Merge remote-tracking branch 'origin/main' into lelia/ce-433-sbom-docs

# Conflicts:
#	CHANGELOG.md

Author: lelia

CHANGELOG.md

@@ -1,6 +1,6 @@
 # Changelog
 
-## 2.11.12
+## 2.11.13
 
 ### Added: SBOM attestation on the Docker image
 
@@ -19,6 +19,15 @@
 - New [Docker image](docs/ci-cd.md#docker-image) section covering how to cache the
   reachability engine between container runs and keep image pulls cheap in CI.
 
+## 2.11.12
+
+### Changed: bump pinned Coana CLI to 15.14.2
+
+- Bumped the pinned reachability engine (the Coana CLI) from `15.14.1` to
+  `15.14.2`. See the
+  [reachability analysis changelog](https://docs.socket.dev/docs/reachability-analysis-changelog)
+  for engine changes.
+
 ## 2.11.11
 
 ### Changed: use lowercase Python CLI User-Agent

docs/cli-reference.md

@@ -338,7 +338,7 @@ If you don't want to provide the Socket API Token every time then you can use th
 | Parameter                        | Required | Default | Description                                                                                                                |
 |:---------------------------------|:---------|:--------|:---------------------------------------------------------------------------------------------------------------------------|
 | `--reach`                          | False    | False   | Enable reachability analysis to identify which vulnerable functions are actually called by your code. Creates a full application reachability scan (`scan_type=socket_tier1`). |
-| `--reach-version`                  | False    | 15.14.1 | Version of the Coana CLI to use. Defaults to the pinned version that ships with this CLI release, so the engine only changes when you upgrade the Socket CLI. Pass `latest` to always use the newest published version (opt-in auto-update), or an explicit version (e.g. `1.2.3`) to pin it. |
+| `--reach-version`                  | False    | 15.14.2 | Version of the Coana CLI to use. Defaults to the pinned version that ships with this CLI release, so the engine only changes when you upgrade the Socket CLI. Pass `latest` to always use the newest published version (opt-in auto-update), or an explicit version (e.g. `1.2.3`) to pin it. |
 | `--reach-analysis-timeout`         | False    | 10m     | Timeout for each reachability analysis run, e.g. `90s`, `10m` or `1h`. Omitted by default, so coana applies its own default (`10m`). Alias: `--reach-timeout` |
 | `--reach-analysis-memory-limit`    | False    | 8GB     | Memory limit for each reachability analysis run, e.g. `512MB` or `8GB`. Omitted by default, so coana applies its own default (`8GB`). Alias: `--reach-memory-limit` |
 | `--reach-concurrency`              | False    | 1       | Control parallel analysis execution (must be >= 1). Omitted by default, so coana applies its own default.                  |

pyproject.toml

@@ -1,12 +1,12 @@
 [build-system]
 requires = [
-  "hatchling==1.32.4"
+  "hatchling==1.33.0"
 ]
 build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.11.12"
+version = "2.11.13"
 requires-python = ">= 3.11"
 license = {"file" = "LICENSE"}
 dependencies = [
@@ -44,18 +44,18 @@ classifiers = [
 
 [project.optional-dependencies]
 test = [
-    "pytest==9.1.1",
+    "pytest==9.2.0",
     "pytest-cov==7.1.0",
     "pytest-mock==3.17.0",
-    "pytest-asyncio==1.4.0",
+    "pytest-asyncio==1.4.1",
     "pytest-watch==4.2.0"
 ]
 dev = [
-    "ruff==0.17.2",
+    "ruff==0.17.3",
     "twine==7.0.0", # for building
-    "uv==0.13.5",  # for dependency management
+    "uv==0.13.6",  # for dependency management
     "pre-commit==4.7.0",
-    "hatch==1.18.1"
+    "hatch==1.18.2"
 ]
 
 [project.scripts]

socketsecurity/__init__.py

@@ -1,4 +1,4 @@
 __author__ = 'socket.dev'
-__version__ = '2.11.12'
+__version__ = '2.11.13'
 USER_AGENT_NAME = 'socket-python-cli'
 USER_AGENT = f'{USER_AGENT_NAME}/{__version__}'

socketsecurity/core/tools/reachability.py

@@ -22,7 +22,7 @@
 # Pinned Coana CLI version. Bumped deliberately per Python CLI release so the
 # reachability engine version only changes through a standard pip upgrade (advance notice).
 # Pass --reach-version latest to opt into the newest published version instead.
-DEFAULT_COANA_CLI_VERSION: Final = "15.14.1"
+DEFAULT_COANA_CLI_VERSION: Final = "15.14.2"
 
 # Vendored from coana-package-manager, where it is generated; the only code that may read or
 # write the cache Coana shares with the Socket CLIs. See "Launching Coana" in that repo's