upgrade coana to v14.12.107

[mtorp]

• Add the --output <scan-report.json> flag to socket scan reach.
• Update the Coana CLI to v 14.12.107.

---

Note

Adds --output/-o to socket scan reach to write reports to a custom .json path (plumbed through execution and logging), and updates Coana CLI to v14.12.107 with version bump.

• CLI: socket scan reach
  • New flag: --output <path>.json (alias -o) to write reachability report to a custom JSON file; validates extension is .json.
  • Help/Docs: Updated help text and examples to describe the new flag and default behavior.
  • Plumbing: Propagates outputPath through cmd-scan-reach.mts → handle-scan-reach.mts → perform-reachability-analysis.mts → output-scan-reach.mts.
    • Coana args now use the specified path for --output-dir and --socket-mode.
    • Success message now reports the actual output path.
  • Tests: Add cases for --output/-o acceptance and failures (non-.json/uppercase extension); snapshots updated for help/examples.
• Dependencies/Version
  • Bump @coana-tech/cli to 14.12.107 and update lockfile.
  • Update package version to 1.1.39 and CHANGELOG.

^{Written by Cursor Bugbot for commit 10de5ce. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​coana-tech/​cli@​14.12.101 ⏵ 14.12.107	+1		+1

View full report

[socket-security-staging]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​coana-tech/​cli@​14.12.101 ⏵ 14.12.107	+1		+1

View full report

[cursor]

Comment @cursor review or bugbot run to trigger another review on this PR

[cursor]

Bug: Coana socket-mode argument receives full path instead of filename

The --socket-mode Coana argument now receives outputFilePath (which can be a full path like ./reports/analysis.json) instead of just a filename. The original code pattern passed a filename to --socket-mode and a directory to --output-dir. When a user specifies --output ./reports/analysis.json, the code passes --output-dir ./reports and --socket-mode ./reports/analysis.json. If Coana combines these (placing the --socket-mode value inside --output-dir), the output could be written to an incorrect nested path. The --socket-mode value likely needs to be path.basename(outputFilePath) to maintain the expected behavior.

 

[jdalton]

☝️ @mtorp Needs double checking

[mtorp]

The --ouput-dir is actually not even used when --socket-mode is set so this comment can be ignored. I'll get the --output-dir removed completely, but I have to update the Coana CLI first. Currently it complains if you don't provide it with an output directory.