Bump pinned Coana CLI to 15.12.11 (#417)

* Bump pinned Coana CLI to 15.12.11

* Run reachability e2e on Node 22 and document the new minimum

Coana CLI 15.12.11 requires Node.js 22.13 or later. The e2e-reachability
job pinned Node 20, so the engine exited 3 before producing a facts file.

* Bump virtualenv to 21.14.12 to clear new pip-audit advisories

virtualenv is a dev-only transitive dependency (pre-commit, hatch). Four
advisories published against 21.12.1 failed the required dependency-audit
check. distlib moves with it.

---------

Co-authored-by: socket-pr-bot[bot] <294242679+socket-pr-bot[bot]@users.noreply.github.com>
Co-authored-by: lelia <2418071+lelia@users.noreply.github.com>

Author: socket-pr-bot[bot]

.github/workflows/e2e-test.yml

@@ -87,7 +87,7 @@ jobs:
       - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         if: matrix.setup-node == 'true'
         with:
-          node-version: '20'
+          node-version: '22'
 
       - name: Install CLI from local repo
         run: |

CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## 2.11.2
+
+### Changed: bump pinned Coana CLI to 15.12.11
+
+- Bumped the pinned reachability engine (the Coana CLI) from `15.12.10` to
+  `15.12.11`. See the
+  [reachability analysis changelog](https://docs.socket.dev/docs/reachability-analysis-changelog)
+  for engine changes.
+- Coana CLI `15.12.11` requires Node.js 22.13 or later (previously 20). On an older Node,
+  `--reach` fails with exit code 3 (with `--disable-blocking`, the scan continues without
+  reachability results). The Docker image already ships a newer Node, but if you run the CLI
+  directly (for example in CI), upgrade Node before upgrading the Socket CLI.
+
 ## 2.11.1
 
 ### Changed: bump pinned Coana CLI to 15.12.10

docs/cli-reference.md

@@ -338,7 +338,7 @@ If you don't want to provide the Socket API Token every time then you can use th
 | Parameter                        | Required | Default | Description                                                                                                                |
 |:---------------------------------|:---------|:--------|:---------------------------------------------------------------------------------------------------------------------------|
 | `--reach`                          | False    | False   | Enable reachability analysis to identify which vulnerable functions are actually called by your code. Creates a full application reachability scan (`scan_type=socket_tier1`). |
-| `--reach-version`                  | False    | 15.12.10 | Version of the Coana CLI to use. Defaults to the pinned version that ships with this CLI release, so the engine only changes when you upgrade the Socket CLI. Pass `latest` to always use the newest published version (opt-in auto-update), or an explicit version (e.g. `1.2.3`) to pin it. |
+| `--reach-version`                  | False    | 15.12.11 | Version of the Coana CLI to use. Defaults to the pinned version that ships with this CLI release, so the engine only changes when you upgrade the Socket CLI. Pass `latest` to always use the newest published version (opt-in auto-update), or an explicit version (e.g. `1.2.3`) to pin it. |
 | `--reach-analysis-timeout`         | False    | 10m     | Timeout for each reachability analysis run, e.g. `90s`, `10m` or `1h`. Omitted by default, so coana applies its own default (`10m`). Alias: `--reach-timeout` |
 | `--reach-analysis-memory-limit`    | False    | 8GB     | Memory limit for each reachability analysis run, e.g. `512MB` or `8GB`. Omitted by default, so coana applies its own default (`8GB`). Alias: `--reach-memory-limit` |
 | `--reach-concurrency`              | False    | 1       | Control parallel analysis execution (must be >= 1). Omitted by default, so coana applies its own default.                  |
@@ -359,7 +359,7 @@ If you don't want to provide the Socket API Token every time then you can use th
 **Reachability Analysis Requirements:**
 
 The Python CLI verifies the following **up front** (before invoking the analysis engine) and exits with code **3** if any are unmet:
-- `node` - Required to run the analysis engine (the Coana CLI). The engine needs Node.js 20 or later.
+- `node` - Required to run the analysis engine (the Coana CLI). The engine needs Node.js 22.13 or later.
 - `uv` - Required by the analysis engine
 - An **Enterprise** Socket organization plan (any `enterprise*` plan, including Enterprise trials)
 

pyproject.toml

@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.11.1"
+version = "2.11.2"
 requires-python = ">= 3.11"
 license = {"file" = "LICENSE"}
 dependencies = [

socketsecurity/__init__.py

@@ -1,3 +1,3 @@
 __author__ = 'socket.dev'
-__version__ = '2.11.1'
+__version__ = '2.11.2'
 USER_AGENT = f'SocketPythonCLI/{__version__}'

socketsecurity/core/tools/reachability.py

@@ -22,7 +22,7 @@
 # Pinned Coana CLI version. Bumped deliberately per Python CLI release so the
 # reachability engine version only changes through a standard pip upgrade (advance notice).
 # Pass --reach-version latest to opt into the newest published version instead.
-DEFAULT_COANA_CLI_VERSION: Final = "15.12.10"
+DEFAULT_COANA_CLI_VERSION: Final = "15.12.11"
 
 # Vendored from coana-package-manager, where it is generated; the only code that may read or
 # write the cache Coana shares with the Socket CLIs. See "Launching Coana" in that repo's