/exclude-paths.test.mts
@@ -14,6 +14,7 @@ function makeReachOptions(
   overrides: Partial<ReachabilityOptions> = {},
 ): ReachabilityOptions {
   return {
+    dynamicSbomInference: false,
     excludePaths: [],
     reachAnalysisMemoryLimit: '8192',
     reachAnalysisTimeout: '',

diff --git a/src/commands/scan/handle-create-new-scan.test.mts b/src/commands/scan/handle-create-new-scan.test.mts
@@ -86,6 +86,7 @@ function createConfig(
     pendingHead: false,
     pullRequest: 0,
     reach: {
+      dynamicSbomInference: false,
       excludePaths: [],
       reachAnalysisMemoryLimit: '8192',
       reachAnalysisTimeout: '',
@@ -198,6 +199,7 @@ describe('handleCreateNewScan excludePaths', () => {
       pendingHead: false,
       pullRequest: 0,
       reach: {
+        dynamicSbomInference: false,
         excludePaths: ['tests', 'packages/*'],
         reachAnalysisMemoryLimit: '8192',
         reachAnalysisTimeout: '',
@@ -261,6 +263,7 @@ describe('handleCreateNewScan excludePaths', () => {
       pendingHead: false,
       pullRequest: 0,
       reach: {
+        dynamicSbomInference: false,
         excludePaths: ['apps/api/tests', '**/dist'],
         reachAnalysisMemoryLimit: '8192',
         reachAnalysisTimeout: '',
@@ -330,6 +333,7 @@ describe('handleCreateNewScan excludePaths', () => {
       pendingHead: false,
       pullRequest: 0,
       reach: {
+        dynamicSbomInference: false,
         excludePaths: ['tests'],
         reachAnalysisMemoryLimit: '8192',
         reachAnalysisTimeout: '',
@@ -389,6 +393,7 @@ describe('handleCreateNewScan excludePaths', () => {
       pendingHead: false,
       pullRequest: 0,
       reach: {
+        dynamicSbomInference: false,
         excludePaths: ['apps/api'],
         reachAnalysisMemoryLimit: '8192',
         reachAnalysisTimeout: '',
@@ -448,6 +453,7 @@ describe('handleCreateNewScan excludePaths', () => {
       pendingHead: false,
       pullRequest: 0,
       reach: {
+        dynamicSbomInference: false,
         excludePaths: ['tests'],
         reachAnalysisMemoryLimit: '8192',
         reachAnalysisTimeout: '',

diff --git a/src/commands/scan/handle-scan-reach.test.mts b/src/commands/scan/handle-scan-reach.test.mts
@@ -104,6 +104,7 @@ describe('handleScanReach', () => {
 
   it('applies excludePaths to manifest discovery and reachability analysis', async () => {
     const reachabilityOptions = {
+      dynamicSbomInference: false,
       excludePaths: ['tests', 'packages/*'],
       reachAnalysisMemoryLimit: '8192',
       reachAnalysisTimeout: '',
@@ -156,6 +157,7 @@ describe('handleScanReach', () => {
 
   it('translates excludePaths from the scan root for nested targets', async () => {
     const reachabilityOptions = {
+      dynamicSbomInference: false,
       excludePaths: ['apps/api/tests', '**/dist'],
       reachAnalysisMemoryLimit: '8192',
       reachAnalysisTimeout: '',
@@ -218,6 +220,7 @@ describe('handleScanReach', () => {
         checks.every(check => check.test),
     )
     const reachabilityOptions = {
+      dynamicSbomInference: false,
       excludePaths: ['apps/api'],
       reachAnalysisMemoryLimit: '8192',
       reachAnalysisTimeout: '',
@@ -266,6 +269,7 @@ describe('handleScanReach', () => {
     mockFindSocketYmlSync.mockReturnValueOnce({ ok: false })
 
     const reachabilityOptions = {
+      dynamicSbomInference: false,
       excludePaths: ['tests'],
       reachAnalysisMemoryLimit: '8192',
       reachAnalysisTimeout: '',
@@ -318,6 +322,7 @@ describe('handleScanReach', () => {
       },
     })
     const reachabilityOptions = {
+      dynamicSbomInference: false,
       excludePaths: [],
       reachAnalysisMemoryLimit: '8192',
       reachAnalysisTimeout: '',
@@ -355,6 +360,7 @@ describe('handleScanReach', () => {
 
   it('does not call finalize when Coana did not return a full application reachability scan id', async () => {
     const reachabilityOptions = {
+      dynamicSbomInference: false,
       excludePaths: [],
       reachAnalysisMemoryLimit: '8192',
       reachAnalysisTimeout: '',
@@ -405,6 +411,7 @@ describe('handleScanReach', () => {
       cause: 'Socket API server error (503)',
     })
     const reachabilityOptions = {
+      dynamicSbomInference: false,
       excludePaths: [],
       reachAnalysisMemoryLimit: '8192',
       reachAnalysisTimeout: '',

diff --git a/src/commands/scan/perform-reachability-analysis.mts b/src/commands/scan/perform-reachability-analysis.mts
@@ -22,6 +22,7 @@ import type { Spinner } from '@socketsecurity/registry/lib/spinner'
 import type { StdioOptions } from 'node:child_process'
 
 export type ReachabilityOptions = {
+  dynamicSbomInference: boolean
   excludePaths: string[]
   reachAnalysisMemoryLimit: string
   reachAnalysisTimeout: string
@@ -251,6 +252,9 @@ export async function performReachabilityAnalysis(
     ...(reachabilityOptions.reachExcludePaths.length
       ? ['--exclude-dirs', ...reachabilityOptions.reachExcludePaths]
       : []),
+    ...(reachabilityOptions.dynamicSbomInference
+      ? ['--maven-use-only-root-socket-facts']
+      : []),
     ...(reachabilityOptions.reachLazyMode ? ['--lazy-mode'] : []),
     ...(reachabilityOptions.reachSkipCache ? ['--skip-cache-usage'] : []),
     ...(reachabilityOptions.reachUseOnlyPregeneratedSboms

diff --git a/src/commands/scan/perform-reachability-analysis.test.mts b/src/commands/scan/perform-reachability-analysis.test.mts
@@ -75,6 +75,7 @@ vi.mock('@socketsecurity/registry/lib/logger', () => ({
 
 function makeReachabilityOptions(): ReachabilityOptions {
   return {
+    dynamicSbomInference: false,
     excludePaths: [],
     reachAnalysisMemoryLimit: '',
     reachAnalysisTimeout: '',

diff --git a/src/commands/scan/reachability-flags.mts b/src/commands/scan/reachability-flags.mts
@@ -4,6 +4,13 @@ import { getReachabilityEcosystemChoices } from '../../utils/ecosystem.mts'
 import type { MeowFlags } from '../../flags.mts'
 
 export const reachabilityFlags: MeowFlags = {
+  dynamicSbomInference: {
+    type: 'boolean',
+    default: false,
+    hidden: true,
+    description:
+      'Internal: enables dynamic SBOM inference for full application reachability analysis. Passes --maven-use-only-root-socket-facts to Coana and implies --auto-manifest.',
+  },
   reachVersion: {
     type: 'string',
     description: `Override the version of @coana-tech/cli used for reachability analysis. Default: ${constants.ENV.INLINED_SOCKET_CLI_COANA_TECH_CLI_VERSION}.`,