Bump pinned @coana-tech/cli to 15.10.4 (#291)

* Bump pinned @coana-tech/cli to 15.10.4

* Rev version to 2.6.3, consolidating the unpublished 2.6.2 notes

2.6.1 shipped while this PR was in flight, and the 2.6.2 version bump on
main was never published. Fold the 2.6.2 changelog entry, the Dependabot
updates, and the dev/test dependency pinning into the 2.6.3 entry.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* Trim dependency-update specifics in the 2.6.3 changelog entry

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: socket-pr-bot[bot] <294242679+socket-pr-bot[bot]@users.noreply.github.com>
Co-authored-by: lelia <2418071+lelia@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: 3 people

CHANGELOG.md

@@ -1,6 +1,6 @@
 # Changelog
 
-## 2.6.2
+## 2.6.3
 
 ### Fixed: SBOM fetch failures no longer produce empty reports
 
@@ -13,6 +13,21 @@
   instead of raising, and individual unparseable artifacts are skipped rather
   than failing the whole response.
 
+### Changed: bump pinned @coana-tech/cli to 15.10.4
+
+- Bumped the pinned reachability engine (`@coana-tech/cli`) from `15.10.3` to
+  `15.10.4`. See the [Coana changelogs](https://docs.coana.tech/changelogs) for
+  engine changes.
+
+### Changed: dependency updates and dev/test dependency pinning
+
+- Bumped pinned runtime dependencies (`beautifulsoup4` `4.15.0`,
+  `markdown` `3.10.3`).
+- Pinned the `test` and `dev` dependency groups to exact versions, extending
+  the exact-pinning policy introduced in 2.6.0 to all dependency groups.
+- Updated GitHub Actions used in CI workflows. No effect on the installed
+  CLI.
+
 ## 2.6.1
 
 ### Changed: scan comparison now polls the diff-scans endpoints

docs/cli-reference.md

@@ -275,7 +275,7 @@ If you don't want to provide the Socket API Token every time then you can use th
 | Parameter                        | Required | Default | Description                                                                                                                |
 |:---------------------------------|:---------|:--------|:---------------------------------------------------------------------------------------------------------------------------|
 | `--reach`                          | False    | False   | Enable reachability analysis to identify which vulnerable functions are actually called by your code. Creates a full application reachability scan (`scan_type=socket_tier1`). |
-| `--reach-version`                  | False    | 15.10.3 | Version of @coana-tech/cli to use. Defaults to the pinned version that ships with this CLI release, so the engine only changes when you upgrade the Socket CLI. Pass `latest` to always use the newest published version (opt-in auto-update), or an explicit version (e.g. `1.2.3`) to pin it. |
+| `--reach-version`                  | False    | 15.10.4 | Version of @coana-tech/cli to use. Defaults to the pinned version that ships with this CLI release, so the engine only changes when you upgrade the Socket CLI. Pass `latest` to always use the newest published version (opt-in auto-update), or an explicit version (e.g. `1.2.3`) to pin it. |
 | `--reach-analysis-timeout`         | False    | 10m     | Timeout for each reachability analysis run, e.g. `90s`, `10m` or `1h`. Omitted by default, so coana applies its own default (`10m`). Alias: `--reach-timeout` |
 | `--reach-analysis-memory-limit`    | False    | 8GB     | Memory limit for each reachability analysis run, e.g. `512MB` or `8GB`. Omitted by default, so coana applies its own default (`8GB`). Alias: `--reach-memory-limit` |
 | `--reach-concurrency`              | False    | 1       | Control parallel analysis execution (must be >= 1). Omitted by default, so coana applies its own default.                  |

pyproject.toml

@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.6.2"
+version = "2.6.3"
 requires-python = ">= 3.11"
 license = {"file" = "LICENSE"}
 dependencies = [

socketsecurity/__init__.py

@@ -1,3 +1,3 @@
 __author__ = 'socket.dev'
-__version__ = '2.6.2'
+__version__ = '2.6.3'
 USER_AGENT = f'SocketPythonCLI/{__version__}'

socketsecurity/core/tools/reachability.py

@@ -18,7 +18,7 @@
 # Pinned @coana-tech/cli version. Bumped deliberately per Python CLI release so the
 # reachability engine version only changes through a standard pip upgrade (advance notice).
 # Pass --reach-version latest to opt into the newest published version instead.
-DEFAULT_COANA_CLI_VERSION: Final = "15.10.3"
+DEFAULT_COANA_CLI_VERSION: Final = "15.10.4"
 
 # Resolved @coana-tech/cli script paths from the npm-install fallback, keyed by version.
 # Lives for the process lifetime so repeated fallback invocations install only once
@@ -55,7 +55,7 @@ def __init__(self, sdk: socketdev, api_token: str):
 
     def _resolve_coana_package_spec(self, version: Optional[str] = None) -> str:
         """
-        Resolve the @coana-tech/cli package spec to run (e.g. '@coana-tech/cli@15.10.3').
+        Resolve the @coana-tech/cli package spec to run (e.g. '@coana-tech/cli@15.10.4').
 
         Args:
             version: Coana CLI version to use.
@@ -64,7 +64,7 @@ def _resolve_coana_package_spec(self, version: Optional[str] = None) -> str:
                 - '<semver>': that exact version.
 
         Returns:
-            str: The package specifier to use with npx (e.g. '@coana-tech/cli@15.10.3').
+            str: The package specifier to use with npx (e.g. '@coana-tech/cli@15.10.4').
         """
         return f"@coana-tech/cli@{self._resolve_coana_version(version)}"