Skip to content

feat(manifest): add socket manifest maven (1.1.124, Coana 15.5.5)#1373

Open
Jeppe Fredsgaard Blaabjerg (jfblaa) wants to merge 2 commits into
v1.xfrom
jfblaa/manifest-maven
Open

feat(manifest): add socket manifest maven (1.1.124, Coana 15.5.5)#1373
Jeppe Fredsgaard Blaabjerg (jfblaa) wants to merge 2 commits into
v1.xfrom
jfblaa/manifest-maven

Conversation

@jfblaa

@jfblaa Jeppe Fredsgaard Blaabjerg (jfblaa) commented Jun 19, 2026

Copy link
Copy Markdown
Contributor

Summary

Adds a new socket manifest maven command that generates a Socket facts file (.socket.facts.json) from a Maven pom.xml project, mirroring the existing gradle / scala (sbt) facts flows. socket-cli delegates to the Coana CLI's manifest maven command (which owns the Maven extension that resolves the dependency graph); socket-cli only constructs the args and verifies the emitted facts file.

This is the 1.1.124 release: the feature plus the Coana bump it depends on.

What's included

  • New command cmd-manifest-maven.mts — facts-only (Maven is already pom-native, so there is no --pom path). Flags: --bin (defaults to mvn on PATH; point at ./mvnw to use a wrapper), --maven-opts (e.g. -P <profile> -s <settings.xml>), --include-configs / --exclude-configs (Maven scopes), --ignore-unresolved, --verbose. Reads defaults from socket.json like the other JVM tools.
  • convert-maven-to-facts.mts — thin delegate to the shared runCoanaManifestFacts (widened to accept ecosystem: 'maven' / --maven-opts).
  • Auto-detectionpom.xml → maven in detect-manifest-actions.mts, wired into socket manifest auto (generate_auto_manifest.mts).
  • Setup wizard — a Maven choice + setupMaven in the socket manifest setup configurator.
  • Typesmaven entry in socket.json manifest defaults.
  • Docs/changelog — README section and a 1.1.124 changelog entry.
  • Coana bump@coana-tech/cli 15.5.0 → 15.5.5, which adds the manifest maven command this delegates to.

Verification

  • pnpm build:dist:src, pnpm check:tsc, pnpm check:lint, biome format all clean.
  • New cmd-manifest-maven.test.mts (help + dry-run); updated cmd-manifest.test.mts snapshot; setup/auto/detect/generate-auto suites pass.
  • End-to-end smoke test against a real Maven project with the published 15.5.5 produces a complete graph (direct + transitive deps, correct tool: "maven" metadata).

Note

Low Risk
Additive beta manifest feature following existing Coana delegation; main dependency is the Coana 15.5.5 bump for Maven support.

Overview
Release 1.1.124 adds Maven to the manifest toolchain and bumps @coana-tech/cli to 15.5.5 so Coana can run manifest maven.

socket manifest maven [beta] writes .socket.facts.json from a pom.xml project by delegating to Coana (same pattern as Gradle/sbt facts). Flags cover --bin (default mvn, or ./mvnw), --maven-opts, scope filters via --include-configs / --exclude-configs, and --ignore-unresolved; defaults can live in socket.json.

Wiring: pom.xml is auto-detected for socket manifest auto, the setup wizard gets a Maven path (setupMaven), and runCoanaManifestFacts now accepts ecosystem: 'maven' with --maven-opts. Docs, changelog, help snapshots, and CLI tests were updated accordingly.

Reviewed by Cursor Bugbot for commit dec47bf. Configure here.

Add a `socket manifest maven` command that generates a Socket facts file
(`.socket.facts.json`) from a Maven `pom.xml` project by delegating to the
Coana CLI's `manifest maven` command, mirroring the existing gradle/sbt
facts flows. Includes pom.xml auto-detection, `socket manifest auto`
wiring, the `socket manifest setup` configurator, socket.json defaults,
and `--maven-opts` / `--bin` pass-through.

Bump Coana CLI to 15.5.5, which adds the `manifest maven` command this
delegates to.
@socket-security

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Addednpm/​@​coana-tech/​cli@​15.5.5741007998100

View full report

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

1 participant