Bump pinned @coana-tech/cli to 15.10.13 (#300)

* Bump pinned @coana-tech/cli to 15.10.13

* Bump pinned GitPython to 3.1.59

GitPython 3.1.57 is affected by six advisories fixed in 3.1.58
(published 2026-08-07) and five more fixed in 3.1.59 (published
2026-08-10). Pin the latest so the pip-audit gate stays green once the
newer advisories propagate to the audit databases. None of the affected
GitPython APIs are used by this CLI.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

---------

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>
Co-authored-by: socket-pr-bot[bot] <294242679+socket-pr-bot[bot]@users.noreply.github.com>
Co-authored-by: lelia <2418071+lelia@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: 3 people

CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## 2.6.4
+
+### Changed: bump pinned @coana-tech/cli to 15.10.13
+
+- Bumped the pinned reachability engine (`@coana-tech/cli`) from `15.10.4` to
+  `15.10.13`. See the [Coana changelogs](https://docs.coana.tech/changelogs) for
+  engine changes.
+
+### Changed: bump pinned GitPython to 3.1.59
+
+- Bumped `GitPython` from `3.1.57` to `3.1.59`, picking up the security fixes
+  released in GitPython 3.1.58 and 3.1.59. None of the affected GitPython APIs
+  are used by this CLI.
+
 ## 2.6.3
 
 ### Fixed: SBOM fetch failures no longer produce empty reports

docs/cli-reference.md

@@ -275,7 +275,7 @@ If you don't want to provide the Socket API Token every time then you can use th
 | Parameter                        | Required | Default | Description                                                                                                                |
 |:---------------------------------|:---------|:--------|:---------------------------------------------------------------------------------------------------------------------------|
 | `--reach`                          | False    | False   | Enable reachability analysis to identify which vulnerable functions are actually called by your code. Creates a full application reachability scan (`scan_type=socket_tier1`). |
-| `--reach-version`                  | False    | 15.10.4 | Version of @coana-tech/cli to use. Defaults to the pinned version that ships with this CLI release, so the engine only changes when you upgrade the Socket CLI. Pass `latest` to always use the newest published version (opt-in auto-update), or an explicit version (e.g. `1.2.3`) to pin it. |
+| `--reach-version`                  | False    | 15.10.13 | Version of @coana-tech/cli to use. Defaults to the pinned version that ships with this CLI release, so the engine only changes when you upgrade the Socket CLI. Pass `latest` to always use the newest published version (opt-in auto-update), or an explicit version (e.g. `1.2.3`) to pin it. |
 | `--reach-analysis-timeout`         | False    | 10m     | Timeout for each reachability analysis run, e.g. `90s`, `10m` or `1h`. Omitted by default, so coana applies its own default (`10m`). Alias: `--reach-timeout` |
 | `--reach-analysis-memory-limit`    | False    | 8GB     | Memory limit for each reachability analysis run, e.g. `512MB` or `8GB`. Omitted by default, so coana applies its own default (`8GB`). Alias: `--reach-memory-limit` |
 | `--reach-concurrency`              | False    | 1       | Control parallel analysis execution (must be >= 1). Omitted by default, so coana applies its own default.                  |

pyproject.toml

@@ -6,14 +6,14 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.6.3"
+version = "2.6.4"
 requires-python = ">= 3.11"
 license = {"file" = "LICENSE"}
 dependencies = [
     "requests==2.34.2",
     "mdutils==1.8.1",
     "prettytable==3.18.0",
-    "GitPython==3.1.57",
+    "GitPython==3.1.59",
     "packaging==26.2",
     "python-dotenv==1.2.2",
     "socketdev==3.5.0",

socketsecurity/__init__.py

@@ -1,3 +1,3 @@
 __author__ = 'socket.dev'
-__version__ = '2.6.3'
+__version__ = '2.6.4'
 USER_AGENT = f'SocketPythonCLI/{__version__}'

socketsecurity/core/tools/reachability.py

@@ -18,7 +18,7 @@
 # Pinned @coana-tech/cli version. Bumped deliberately per Python CLI release so the
 # reachability engine version only changes through a standard pip upgrade (advance notice).
 # Pass --reach-version latest to opt into the newest published version instead.
-DEFAULT_COANA_CLI_VERSION: Final = "15.10.4"
+DEFAULT_COANA_CLI_VERSION: Final = "15.10.13"
 
 # Resolved @coana-tech/cli script paths from the npm-install fallback, keyed by version.
 # Lives for the process lifetime so repeated fallback invocations install only once
@@ -55,7 +55,7 @@ def __init__(self, sdk: socketdev, api_token: str):
 
     def _resolve_coana_package_spec(self, version: Optional[str] = None) -> str:
         """
-        Resolve the @coana-tech/cli package spec to run (e.g. '@coana-tech/cli@15.10.4').
+        Resolve the @coana-tech/cli package spec to run (e.g. '@coana-tech/cli@15.10.13').
 
         Args:
             version: Coana CLI version to use.
@@ -64,7 +64,7 @@ def _resolve_coana_package_spec(self, version: Optional[str] = None) -> str:
                 - '<semver>': that exact version.
 
         Returns:
-            str: The package specifier to use with npx (e.g. '@coana-tech/cli@15.10.4').
+            str: The package specifier to use with npx (e.g. '@coana-tech/cli@15.10.13').
         """
         return f"@coana-tech/cli@{self._resolve_coana_version(version)}"