upgrading coana to version 14.12.194 (#1114)

* upgrading coana to version 14.12.194 and adding --disable-external-tool-checks flag

* add uv to e2e tests

* install uv directly

* improve Coana error logging and add e2e test retries

- Include exit code and signal in Coana failure messages
- Log Coana version, target, and cwd on reachability analysis failure
- Add retry: 2 to all scan reach e2e tests for transient CI failures

Author: mtorp

.github/workflows/e2e-tests.yml

@@ -26,6 +26,9 @@ jobs:
         with:
           node-version: ${{ matrix.node-version }}
 
+      - name: Install uv
+        run: curl -LsSf https://astral.sh/uv/install.sh | sh
+
       - name: Build
         run: pnpm run build
 

CHANGELOG.md

@@ -4,6 +4,11 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## [1.1.70](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.70) - 2026-03-11
+
+### Changed
+- Updated the Coana CLI to v `14.12.194`.
+
 ## [1.1.69](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.69) - 2026-03-10
 
 ### Changed

package.json

@@ -1,6 +1,6 @@
 {
   "name": "socket",
-  "version": "1.1.69",
+  "version": "1.1.70",
   "description": "CLI for Socket.dev",
   "homepage": "https://github.com/SocketDev/socket-cli",
   "license": "MIT AND OFL-1.1",
@@ -97,7 +97,7 @@
     "@babel/preset-typescript": "7.27.1",
     "@babel/runtime": "7.28.4",
     "@biomejs/biome": "2.2.4",
-    "@coana-tech/cli": "14.12.192",
+    "@coana-tech/cli": "14.12.194",
     "@cyclonedx/cdxgen": "11.11.0",
     "@dotenvx/dotenvx": "1.49.0",
     "@eslint/compat": "1.3.2",

pnpm-lock.yaml

@@ -57,6 +57,7 @@ export async function handleCi(autoManifest: boolean): Promise<void> {
       reachDebug: false,
       reachDetailedAnalysisLogFile: false,
       reachDisableAnalytics: false,
+      reachDisableExternalToolChecks: false,
       reachEcosystems: [],
       reachEnableAnalysisSplitting: false,
       reachExcludePaths: [],

src/commands/ci/handle-ci.mts

@@ -154,6 +154,11 @@ Available styles:
       'Enable debug logging in the Coana-based Socket Fix CLI invocation.',
     shortFlag: 'd',
   },
+  disableExternalToolChecks: {
+    type: 'boolean',
+    default: false,
+    description: 'Disable external tool checks during fix analysis.',
+  },
   ecosystems: {
     type: 'string',
     default: [],
@@ -294,6 +299,7 @@ async function run(
     applyFixes,
     autopilot,
     debug,
+    disableExternalToolChecks,
     ecosystems,
     exclude,
     fixVersion,
@@ -317,6 +323,7 @@ async function run(
     applyFixes: boolean
     autopilot: boolean
     debug: boolean
+    disableExternalToolChecks: boolean
     ecosystems: string[]
     exclude: string[]
     fixVersion: string | undefined
@@ -426,6 +433,7 @@ async function run(
     coanaVersion: fixVersion,
     cwd,
     debug,
+    disableExternalToolChecks,
     disableMajorUpdates,
     ecosystems: validatedEcosystems,
     exclude: excludePatterns,

src/commands/fix/cmd-fix.mts

@@ -119,6 +119,7 @@ export async function coanaFix(
     coanaVersion,
     cwd,
     debug,
+    disableExternalToolChecks,
     disableMajorUpdates,
     ecosystems,
     exclude,
@@ -266,6 +267,9 @@ export async function coanaFix(
           '--output-file',
           tmpFile,
           ...(debug ? ['--debug'] : []),
+          ...(disableExternalToolChecks
+            ? ['--disable-external-tool-checks']
+            : []),
           ...(disableMajorUpdates ? ['--disable-major-updates'] : []),
           ...(showAffectedDirectDependencies
             ? ['--show-affected-direct-dependencies']
@@ -418,6 +422,9 @@ export async function coanaFix(
         ...(exclude.length ? ['--exclude', ...exclude] : []),
         ...(ecosystems.length ? ['--purl-types', ...ecosystems] : []),
         ...(debug ? ['--debug'] : []),
+        ...(disableExternalToolChecks
+          ? ['--disable-external-tool-checks']
+          : []),
         ...(disableMajorUpdates ? ['--disable-major-updates'] : []),
         ...(showAffectedDirectDependencies
           ? ['--show-affected-direct-dependencies']

src/commands/fix/coana-fix.mts

@@ -120,6 +120,7 @@ export async function handleFix({
   coanaVersion,
   cwd,
   debug,
+  disableExternalToolChecks,
   disableMajorUpdates,
   ecosystems,
   exclude,
@@ -146,6 +147,7 @@ export async function handleFix({
     coanaVersion,
     cwd,
     debug,
+    disableExternalToolChecks,
     disableMajorUpdates,
     ecosystems,
     exclude,
@@ -171,6 +173,7 @@ export async function handleFix({
       coanaVersion,
       cwd,
       debug,
+      disableExternalToolChecks,
       disableMajorUpdates,
       ecosystems,
       exclude,

src/commands/fix/handle-fix.mts

@@ -9,6 +9,7 @@ export type FixConfig = {
   coanaVersion: string | undefined
   cwd: string
   debug: boolean
+  disableExternalToolChecks: boolean
   disableMajorUpdates: boolean
   ecosystems: PURL_Type[]
   exclude: string[]

src/commands/fix/types.mts

@@ -244,6 +244,7 @@ async function run(
     reachDetailedAnalysisLogFile,
     reachDisableAnalysisSplitting: _reachDisableAnalysisSplitting,
     reachDisableAnalytics,
+    reachDisableExternalToolChecks,
     reachEnableAnalysisSplitting,
     reachLazyMode,
     reachSkipCache,
@@ -277,6 +278,7 @@ async function run(
     reachDetailedAnalysisLogFile: boolean
     reachDisableAnalysisSplitting: boolean
     reachDisableAnalytics: boolean
+    reachDisableExternalToolChecks: boolean
     reachEnableAnalysisSplitting: boolean
     reachLazyMode: boolean
     reachSkipCache: boolean
@@ -580,6 +582,7 @@ async function run(
       reachDebug: Boolean(reachDebug),
       reachDetailedAnalysisLogFile: Boolean(reachDetailedAnalysisLogFile),
       reachDisableAnalytics: Boolean(reachDisableAnalytics),
+      reachDisableExternalToolChecks: Boolean(reachDisableExternalToolChecks),
       reachEcosystems,
       reachEnableAnalysisSplitting: Boolean(reachEnableAnalysisSplitting),
       reachExcludePaths,