Which of my dependencies contain malicious or vulnerable code before it reaches production?

scans direct and transitive packages against Socket's intelligence and flags the ones with known vulnerabilities or malware, surfaced on pull requests before merge

Is a reported vulnerability actually exploitable in my application?

traces whether the vulnerable code path is reachable from the application's own call graph, distinguishing verdicts backed by human-verified specs from those inferred by AI-reviewed specs

Is a malicious package about to be installed on one of our machines?

sits between the package manager and the registry and checks every direct and transitive dependency against Socket's intelligence, blocking the install before the code lands

Did someone tamper with a package version after it was published?

shows the full commit history behind a package's tags on its registry page, with the commit currently associated with a force-pushed tag highlighted so a swapped reference stands out

Are the browser extensions our team installs secretly exfiltrating data or contacting attacker infrastructure?

continuously analyzes Chrome, Firefox, and Edge extensions for credential and clipboard theft, data exfiltration, remote payload loading, and changes in the domains they contact between releases

Which alerts need a person to act on them, and who is on the hook?

lets a policy route findings into rules that open tracked tickets in tools like Asana or ClickUp, with status kept in sync as the alert clears or the ticket closes

Socket release history — The Cyber Toolchain

Organization alerts can now track multiple branches (2026-11-02) Nov 2, 2026 · issue 129

Socket now tracks multiple branches per repository for organization-wide alerts, supporting glob patterns and up to 5 branches per repo⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Track a canary or beta branch alongside main so production ring deployments all surface in org-wide alerts.

📍Settings -> Scans -> Tracked Branches -> Add a branch name (e.g. canary) or a glob expression (e.g. release/*) to begin receiving alerts, webhooks, and emails for that branch.

Register a full scan against a non-default branch via the API so it appears in organization alerts and triggers webhooks.

$ curl -X POST https://socket.dev/api/full-scan \
  -H 'Authorization: Bearer <token>' \
  -H 'Content-Type: application/json' \
  -d '{"branch": "canary", "set_as_pending_head": true}'

API users can now track non-default branches by setting the branch and set_as_pending_head fields when creating a full scan.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Organization-wide alerts now track multiple branches per repository (up to 5), with alerts broken down by label, repository, and branch in the dashboard.
Add tracked branches using plain names or glob expressions via Settings -> Scans -> Tracked Branches to receive alerts, webhooks, and email notifications across branches such as beta, canary, or legacy.

API users can now track non-default branches by setting the branch and set_as_pending_head fields when creating a full scan.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

2 more in Everything

changelog Oct 29, 2026 · issue 124

Socket schedules the removal of the GET /v0/report/view/{id} endpoint and changes Obfuscated code alert defaults on November 10⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Check the new full-scans endpoint to retrieve a scan report after the old view endpoint is retired.

$ curl -s -H 'Authorization: Bearer <token>' 'https://api.socket.dev/v0/orgs/<org_slug>/full-scans/<full_scan_id>'

Verify the Sunset header on the deprecated endpoint before your migration deadline to confirm the retirement date.

$ curl -sI -H 'Authorization: Bearer <token>' 'https://api.socket.dev/v0/report/view/<id>' | grep -i sunset

Migrate report view calls from the deprecated GET /v0/report/view/{id} endpoint to GET /v0/orgs/{org_slug}/full-scans/{full_scan_id} before November 20, 2026 — the old endpoint now advertises its retirement in a Sunset response header.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Keep Obfuscated code alerts after November 10 by opening Security Policy and setting Obfuscated code to Warn or Monitor instead of Inherit, or by adding a matching rule on the Policies page — the alert will be removed from the Balanced and Comprehensive preset defaults on that date.

Migrate report view calls from the deprecated GET /v0/report/view/{id} endpoint to GET /v0/orgs/{org_slug}/full-scans/{full_scan_id} before November 20, 2026 — the old endpoint now advertises its retirement in a Sunset response header.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

1 more in Everything

└──▷ BREAKING ON UPGRADE

!The GET /v0/report/view/{id} endpoint is retired on November 20, 2026; integrations using it must switch to GET /v0/orgs/{org_slug}/full-scans/{full_scan_id}.
!The Obfuscated code alert is removed from the Balanced and Comprehensive security policy presets on November 10, 2026; organizations relying on preset defaults will stop receiving this alert unless they explicitly set it to Warn or Monitor.

Obfuscated Code Alert Defaults Changing November 10 (2026-10-27) Oct 27, 2026 · issue 123

Updated detection Obfuscated code alert removed from 'Balanced' and 'Comprehensive' preset defaults

└──▷ BREAKING ON UPGRADE

!The Obfuscated code alert is removed from the Balanced and Comprehensive security policy presets on November 10, 2026; organizations relying on preset defaults will no longer receive these alerts unless they explicitly set Obfuscated code to Warn or Monitor via Settings → Security Policy or the Policies page.

announced Oct 26, 2026 · issue 123

Socket Threat Intel Campaigns page now shows per-org blocked/detected status with drill-down to scans and Firewall events.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Determine whether a newly publicized malware campaign reached your org and whether Socket blocked or only detected it, then trace every affected repository and branch to the exact scan.

📍In the Socket dashboard, go to Threat Intel → Campaigns. Locate the campaign in question and check the org-level status badge (Blocked by Socket, Detected in Firewall/SCA, or Not Detected). Click the campaign and open the Org Impact tab to see each affected package version, the repositories and branches that contained it, and first/last-seen dates. Click any date to open the corresponding scan report or Firewall event.

Adds per-organization campaign impact summaries — Blocked by Socket, Detected in Firewall/SCA, or Not Detected — to every malware campaign on the Threat Intel → Campaigns page, drawn from repository scans and Firewall event traffic.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
New Org Impact tab on each campaign shows each affected package and version separately, with the repositories, branches, and first/last-seen dates that link directly to the originating scan report or matching Socket Firewall events.
Adds Blog and Affected Packages tabs to each campaign detail view, surfacing Socket write-ups and the complete list of affected packages alongside the impact data.

3 details in Everything

changelog Oct 21, 2026 · issue 115

Socket: Adds token_prefix and token_last4 fields to token-list API responses, allowing key identification without parsing the masked display string.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Async endpoints for starting a fix computation and polling for results are now documented in the Fixes API, supporting supported parameters and result format to avoid timeouts on large projects or first runs.
Adds repository access checks before computing or returning fixes for user OAuth sessions governed by repository or workspace policies, returning 403 for unfiltered repository endpoints.
Adds current-role checks for OAuth requests so that role changes take effect on the next request, including for linked service-account requests.
Organization settings are now accessible directly from the Settings link at the bottom of the dashboard sidebar.

Async endpoints for starting a fix computation and polling for results are now documented in the Fixes API, supporting supported parameters and result format to avoid timeouts on large projects or first runs.

3 more in Everything

└──▷ BREAKING ON UPGRADE

!API keys now use a new consistent masked format (e.g. sktsec_…Xy9Q); integrations that parse the previous masked format may need updating.

Faster bulk ticket creation for manifest alerts (2026-10-20) Oct 20, 2026 · issue 114

Socket adds bulk ticket creation for manifest alerts across Jira, Linear, Asana, and ClickUp, with shift-click range selection.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Select multiple manifest alerts across repositories and create one Jira ticket per repo/manifest in a single action.

📍In the Socket dashboard, navigate to your manifest alerts list. Shift-click to select the desired range of alerts, then choose Create tickets and select Jira (or Linear, Asana, or ClickUp) to generate one ticket per repository and manifest file.

Bulk-create Jira, Linear, Asana, and ClickUp tickets for manifest alerts (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Missing lockfile), one ticket per repository and manifest file, scoped to the selected repository and branch.
Shift-click to select a range of alerts for bulk actions.

2 details in Everything

OAuth access stays in sync with role changes (2026-10-15) Oct 15, 2026 · issue 114

Socket OAuth access now enforces current role permissions on every request, so role changes take effect immediately.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

For organizations with current-role checks enabled, OAuth token requests now validate both the token's granted scopes and the user's current role permissions, with role changes taking effect on the next request.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Linked service-account OAuth requests now check current service-account permissions alongside granted token scopes.

For organizations with current-role checks enabled, OAuth token requests now validate both the token's granted scopes and the user's current role permissions, with role changes taking effect on the next request.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

1 more in Everything

announced Oct 14, 2026 · issue 109

Socket for Origin brings automatic dependency scanning and security findings to Origin (Cursor) pull requests via the Origin App Marketplace.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Connect Socket to Origin so every pull request automatically gets dependency security checks without leaving your Origin workflow.

📍In the Origin App Marketplace, find Socket, click Install, authorize your Socket organization, and confirm the connection. From that point, Socket runs a Socket Security / Dependency scan check automatically on every PR open and commit push.

Adds Socket for Origin integration in the Origin App Marketplace, enabling automatic dependency scans on Origin pull requests when opened or new commits are pushed.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Posts a Socket Security / Dependency scan check on Origin pull requests, showing scan progress, a policy-based verdict, and a link to the full report — with a rerun button directly in Origin.
Posts PR comments with dependency overviews, scores, severity labels, and report links, updating automatically as the PR changes.
Scans supported manifests and lockfiles — including dependency changes in monorepo workspaces — by comparing the target branch with Origin's proposed merge result.

4 details in Everything

docs update Oct 11, 2026 · issue 102

Socket reachability analysis gains broader facts-file support, Python/PyTorch precision improvements, and overhauled fix engines for Maven, Gradle, sbt, NuGet, Cargo, RubyGem⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Recognises Socket facts files matching any *.socket.facts.json naming pattern (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ pom.xml.socket.facts.json).
JVM reachability analysis now uses the per-subproject classpath from the Socket CLI's compute-artifacts sidecar when one is provided.
Socket Fix refuses a pnpm upgrade that needs a new version of a private package, and instructs the user to run it where the registry is reachable.
Performance, recall, and out-of-memory handling improvements for the JavaScript/TypeScript, PHP, and JVM reachability analyses.
Soundness and memory usage improvements for the Python reachability analysis.

Recognises Socket facts files matching any *.socket.facts.json naming pattern (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ pom.xml.socket.facts.json).
Socket Fix refuses a pnpm upgrade that needs a new version of a private package, and instructs the user to run it where the registry is reachable.

3 more in Everything

docs update Oct 10, 2026 · issue 101

Socket Fix gains scoped override/resolution writing when a parent version range blocks a fix, and now lists fixes it could not apply with a non-zero exit code.

Updated supported platformSocket Fix can now write a scoped override or resolution when a parent's version range is the only thing blocking a fix.
Socket Fix now lists the fixes it could not apply and exits with a non-zero code instead of reporting them as applied.

2 details in Everything

New supported platform Poetry and Pipenv support for Socket Fix Python upgrades
Updated supported platform pnpm lockfile update support (pnpm 9 and later) on Socket-hosted runs
Updated supported platform JVM per-subproject classpath from compute-artifacts sidecar
Updated supported platform Python reachability analysis soundness, memory usage and PyTorch modeling improvements
Updated supported platform Performance, recall and OOM handling for JavaScript/TypeScript, PHP and JVM reachability
Updated supported platform Socket facts files now matched by any *.socket.facts.json pattern

docs update Oct 9, 2026 · issue 099

Socket Fix gains scoped-override writing, non-zero exit on failed fixes, PyTorch-aware Python analysis, and broader *.socket.facts.json file recognition.

Recognises Socket facts files matching any *.socket.facts.json pattern (e.g. pom.xml.socket.facts.json) for broader project discovery.
Socket Fix can now write a scoped override or resolution when a parent version range is the only thing blocking a fix.
Socket Fix now lists fixes it could not apply and exits with a non-zero code instead of silently reporting them as applied.
Updated supported platformMore precise modeling of PyTorch in the Python reachability analysis prevents analysis blow-ups in projects that use it.

4 details in Everything

New supported platform Poetry and Pipenv support for Socket Fix (Python)
Updated supported platform pnpm lockfile updates on Socket-hosted runs (pnpm 9+)
Updated supported platform Socket Fix overhauled for Maven, Gradle, sbt, NuGet, Cargo and RubyGems
Updated supported platform Socket Fix Python upgrade overhaul: uv, pip-compile, uv pip compile, Poetry, Pipenv

docs update Oct 6, 2026 · issue 096

New supported platform Poetry and Pipenv support for Python upgrades in Socket Fix
Updated supported platform Socket Fix pnpm lockfile updates on Socket-hosted runs (pnpm 9 and later)
Updated supported platform Socket Fix overhaul for Maven, Gradle, sbt, NuGet, Cargo and RubyGems following each build tool's own resolution
Updated supported platform Socket Fix Python upgrades overhauled to follow each tool's own resolution, including uv, pip-compile, uv pip compile
Updated supported platform JVM reachability analysis uses per-subproject classpath from Socket CLI compute-artifacts sidecar

docs update Oct 5, 2026 · issue 095

Socket Fix overhauls dependency upgrades for Maven, Gradle, sbt, NuGet, Cargo, RubyGems, and pnpm with tool-native resolution semantics⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

JVM reachability analysis uses the per-subproject classpath from the Socket CLI's compute-artifacts sidecar when one is provided.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Socket Fix for pnpm now refuses an upgrade that needs a new version of a private package, and instructs running it where the registry is reachable.

2 details in Everything

docs update Sep 25, 2026 · issue 085

└──▷ TRY IT

Poll migration status in CI to gate whether to send policy/rule writes with or without dry_run — only switching live when state is accepted or auto_finalized.

$ curl -u "$SOCKET_API_TOKEN:" https://api.socket.dev/v0/orgs/$ORG/alert-policies/migration/status

docs update Sep 25, 2026 · issue 085

New GET /v0/orgs/{org_slug}/alert-policies/migration/status endpoint reveals your org's policy migration state and which config decides alerts now.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Poll your org's migration status in CI to gate whether to send policy/rule writes with or without dry_run, based on the current state field.

$ curl -u "$SOCKET_API_TOKEN:" \
  https://api.socket.dev/v0/orgs/$ORG/alert-policies/migration/status

Adds GET /v0/orgs/{org_slug}/alert-policies/migration/status to return migration state (null, pending, previewing, accepted, or auto_finalized), finalization timestamps (finalized_at, deadline_at, window_end_at, deadline_admin_paused_at), and two booleans (alert_policies_enabled, legacy_evaluation_enabled) showing which configuration currently drives alert actions — requires the alert-policy:list scope and org-wide repository access, costs 1 quota unit per call.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

1 detail in Everything

docs update Sep 25, 2026 · issue 085

Socket reachability analysis gains Go 1.27 support, pnpm catalog resolution, and per-pattern broken vulnerability reporting⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Pin all pnpm catalog dependencies to exact versions during a fix run, so catalog entries are written as bare versions rather than range expressions.

$ socket fix --range-style pin

Supports dependencies declared through a pnpm catalog — entries like 'tap': 'catalog:' or 'tap': 'catalog:tools' now resolve correctly, preserving range operators (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ =19.2.5 upgraded to =21.8.0), with --range-style pin writing the bare version.
Reports broken vulnerability patterns per pattern, with the affected package version, for the JavaScript, Go, and Python reachability analyses.

Supports dependencies declared through a pnpm catalog — entries like 'tap': 'catalog:' or 'tap': 'catalog:tools' now resolve correctly, preserving range operators (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ =19.2.5 upgraded to =21.8.0), with --range-style pin writing the bare version.

1 more in Everything

docs update Sep 24, 2026 · issue 084

Socket reachability analysis adds Go 1.27 support, Python pickle hook modeling, and lower peak memory for large repos.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Supports Go 1.27 projects in the Go reachability analysis.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Models calls to pickle.{Pickler,Unpickler} hooks through load and dump in the Python reachability analysis.
Lowers peak memory use when scanning large repositories.

Supports Go 1.27 projects in the Go reachability analysis.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

2 more in Everything

docs update Sep 14, 2026 · issue 074

└──▷ TRY IT

Poll migration status in CI to gate whether to send live policy writes or fall back to dry_run — avoid sending writes that return errors during the pending or previewing states.

$ curl -u "$SOCKET_API_TOKEN:" \
  https://api.socket.dev/v0/orgs/$ORG/alert-policies/migration/status

docs update Sep 14, 2026 · issue 074

Socket reachability engine adds PHP support, --reach-version override, dynamic JS dispatch, Go/Rust analysis improvements, and smarter socket fix for Go modules⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Pin a specific Coana engine version for a reachability scan without waiting for a Socket CLI release — useful when a newer engine fixes a false-positive for your stack.

$ socket scan reach --reach-version 15.10.38 .

The --entry-points flag now applies only to the scanned project's own root instead of leaking into every discovered subproject.
Performance improvements for Python reachability analysis on projects using 3rd-party serializers like Pydantic.

2 more in Everything

docs update Sep 13, 2026 · issue 073

New GET /v0/orgs/{org_slug}/alert-policies/migration/status endpoint reveals your org's Policies migration state in real time.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Check whether your org has crossed into accepted or auto_finalized before deciding whether to send policy/rule writes with or without dry_run.

$ curl -u "$SOCKET_API_TOKEN:" \
  https://api.socket.dev/v0/orgs/$ORG/alert-policies/migration/status

Adds GET /v0/orgs/{org_slug}/alert-policies/migration/status to report where an organization stands in the alert-policy migration, returning state (null, pending, previewing, accepted, or auto_finalized), the booleans alert_policies_enabled and legacy_evaluation_enabled, and timestamps (finalized_at, deadline_at, window_end_at, deadline_admin_paused_at) — all as ISO-8601 strings or null.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Requires the alert-policy:list scope and organization-wide repository access on the API token; a repository-restricted token returns an error, and each call consumes 1 unit of quota.

2 details in Everything

docs update Sep 13, 2026 · issue 073

Socket's Coana reachability engine gains PHP support, workspace grouping, dynamic JS dispatch, and smarter fix attribution via --dry-run --output-file⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Pin a specific Coana engine version for a reachability scan — useful when you need to reproduce results from an earlier engine or test a newer one before it ships in the CLI bundle.

$ socket scan reach --reach-version 15.10.38 .

Adds --reach-version flag to socket scan reach to run a specific Coana engine version instead of the bundled pinned one.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds withheldFixes field to the --dry-run --output-file JSON output, naming versions and flags that blocked an automatic fix.
Enables reachability analysis for PHP/Composer projects when running via the Socket CLI, with subdirectory Composer projects analyzed in their own directory.
Supports vulnerability patterns that identify vulnerable Rust/Cargo code by source location, with semver range scoping so a pattern only applies to crate versions within its range.
JVM/Java scans now support multiple independent Maven/Gradle/SBT build roots in a single repository.

+5 more show less

JavaScript/TypeScript reachability analysis now approximates unresolved dynamic property reads and calls (e.g. obj[key]()) instead of dropping them, catching reachable code behind dynamic dispatch.
Reachability reports are now streamed to disk rather than serialized as a single string, removing the ~512 MiB RangeError: Invalid string length limit on large repositories.
Maven artifact resolution now tries remaining public repositories after a failed download instead of stopping at the first failure.
Package downloads are now retried on transient network failures, with distinct fast-fail behaviour for missing packages, rejected certificates, and unresolvable hosts.
Prefers uv over pyenv when a specific Python interpreter is required for reachability analysis.

Adds --reach-version flag to socket scan reach to run a specific Coana engine version instead of the bundled pinned one.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds withheldFixes field to the --dry-run --output-file JSON output, naming versions and flags that blocked an automatic fix.
Enables reachability analysis for PHP/Composer projects when running via the Socket CLI, with subdirectory Composer projects analyzed in their own directory.
Supports vulnerability patterns that identify vulnerable Rust/Cargo code by source location, with semver range scoping so a pattern only applies to crate versions within its range.

6 more in Everything

docs update Sep 12, 2026 · issue 072

Socket: Adds --reach-version flag to socket scan reach to run a different pinned Coana engine version than the one bundled with the Socket CLI.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Pin a specific Coana engine version for a reachability scan to test a newer engine without upgrading the CLI.

$ socket scan reach --reach-version 15.10.38 .

Inspect which fixes were withheld by a policy flag (e.g. --disable-major-updates) without making any changes.

$ socket scan reach --dry-run --output-file results.json . && jq '.withheldFixes' results.json

Enables reachability analysis for PHP/Composer projects when running through the Socket CLI; a Composer project in a subdirectory is now analyzed in its own directory rather than at the repository root.
Adds withheldFixes field to --dry-run --output-file JSON output, naming the version and responsible flag when compute-fixes-and-upgrade-purls cannot apply a fix due to a policy constraint such as --disable-major-updates.
npm, pnpm, and yarn workspace packages are now grouped and analyzed together under their workspace root when running reachability analysis via the Socket CLI.
Reachability scans now survive transient Socket backend failures by retrying with exponential backoff, exiting with a dedicated exit code for Socket-side outages instead of crashing.
Improved JVM/Java reachability analysis with better parity between source-based and bytecode-based analyses and improved support for Kotlin and Scala constructs such as delegated properties and object declarations.

+1 more show less

Go reachability analysis gains better handling of timeouts and improved support for push-style //go:linkname directives.

Enables reachability analysis for PHP/Composer projects when running through the Socket CLI; a Composer project in a subdirectory is now analyzed in its own directory rather than at the repository root.
Adds withheldFixes field to --dry-run --output-file JSON output, naming the version and responsible flag when compute-fixes-and-upgrade-purls cannot apply a fix due to a policy constraint such as --disable-major-updates.

4 more in Everything

docs update Sep 11, 2026 · issue 071

Socket's Coana reachability engine gains PHP support, smarter Go/Rust/JVM analysis, and a new --reach-version override flag.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Pin a specific Coana engine version for a scan without waiting for a Socket CLI release — useful when a newer engine fixes a false-positive or adds coverage you need today.

$ socket scan reach --reach-version 15.10.38 .

Adds withheldFixes field to --dry-run --output-file JSON output, attributing which flag (e.g. --disable-major-updates) blocked a fix and naming the withheld version.
JVM/Java reachability analysis now supports scans containing multiple independent Maven/Gradle/SBT build roots.
Performance improvements for the Python reachability analysis on projects that use third-party serializers like Pydantic.

Adds withheldFixes field to --dry-run --output-file JSON output, attributing which flag (e.g. --disable-major-updates) blocked a fix and naming the withheld version.

2 more in Everything

docs update Sep 10, 2026 · issue 070

New GET /v0/orgs/{org_slug}/alert-policies/migration/status endpoint reveals where your org stands in Socket's Policies migration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Check whether your org has completed the migration before deciding whether to send policy writes with or without dry_run in a CI script.

$ curl -u "$SOCKET_API_TOKEN:" \
  https://api.socket.dev/v0/orgs/$ORG/alert-policies/migration/status

Adds GET /v0/orgs/{org_slug}/alert-policies/migration/status to query your organization's current position in the alert-policy migration, returning state, alert_policies_enabled, legacy_evaluation_enabled, finalized_at, deadline_at, window_end_at, and deadline_admin_paused_at fields.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

1 detail in Everything

docs update Sep 10, 2026 · issue 070

Socket: Adds withheldFixes field to --dry-run --output-file JSON output, naming versions and flags that blocked a fix (e.g. --disable-major-updates).

└──▷ TRY IT

Pin a specific Coana engine version for a reachability scan without waiting for a Socket CLI update — useful to test a newer engine or lock a known-good one in CI.

$ socket scan reach --reach-version 15.10.38 .

Adds grouping of npm, pnpm, and yarn workspace packages so they are analyzed together under their workspace root during reachability scans.
Adds approximation of unresolved dynamic property reads and calls (e.g. obj[key]()) in JavaScript/TypeScript reachability analysis so reachable code behind dynamic dispatch is no longer missed.
Streams large reachability reports to disk instead of serializing them as a single JavaScript string, removing the ~512 MiB RangeError: Invalid string length limit.
--entry-points now applies only to the scanned project's own root instead of leaking into every discovered subproject.
Maven artifact resolution now tries remaining public repositories after a failed download instead of giving up after the first failure.

+1 more show less

Package downloads in reachability analysis are now retried on transient network failures, with immediate failure on a missing package, rejected certificate, or unresolvable host, and the failure reason is named.

Adds grouping of npm, pnpm, and yarn workspace packages so they are analyzed together under their workspace root during reachability scans.

5 more in Everything

docs update Sep 10, 2026 · issue 070

Socket's Coana reachability engine gains PHP support, smarter fix attribution, Go/Rust/JVM analysis improvements, and JS dynamic dispatch coverage⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Pin a specific Coana engine version for a reachability scan without waiting for a Socket CLI update — useful when a newer engine version fixes a language-specific analysis issue.

$ socket scan reach --reach-version 15.10.38 .

Adds --reach-version flag to socket scan reach to override the bundled Coana engine version and run a specific one instead.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Reachability scans now survive transient Socket backend failures with exponential-backoff retries, a human-readable outage explanation, and a dedicated exit code instead of a stack trace.
Supports vulnerability patterns that identify vulnerable Rust/Cargo code by source location, including semver range scoping so a pattern only applies to crate versions within its range.
Unresolved dynamic property reads and calls (e.g. obj[key]() where key is not a constant) in JavaScript/TypeScript are now approximated rather than dropped, so reachable code behind dynamic dispatch is no longer missed.
Adds support for multiple independent Maven/Gradle/SBT build roots within a single JVM/Java reachability scan.

+2 more show less

Maven artifact resolution now tries remaining public repositories after a failed download instead of halting on the first failure; package downloads are retried on transient network failures with immediate failure on missing packages, rejected certificates, or unresolvable hosts.
Prefers uv over pyenv when a specific Python interpreter is required for reachability analysis.

Adds --reach-version flag to socket scan reach to override the bundled Coana engine version and run a specific one instead.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Supports vulnerability patterns that identify vulnerable Rust/Cargo code by source location, including semver range scoping so a pattern only applies to crate versions within its range.

5 more in Everything

docs update Sep 9, 2026 · issue 069

Socket reachability engine adds PHP support, JS dynamic dispatch approximation, --reach-version override, and smarter socket fix for Go and Cargo.

└──▷ TRY IT

Pin a specific Coana engine version for a reachability scan, e.g. to test a newer engine before it ships in the CLI bundle.

$ socket scan reach --reach-version 15.10.38 .

Inspect which fix versions were withheld by policy flags during a dry-run, using the structured JSON output.

$ socket scan reach --dry-run --output-file results.json . && jq '.withheldFixes' results.json

Adds --reach-version flag to socket scan reach to run a different Coana engine version than the one bundled with the Socket CLI.
Adds withheldFixes field in --dry-run --output-file JSON output when compute-fixes-and-upgrade-purls cannot apply a fix because a flag such as --disable-major-updates withheld the only patched version.
Enables reachability analysis for PHP/Composer projects when running via the Socket CLI; a Composer project in a subdirectory is now analyzed in its own directory rather than at the repository root.
npm, pnpm, and yarn workspace packages are now grouped and analyzed together under their workspace root when running reachability analysis via the Socket CLI.
JavaScript/TypeScript reachability analysis now approximates unresolved dynamic property reads and calls (e.g. obj[key]() where key is not a constant) instead of dropping them, so reachable code behind dynamic dispatch is no longer missed.

+6 more show less

Rust reachability analysis adds support for vulnerability patterns that identify vulnerable code by source location, with semver range scoping so a pattern only applies to crate versions within its range.
JVM/Java reachability analysis adds improved support for Kotlin and Scala constructs such as delegated properties and object declarations.
Reachability scans now retry with exponential backoff on transient Socket backend failures and exit with a dedicated exit code for Socket-side outages instead of crashing.
Reachability reports are now streamed to disk (no longer limited by the ~512 MiB JavaScript string ceiling), and evidence stacks are capped at 3 per alert (down from 10), keeping the shortest stacks.
Python reachability analysis now prefers uv over pyenv when a specific Python interpreter is required.
Go reachability analysis adds better handling of timeouts and improved support for push-style //go:linkname directives.

Adds --reach-version flag to socket scan reach to run a different Coana engine version than the one bundled with the Socket CLI.
Adds withheldFixes field in --dry-run --output-file JSON output when compute-fixes-and-upgrade-purls cannot apply a fix because a flag such as --disable-major-updates withheld the only patched version.
Enables reachability analysis for PHP/Composer projects when running via the Socket CLI; a Composer project in a subdirectory is now analyzed in its own directory rather than at the repository root.

8 more in Everything

docs update Sep 2, 2026 · issue 062

Socket API write endpoints now accept ?dry_run=true to validate policy, rule, and resolution requests without saving anything.

└──▷ TRY IT

Validate a new alert policy before migration cutover — confirms the payload is accepted and previews the assigned id without actually creating the policy.

$ curl -u "$SOCKET_API_TOKEN:" -X POST \
  -H "Content-Type: application/json" \
  -d '{"name": "Production", "description": "Stricter handling for production services", "baseline": "balanced"}' \
  "https://api.socket.dev/v0/orgs/$ORG/alert-policies?dry_run=true"

Test a resolution payload against a specific alert selector to confirm scope and auth before committing — useful when you want to avoid accidentally suppressing alerts org-wide.

$ curl -u "$SOCKET_API_TOKEN:" -X POST \
  -H "Content-Type: application/json" \
  -d '{"reason": "other", "comment": "accepted risk", "vigil_selector": {"finding.alertType": "criticalCVE", "artifact.type": "npm", "artifact.name": "lodash"}}' \
  "https://api.socket.dev/v0/orgs/$ORG/alerts/resolutions?dry_run=true"

Confirm a policy delete is targeting the right policy before running the destructive call in a migration script.

$ curl -u "$SOCKET_API_TOKEN:" -X DELETE \
  "https://api.socket.dev/v0/orgs/$ORG/alert-policies/$POLICY_ID?dry_run=true"

Adds ?dry_run=true query parameter to policy, rule, and resolution write endpoints — returns the same response body a real write would, including the id/uuid, but creates, updates, or deletes nothing.
Supports dry_run on POST /orgs/{org_slug}/alert-policies, PUT /orgs/{org_slug}/alert-policies/{policy_id}, DELETE /orgs/{org_slug}/alert-policies/{policy_id}, POST /orgs/{org_slug}/alert-policies/{policy_id}/rules, PUT /orgs/{org_slug}/alert-policies/{policy_id}/rules/{rule_id}, DELETE /orgs/{org_slug}/alert-policies/{policy_id}/rules/{rule_id}, and POST /orgs/{org_slug}/alerts/resolutions.
Dry-run creates return HTTP 200 with dry_run: true in the body (not 201); dry-run deletes return { "dry_run": true } instead of { "result": "success" }; dry-run updates return 200 with the updated body plus dry_run: true.
Accepts true, 1, or yes (case-insensitive, surrounding space ignored) to enable dry-run; false, 0, no, or omitted for a real write; any other value (e.g. ture, on) returns 400: dry_run must be true, 1, yes, false, 0, or no; conflicting repeated values return 400: dry_run has conflicting values.
Auth and quota rules match real writes: alert-policy:create/:update/:delete for policy and rule endpoints, alert-resolution:create for resolutions; repository-restricted tokens still receive 403 on policy writes; each dry-run call consumes 1 unit of quota.

5 details in Everything

docs update Sep 2, 2026 · issue 062

Socket adds POST /orgs/{org_slug}/alert-policies/migration/translate to convert legacy alert triage payloads into new resolution or policy-rule requests.

└──▷ TRY IT

Translate a batch of legacy triage rules to preview what alert resolutions and policy rules they become before committing to migration.

$ curl -u "$SOCKET_API_TOKEN:" -X POST \
  -H "Content-Type: application/json" \
  -d '{
    "alertTriage": [
      {
        "packageType": "npm",
        "packageName": "lodash",
        "alertType": "criticalCVE",
        "note": "accepted risk",
        "state": "ignore"
      }
    ]
  }' \
  https://api.socket.dev/v0/orgs/$ORG/alert-policies/migration/translate

Dry-run a translated policy-rule body to validate it against the Default policy without writing it — safe to run before confirming migration.

$ curl -u "$SOCKET_API_TOKEN:" -X POST \
  -H "Content-Type: application/json" \
  -d '{
    "name": "in [email protected]",
    "action": "monitor",
    "note": null,
    "vigil_selector": {
      "artifact.type": "npm",
      "artifact.name": "react",
      "artifact.version": "19.2.8"
    }
  }' \
  'https://api.socket.dev/v0/orgs/$ORG/alert-policies/default/rules?dry_run=true'

New POST /orgs/{org_slug}/alert-policies/migration/translate endpoint accepts the same alertTriage array (1–100 entries) used by POST /orgs/{org_slug}/triage/alerts and returns translated alert_resolution or alert_policy_rule request bodies without writing anything.
Supports ?dry_run=true on rule-body POSTs so practitioners can validate translated policy-rule payloads before confirming migration.
Response always returns two arrays — translations (with index, target, method, path, and body) and untranslatable (with index, code, and reason) — so partial batches surface per-entry failures without dropping the rest.
Defines structured untranslatable error codes: inherit_not_translatable, alert_key_not_translatable, matches_all_alerts, filter_not_translatable, and note_too_long, each with actionable remediation guidance.
Accepts any one of triage:alerts-update, alert-policy:read, or alert-resolution:create token scopes; consuming 1 unit of quota per call.

+4 more show less

Legacy ignore entries that can be expressed as alert-type/package filters translate to alert_resolution targets (reason always other); those with fixAvailable, cvssScoreCmp, reachability, or kevs filters translate to alert_policy_rule targets instead.
Legacy block entries translate to alert_policy_rule with error action; warn and monitor entries become policy rules with their respective actions.
Policy-rule translations always target the Default policy at /alert-policies/default/rules; sending the same body to /alert-policies/{policy_id}/rules applies it to a labeled policy.
Scoped npm package names (e.g. @scope/pkg) stored whole in packageName are automatically split into artifact.namespace and artifact.name in the returned selector.

9 details in Everything

docs update Sep 2, 2026 · issue 062

Socket adds dry-run support to POST /alerts/resolutions and a triage-payload translation utility.

└──▷ TRY IT

Validate a resolution payload against the API before committing it — useful for testing migrated triage rules without side effects.

$ POST /alerts/resolutions?dry_run=true

Adds ?dry_run=true query parameter to POST /alerts/resolutions to validate a resolution payload without saving it.
Adds a Translating Alert Triage Payloads utility to convert existing Alert Triage ignore-rule request bodies into the resolutions format.

2 details in Everything

docs update Sep 2, 2026 · issue 062

Socket adds ?dry_run=true to policy/rule write endpoints so you can test API changes before confirming a migration.

Adds ?dry_run=true query parameter to policy and rule write endpoints: returns 200 and validates the write without saving anything, letting you test API integrations before confirming the Policies migration.
During the Policies migration preview, real policy and rule writes return 409 until the migration is confirmed — use ?dry_run=true to safely test writes in the interim.

2 details in Everything

└──▷ BREAKING ON UPGRADE

!While your organization is previewing the migration to Policies, real policy and rule write API calls return 409 until the migration is confirmed.

announced Sep 1, 2026 · issue 064

Socket adds Microsoft Teams as a notification channel with per-channel subscriptions, severity filters, and Adaptive Card digests.

└──▷ HOW TO FIND IT

Connect a Teams channel to Socket so critical supply chain alerts land in your security team's channel automatically.

📍In Socket, go to Settings → Integrations → Notifications → Create Channel, select Microsoft Teams, enter a channel name, and paste the HTTP POST URL copied from your Microsoft Workflows 'Post to a channel when a webhook request is received' flow. Socket will send a test Adaptive Card; a successful test marks the channel as Active.

Route only critical supply chain risk alerts for a specific repository to a dedicated engineering Teams channel, keeping noise out of the general security channel.

📍In Socket, go to Settings → Integrations → Notifications → Create Subscription, choose the alert created event, set filters to category: supply chain risk, severity: critical, and the target repository, then select your Microsoft Teams channel as the destination.

Adds Microsoft Teams as a notification destination in Settings → Integrations → Notifications, configured via a Microsoft Workflows incoming webhook (HTTP POST URL) alongside the existing email channel.
New subscription model lets owners and admins route organization alerts and supply chain attack campaign notifications to specific Teams channels, filtered by alert category (supply chain risk, vulnerability, quality, maintenance, license), severity, Socket priority, repository, or package ecosystem.
Delivers notifications as structured Adaptive Cards summarizing alert totals by severity, affected repository count, individual finding previews, and a direct link to the Socket dashboard.
Groups related alert activity into digests before posting to Teams, preventing channel flooding when a scan surfaces many alerts at once.
Attack campaign notifications indicate whether affected packages are present in the organization — showing impacted repositories or confirming no monitored repositories are affected — without requiring manual per-repository checks.

5 details in Everything

changelog Aug 31, 2026 · issue 060

Socket adds Asana alert ticketing, PHP/Composer beta support, and Firefox extension scanning

New Asana integration lets teams create and manage Asana tasks from Socket alerts, either manually or via ticketing rules that filter by event, type, priority, and repository — with configurable sync between task and alert status; available in beta on Business and Enterprise plans.
PHP and Composer support promoted from Experimental to Beta and now available to all Socket users; PHP reachability analysis is generally available for Team plan customers and above without requiring Experimental access.
New Firefox extension scanning covers every extension in Mozilla's official add-ons directory, monitoring for permission changes, network activity, malware, credential and clipboard theft, data exfiltration, remote loading, obfuscation, and impersonation; available in Experimental for Enterprise customers.

3 details in Everything

announced Aug 28, 2026 · issue 058

Socket adds Microsoft Edge Add-ons extension monitoring, bringing malware, credential-theft, and version-change detection to Edge.

└──▷ HOW TO FIND IT

Enable Edge extension coverage for your enterprise org — reach out to your Socket account team or contact Socket to get started with the Experimental rollout.

📍In the Socket dashboard, contact your Socket account team to enable Edge coverage under the Experimental tier for your enterprise organization.

Adds continuous analysis of extensions published through Microsoft Edge Add-ons, covering malware, credential and clipboard theft, data exfiltration, remote code loading, obfuscation, and impersonation — the same detections previously available for Chrome and Firefox.
Enables version-change comparison for Edge extensions, surfacing meaningful differences in code, permissions, network activity, and behavior between releases under the same extension identity.
Identifies command-and-control infrastructure, suspicious endpoints, remote payload sources, and changes in domains contacted by Edge extensions.
Connects related extensions across stores through reused code, shared infrastructure, publisher patterns, and coordinated campaigns.
Closes cross-store coverage gap by pairing Chrome Web Store analysis (including Chrome extensions Edge users can install) with new Microsoft Edge Add-ons analysis.

5 details in Everything

announced Aug 26, 2026 · issue 058

Socket for ClickUp integration launches in beta, enabling bi-directional alert-to-task sync with automated ticketing rules.

└──▷ HOW TO FIND IT

Set up the ClickUp integration in Socket to start routing alerts as tasks into your team's existing ClickUp workflows.

📍In the Socket dashboard, go to Settings → Integrations → ClickUp and click Connect.

New ClickUp integration (beta) lets teams create ClickUp tasks from Socket alerts via Settings → Integrations → ClickUp in the Socket dashboard.
Automated ticketing rules route matching Socket findings into a chosen ClickUp Workspace and List, with configurable priority (Urgent, High, Normal, Low, or Auto to map Socket priority automatically), tags, and assignee.
Bi-directional status sync keeps Socket alerts and ClickUp tasks updated: clearing an alert can move the linked task to completed, and closing or completing a task in ClickUp can triage-ignore the corresponding Socket alert.
ClickUp task updates, status changes, and deletions are delivered to Socket via Workspace webhooks, giving security monitors and engineers a shared view of issue status.
Manual task creation available for individual alerts via the Create Ticket button in the Socket alert view, with selection of target ClickUp Workspace and List (displayed with full Space / List or Space / Folder / List path).

5 details in Everything

New: Asana integration for alert ticketing (2026-08-25) Aug 25, 2026 · issue 057

Socket adds Asana integration (beta) for creating and managing tasks from alerts via manual action or ticketing rules.

Adds Asana integration (beta, Business and Enterprise plans) to create and manage Asana tasks directly from Socket alerts.
Supports ticketing rules that filter alerts by event, type, priority, repository, and other attributes to automate Asana task creation.
Allows configuring Asana workspace, project, tags, and assignee per ticketing rule, with bi-directional status sync between linked tasks and alerts.

3 details in Everything

New: Asana integration for alert ticketing Aug 25, 2026 · release notes

Socket enables Asana task management from alerts via UI configuration.

New integration with Asana for alert ticketing.

1 detail in Everything

announced Aug 25, 2026 · issue 058

Socket launches native Asana integration with manual ticket creation, automated ticketing rules, and two-way sync.

└──▷ HOW TO FIND IT

Connect an Asana workspace to your Socket organization so alerts can be routed as trackable tasks.

📍In the Socket dashboard, go to Settings → Integrations → Asana and click Connect. Authorize via OAuth — no third-party admin console required. The connected workspace name, connecting user, and status will appear in the Socket dashboard.

Set up an automated ticketing rule to route high-priority supply chain alerts directly to the right Asana project without manual triage.

📍In the Socket dashboard, go to Settings → Integrations → Asana → ticketing rules. Step 1: select the alert events that trigger the rule. Step 2: add conditions (e.g., type = supply chain, priority = high). Step 3: select the connected Asana workspace and target project. Step 4: add tags and assign to an Asana user. Step 5: configure two-way sync behavior — e.g., mark Asana task complete when alert clears, and triage-ignore the Socket alert when the Asana task is completed.

New Settings → Integrations → Asana UI in the Socket dashboard lets an Owner or Admin connect one or more Asana workspaces via OAuth, with no separate app to install.
Adds a Create Ticket button on any Socket alert to manually create a linked Asana task — selecting workspace, project, tags, and assignee — with a bidirectional link between the alert and the task.
Two-way sync keeps Asana tasks and Socket alerts current: Socket can mark an Asana task complete when an alert clears, and completing the Asana task can triage-ignore the linked Socket alert.

3 details in Everything

docs update Aug 24, 2026 · issue 055

Socket adds --dynamic-sbom-inference flag to Node CLI for per-subproject JVM reachability analysis across Gradle, sbt, and Maven builds.

└──▷ TRY IT

Run a reachability scan on a multi-module Gradle, sbt, or Maven repo so each subproject is analyzed independently with an accurate dependency graph from the build tool.

$ socket scan create --reach --dynamic-sbom-inference

Pre-generate Socket facts files for a JVM build before running a Python CLI reachability scan (or when the build tool must be invoked separately).

$ socket manifest dynamic-sbom-inference

Adds --dynamic-sbom-inference flag to socket scan create --reach in the Node CLI, triggering the build tool to generate a Socket facts file so every Gradle, sbt, and Maven build under the scan target is analyzed per-subproject rather than as a single unit — yielding faster scans on large repos and more accurate dependency graphs.
Adds socket manifest setup --dynamic-sbom-inference to configure per-project defaults one build at a time for repositories containing several JVM builds.
Adds socket manifest dynamic-sbom-inference as a standalone pre-generation step, enabling Python CLI users (and sbt/Gradle-without-lockfile users) to produce the required facts files before running a scan.

3 details in Everything

docs update Aug 24, 2026 · issue 055

Socket Kotlin scans now support full reachability analysis with dynamic SBOM inference per Gradle subproject.

└──▷ TRY IT

Run a full reachability scan across all Gradle subprojects in a Kotlin repo, generating manifests automatically without a pre-existing SBOM.

$ socket scan create --reach --dynamic-sbom-inference

Adds --reach --dynamic-sbom-inference flags to socket scan create for full application reachability scans on Kotlin projects, analyzing and reporting reachability per Gradle subproject using the dependency graph Gradle itself resolves.

1 detail in Everything

PHP and Composer support is now in beta (2026-08-21) Aug 21, 2026 · issue 057

Socket PHP and Composer support graduates to Beta with reachability analysis now GA for Team plans

PHP and Composer support is now in Beta and available to all Socket users (previously Experimental).
PHP reachability analysis is now generally available for Team plan customers and above, with no Experimental access required — includes precomputed reachability and full application reachability.

2 details in Everything

New: Firefox extension protection (2026-08-20) Aug 20, 2026 · issue 057

Socket adds Firefox extension scanning, covering permissions, network activity, malware, and exfiltration behaviors across Mozilla's add-ons directory.

Scans every Firefox extension listed in Mozilla's official add-ons directory, monitoring new releases for changes in permissions, code, network activity, and behavior.
Detects malware, credential and clipboard theft, data exfiltration, remote loading, obfuscation, impersonation, and related campaign activity in Firefox extensions.
Firefox extension coverage is available in Experimental for Enterprise customers — contact your Socket account team to enable it.

3 details in Everything

New: Firefox extension protection Aug 20, 2026 · release notes

Socket adds experimental Firefox extension protection scanning for enterprise customers

Adds support for scanning Firefox extensions listed in Mozilla's official add-ons directory.
Enables monitoring of new Firefox extension releases for changes in permissions, code, network activity, and behavior.

2 details in Everything

docs update Aug 17, 2026 · issue 048

Socket splits legacy Alert Triage into two new APIs: policy rules and alert resolutions, each with distinct endpoints and selectors.

└──▷ TRY IT

Migrate a legacy pattern rule that monitored unreachable critical CVEs in lodash 4.x to a new policy rule.

$ curl -u "$SOCKET_API_TOKEN:" -X POST \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Monitor unreachable critical CVEs in lodash 4.x",
    "action": "monitor",
    "note": "Unreachable in our services",
    "position": "last",
    "vigil_selector": {
      "finding.alertType": "criticalCVE",
      "finding.cvss": { "$gte": 7.5 },
      "finding.reachability": "unreachable",
      "artifact.type": "npm",
      "artifact.name": "lodash",
      "artifact.version": { "$prefix": "4." }
    }
  }' \
  https://api.socket.dev/v0/orgs/$ORG/alert-policies/default/rules

Migrate a legacy single-finding suppression to an alert resolution scoped to a specific CVE, repo, and exact package version.

$ curl -u "$SOCKET_API_TOKEN:" -X POST \
  -H "Content-Type: application/json" \
  -d '{
    "reason": "tolerable_risk",
    "comment": "Dev-only dependency, not shipped",
    "vigil_selector": {
      "finding.alertType": "criticalCVE",
      "finding.cveId": "CVE-2024-29041",
      "location.repo": "my-org/internal-tools",
      "artifact.type": "npm",
      "artifact.name": "lodash",
      "artifact.version": "4.17.20"
    }
  }' \
  https://api.socket.dev/v0/orgs/$ORG/alerts/resolutions

Adds POST /orgs/{org_slug}/alert-policies/default/rules to create policy rules with vigil_selector, action, note, and placement controls (position, before_rule_id, after_rule_id, or rank).
Adds GET .../rules returning { "items": [...] } in evaluation order, PUT .../rules/{rule_id} for partial-update and rule reordering, and DELETE .../rules/{rule_id} for removal.
Adds POST /orgs/{org_slug}/alerts/resolutions to create alert resolutions scoped by vigil_selector fields including finding.cveId, finding.ghsaId, location.repo, artifact.version, with optional reason, comment (up to 1024 chars), and reason_text (up to 256 chars).
Adds GET /orgs/{org_slug}/alerts/resolutions with cursor pagination via startAfterCursor and endCursor, plus per_page (1–100, default 30) and direction; DELETE .../resolutions/{uuid} restores hidden alerts on next refresh.
New vigil_selector operator support includes $prefix for version-range matching (e.g. { "$prefix": "4." }), $gte for CVSS score thresholds, $in for multi-value reachability states, and $or for matching either finding.cveId or finding.ghsaId.

+3 more show less

Maps legacy state values to new action values: block → error, warn → warn, monitor → monitor, ignore → ignore; inherit requires no rule.
Maps legacy matcher fields to new selector fields: packageType → artifact.type, packageNamespace → artifact.namespace, packageName → artifact.name, packageVersion → artifact.version, alertType → finding.alertType, cvssScoreCmp → finding.cvss, cveOrGhsaId → finding.cveId/finding.ghsaId, fixAvailable → finding.fixAvailable, kevs → finding.hasKEV, reachability → finding.reachability.
Introduces finding.cvePatchStatus selector field to query whether a Socket patch exists or is applied for a finding — distinct from the legacy patchAvailable entitlement check, which has no direct translation.

8 details in Everything

└──▷ BREAKING ON UPGRADE

!The legacy POST /orgs/{org_slug}/triage/alerts batch API (keyed under alertTriage) and DELETE /orgs/{org_slug}/triage/alerts/{uuid} are replaced by separate policy-rule and alert-resolution endpoints; existing integrations must migrate.
!The legacy patchAvailable field has no equivalent in the new API and does not translate — rules relying on it must be rewritten using finding.fixAvailable and/or finding.cvePatchStatus.
!Legacy entries carrying an alertKey (suppressing one specific alert instance) have no vigil_selector equivalent and must be recreated as alert resolutions scoped to repo, package, version, and alert type.

docs update Aug 17, 2026 · issue 048

Socket replaces the legacy Security Policy API with a baseline-preset plus explicit rules model, exposing new policy and rule endpoints.

└──▷ TRY IT

Migrate a legacy policy that blocks critical CVEs by setting the balanced baseline on the default policy, then adding a per-alert-type override rule.

$ curl -u "$SOCKET_API_TOKEN:" -X PUT \
  -H "Content-Type: application/json" \
  -d '{ "baseline": "balanced" }' \
  https://api.socket.dev/v0/orgs/$ORG/alert-policies/default

curl -u "$SOCKET_API_TOKEN:" -X POST \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Block critical CVEs",
    "action": "error",
    "vigil_selector": { "finding.alertType": "criticalCVE" }
  }' \
  https://api.socket.dev/v0/orgs/$ORG/alert-policies/default/rules

Inspect the full equivalent of the legacy security policy GET by reading the default policy baseline and its rules in evaluation order.

$ curl -u "$SOCKET_API_TOKEN:" https://api.socket.dev/v0/orgs/$ORG/alert-policies
curl -u "$SOCKET_API_TOKEN:" https://api.socket.dev/v0/orgs/$ORG/alert-policies/default/rules

Adds GET /orgs/{org_slug}/alert-policies to list all policies, returning the default policy first followed by custom policies in creation order.
Adds GET /orgs/{org_slug}/alert-policies/{policy_id}/rules returning { "items": [ ... ] } in evaluation order, replacing the single-response legacy GET.
Adds PUT /orgs/{org_slug}/alert-policies/{policy_id} accepting name, description, repository_ids, and baseline fields; only sent fields are updated, and repository_ids replaces the entire set.
Adds POST /orgs/{org_slug}/alert-policies/{policy_id}/rules to create per-alert-type rules with a name, action, and vigil_selector (e.g. { "finding.alertType": "criticalCVE" }); returns 201 with the stored rule including its full selector and rank.
Adds DELETE on a policy, which removes the policy, its rules, and its label; repositories assigned to it fall back to the default policy. The default policy cannot be renamed or deleted.

+2 more show less

The default policy is addressable as the literal string default as policy_id in every policy and rule endpoint, even after it is first modified and receives a UUID.
New policy model introduces a baseline preset field per policy, replacing the organization-wide securityPolicyDefault; actions error, warn, monitor, ignore, and defer carry over, with defer now meaning fall back to the baseline preset.

7 details in Everything

docs update Aug 17, 2026 · issue 048

Socket adds new alert-policies and alert-resolutions REST API endpoints, replacing legacy security-policy and triage endpoints.

└──▷ TRY IT

List all alert policies for your org using the new endpoint and an org-scoped API token, as a drop-in replacement for the legacy security-policy GET.

$ curl -u "$SOCKET_API_TOKEN:" https://api.socket.dev/v0/orgs/$ORG/alert-policies

List all alert resolutions (specific suppressed findings) for your org — a capability that had no dedicated legacy endpoint.

$ curl -u "$SOCKET_API_TOKEN:" https://api.socket.dev/v0/orgs/$ORG/alerts/resolutions

Introduces GET /orgs/{org_slug}/alert-policies and GET /orgs/{org_slug}/alert-policies/{policy_id}/rules as replacements for GET /orgs/{org_slug}/settings/security-policy.
Introduces POST /orgs/{org_slug}/alert-policies, PUT /orgs/{org_slug}/alert-policies/{policy_id}, and rule endpoints as replacements for POST /orgs/{org_slug}/settings/security-policy.
Introduces GET /orgs/{org_slug}/alerts/resolutions, POST /orgs/{org_slug}/alerts/resolutions, and DELETE /orgs/{org_slug}/alerts/resolutions/{uuid} to handle specific finding suppressions previously mixed into POST /orgs/{org_slug}/triage/alerts.
Introduces GET /orgs/{org_slug}/alert-policies/{policy_id}/rules, POST /orgs/{org_slug}/alert-policies/{policy_id}/rules, and DELETE /orgs/{org_slug}/alert-policies/{policy_id}/rules/{rule_id} as replacements for the legacy triage endpoints.
Adds net-new GET, PUT, and DELETE on /orgs/{org_slug}/alert-policies/{policy_id} and on individual rules — endpoints with no legacy equivalent.

+2 more show less

Introduces fine-grained token scopes for the new endpoints: alert-policy:list, alert-policy:read, alert-policy:create, alert-policy:update, alert-policy:delete for policies and rules; alert-resolution:list, alert-resolution:read, alert-resolution:create, alert-resolution:delete for resolutions.
Alert resolution endpoints are accessible to repository-restricted tokens within their granted repositories, while all alert-policy endpoints require organization-wide repository access (repository-restricted tokens receive 403).

7 details in Everything

└──▷ BREAKING ON UPGRADE

!Once an organization's migration window ends (30 days from when migration is enabled), the legacy POST /orgs/{org_slug}/settings/security-policy and POST /orgs/{org_slug}/triage/alerts endpoints stop accepting writes — automation must be updated to the new endpoints before the cutover.

docs update Aug 17, 2026 · issue 048

Socket introduces Policies: ordered alert-action rules with baseline presets, per-repo scoping, and full REST API management.

Adds a Policies system where each policy is an ordered list of rules that assigns one of four actions — error (Block), warn, monitor, or ignore — to every alert Socket raises.
Introduces four baseline presets (Essential, Balanced, Comprehensive, None) that sit beneath custom rules, with Balanced as the default for new policies and the Default policy.
Supports per-repository policy scoping: each repository belongs to exactly one policy, and the Default policy governs any repository not explicitly assigned to another.
Exposes full policy management via the Socket REST API using Vigil selectors — covering list, create, get, update, and delete operations for both policies and individual rules.
Adds Drafting Rules with AI capability: describe rules in plain language and review Socket-generated rule drafts before applying them.

+1 more show less

Adds a Migrating to Policies guide for moving existing Socket configurations to the new Policies system.

6 details in Everything

Repository-Scoped API Tokens Now Support Reachability Scans (2026-07-09) Jul 9, 2026 · release notes

Socket adds reachability scan file listing support to repository-scoped API tokens

Repository-scoped API tokens can now retrieve the supported-files list required to start reachability scans

1 detail in Everything

Packagist Package Pages Now Surface Force-Pushed Tags (2026-07-06) Jul 6, 2026 · issue 014

Socket now surfaces full commit history for force-pushed Packagist tags, highlighting the current and prior commits.

Displays full commit history for force-pushed tags on Packagist package pages, with the currently associated commit highlighted.
Enables review of commits a package version previously referenced before a tag was overwritten.

2 details in Everything

Private Package Scores Now Display as N/A (2026-07-03) Jul 3, 2026 · release notes

Socket now displays N/A for unscoreable private package scores in PR comments and dependency views

Private packages that Socket cannot score now display N/A instead of a numeric score in pull request comments and dependency views.

1 detail in Everything

New: AI-Reviewed Reachability Specifications (2026-06-30) Jun 30, 2026 · issue 014

Socket adds opt-in AI-generated reachability specs to expand vulnerability reachability coverage beyond human-verified rules.

└──▷ HOW TO FIND IT

Enable AI-generated reachability specs org-wide to get reachability verdicts on a broader set of vulnerabilities during alert scans.

📍In the console, go to Settings → Alert Scans → Reachability and enable the AI-generated reachability specifications option.

Adds opt-in AI-reviewed reachability specifications that extend reachability verdicts to vulnerabilities not yet covered by human-verified specs.
New Specification field in alert details surfaces whether a reachability result was produced by an AI-generated or human-verified specification.

2 details in Everything

New: AI-Reviewed Reachability Specifications Jun 30, 2026 · release notes

Socket adds opt-in AI-generated reachability specifications and a Specification field in alert details to broaden coverage.

Adds Settings → Alert Scans → Reachability toggle to enable AI-generated reachability specifications alongside human-verified ones
Adds a Specification field to Alert details showing whether the reachability result came from an AI-generated or human-verified specification

2 details in Everything

Redesigned Organization Switcher for Faster Navigation (2026-06-29) Jun 29, 2026 · issue 014

Socket's organization switcher now surfaces Settings and orgs upfront, with a searchable All Organizations view.

└──▷ HOW TO FIND IT

Quickly jump between organizations when managing multiple clients or teams.

📍In the Socket console, click the organization switcher in the top navigation, then type an organization name in the All Organizations search box to filter and select it instantly.

Redesigned organization switcher surfaces Settings and organizations at the top level for faster access.
New searchable All Organizations view for users belonging to multiple organizations.

2 details in Everything

Redesigned Organization Switcher for Faster Navigation Jun 29, 2026 · release notes

Redesigned Organization Switcher now includes a searchable All organizations view for faster navigation.

Adds a searchable All organizations view in the Organization Switcher for users with multiple organizations
Surfaces Settings and organization list up front in the redesigned switcher UI

2 details in Everything

Alert Titles Added to CSV Exports (2026-06-23) Jun 23, 2026 · issue 014

Socket CSV exports now include a human-readable Alert Title column and more consistent Upgrade Version values.

Adds a human-readable Alert Title column to Alerts CSV exports, enabling direct CVE identification without cross-referencing the dashboard.
Populates Upgrade Version values more consistently in vulnerability alert CSV exports.

2 details in Everything

Alert Titles Added to CSV Exports Jun 23, 2026 · release notes

Socket adds an Alert Title column to CSV exports for easier CVE identification.

CSV exports now include a human-readable Alert Title column for vulnerability alerts

1 detail in Everything

Socket MCP adds organization alerts, threat feed, and package inspection Jun 18, 2026 · release notes

Socket MCP adds org alerts, threat feed querying, and authenticated package inspection

Adds organization-level alert review with filtering by severity or repository
Enables querying the Socket threat feed by ecosystem, category, and time window
Allows listing, reading, and searching published package artifacts without local installation
Connects package findings to affected repositories and organization alerts
Supports authentication for org alerts and threat feed; depscore remains public

5 details in Everything

New: Socket Firewall support for VS Code and Open VSX Jun 17, 2026 · release notes

Socket Firewall now filters and blocks flagged VS Code/Open VSX extensions via marketplace proxying.

Adds Socket Firewall support for VS Code and Open VSX to filter flagged extensions from marketplace results.
Enables blocking at extension asset and VSIX download URLs in the Socket Firewall closed beta.
Supports deployment through editor configuration, DNS override, or enterprise egress forwarding.

3 details in Everything

New: Manifest Alerts for missing lockfiles Jun 16, 2026 · release notes

Socket introduces Manifest Alerts for missing lockfiles with Jira/Linear integration

Adds Manifest Alerts view to scan results for detecting missing lockfiles in application and project repositories
Supports impact details and remediation for npm, pnpm, yarn, and bun ecosystems when a manifest lacks a corresponding lockfile
Adds controls to ignore/restore Manifest Alerts and create Jira or Linear tickets directly from the alert

3 details in Everything

Add Firewall events data export (2026-06-16) Jun 16, 2026 · issue 014

Socket Firewall now supports exporting event logs to external data sources via the new Data Export integration.

└──▷ HOW TO FIND IT

Route Firewall event logs to an external SIEM or data pipeline for retention and analysis.

📍In the console, go to Settings › Data Export › Create Integration, then select Telemetry events as the data type.

Add Firewall events data export Jun 16, 2026 · release notes

Socket adds UI step to export Firewall telemetry event logs to external integrations

Adds UI path Settings > Data Export > Create Integration for exporting Socket Firewall telemetry events

1 detail in Everything

Obfuscated Code Alerts Now Default to Monitor Jun 16, 2026 · release notes

Socket changes default standalone obfuscated code alerts to Monitor instead of Warn.

Packagist Package Pages Now Show Daily Download Trends Jun 14, 2026 · release notes

Packagist package pages now display a daily downloads chart powered by Packagist stats.

Crates Package Pages Now Show Daily Download Trends Jun 13, 2026 · release notes

Socket crates.io package pages now display daily download metrics and trend graphs.

Crates package pages on Socket.dev now include daily download metrics sourced from crates.io
Daily download trends visualization is added to crate package pages for adoption analysis

2 details in Everything

Bulk-Assign Repository Labels with CSV Import Jun 6, 2026 · release notes

New CSV import feature for bulk-assiging repository labels in Socket

Adds CSV import capability to the Repositories → Labels page for bulk label assignment

1 detail in Everything

Surface Go retraction and PyPI yank warnings Jun 4, 2026 · release notes

Socket updates its UI to highlight risky package versions in Go and PyPI repositories.

Adds a warning banner on Go and PyPI package pages when a version is retracted or yanked

1 detail in Everything

Surface package keywords for GitHub Actions and Packagist Jun 3, 2026 · release notes

Socket displays package keywords and marketplace categories for GitHub Actions and Packagist packages.

Update Composer package metadata Jun 2, 2026 · release notes

Composer package pages now show a Homepage link when available.

Show OpenVSX publishers and repository links May 31, 2026 · release notes

OpenVSX package pages now display publisher info and source repository links

Adds publisher name to the maintainers view and overview metadata for OpenVSX package pages

1 detail in Everything

Add OpenVSX categories, compatibility, and homepage metadata May 31, 2026 · release notes

Socket now displays OpenVSX categories, compatibility, and homepage metadata on package pages.

OpenVSX extension categories are now visible on Socket package pages
VS Code version compatibility information is displayed for OpenVSX extensions
Homepage links are shown for OpenVSX extensions when available

3 details in Everything

Surface Chrome Web Store user counts May 29, 2026 · release notes

Socket Surface now displays Chrome Web Store active-user counts on extension package pages, separating them from download metrics to aid popularity evaluation.

Add duplicate redirect support to diff scan creation May 21, 2026 · release notes

Adds on_duplicate=redirect support to POST /v0/orgs/{org_slug}/diff-scans/from-ids for handling duplicate scans

Add relative date filters to Vulnerabilities and Scans May 19, 2026 · release notes

Adds relative date filters (e.g., 1 week ago) to Vulnerabilities and Scans pages in Socket UI.

Supports relative date presets like 1 week ago and 1 month ago on Vulnerabilities and Scans pages
Adds a Detected date filter specifically for the Vulnerabilities page
Adds created-date filtering with custom calendar options and before/after operators to the Scans page

3 details in Everything

Campaign pages now show artifact identifiers May 15, 2026 · release notes

Campaign pages now display artifact identifiers for affected packages to distinguish identical versioned distributions.

Adds artifact identifiers (e.g., PyPI wheel tags, Maven jar qualifiers) to campaign pages under each affected package.

1 detail in Everything

Add html_url to repository API responses May 1, 2026 · release notes

Repository API responses now include html_url pointing to the Socket dashboard.

Add security policy confirmations and JSON copy actions in the dashboard Apr 30, 2026 · release notes

Adds security policy confirmations and Copy JSON button in the dashboard

Security Policy now requires confirmation before removing custom alert settings or switching presets when custom overrides are present.
Firewall event details include a Copy JSON button to copy the full event body.

2 details in Everything

Add Security settings for active sessions Apr 30, 2026 · release notes

Socket introduces a Security tab within User Preferences for managing active user sessions.

Adds a new Security tab in the User Preferences UI to view and terminate active account sessions

1 detail in Everything

Added Gradle Version Catalog Support for SBOM Generation Apr 11, 2026 · release notes

Socket adds Gradle Version Catalog (libs.versions.toml) support for SBOM generation fallback.

Adds parsing of libs.versions.toml files during SBOM generation to improve dependency detection for Gradle projects without lockfiles.

1 detail in Everything

Updated Default Policy Settings for AI-Detected Potential Malware Apr 3, 2026 · release notes

Socket updates default actions for AI-detected potential malware alerts to warn across all policies, with future block capability.

Sets the default action for AI-detected potential malware alerts to warn in low noise, default, and higher noise security policies

1 detail in Everything

Added Markdown Rendering for Supply Chain Attack Descriptions Mar 27, 2026 · release notes

Adds Markdown rendering to Supply Chain Attack Descriptions in public and dashboard views.

Sync Individual GitHub Installations Mar 26, 2026 · release notes

Adds ability to sync individual GitHub app installations from Dashboard UI and clarifies global sync scope.

Adds UI option to sync a single GitHub installation via Dashboard → Integrations → GitHub
Clarifies that the Sync all GitHub installations button syncs every linked organization installation

2 details in Everything

Scan Scores in API Responses Mar 24, 2026 · release notes

Socket API now includes scan scores in streaming events and supports detailed score breakdowns via query parameter

Streaming full-scan data now includes a scores event type containing score details
Adds ?include_score_details query parameter to view components of full-scan scores

2 details in Everything

Improved Mobile Experience for Attack Campaign Pages Mar 24, 2026 · release notes

Improved mobile usability for public supply chain attack campaign pages.

Improved Package Search Result Display in the Overlay Mar 5, 2026 · release notes

Improved package search overlay behavior with conditional View all and accurate footer counts.

The package search overlay now shows the View all option only when more than 20 results are available.
The result list behaves more consistently when exact matches or empty states are shown.

2 details in Everything

Preserved File Paths When Switching Package Versions and Artifacts Mar 2, 2026 · release notes

Package file navigation preserves current path when switching versions or artifacts

Fixed Empty Workspace Parameter Handling for Repository Scans Feb 27, 2026 · release notes

Socket fixes workspace parameter handling to allow omitting or passing an empty value for default workspace scans

Omitting the workspace parameter now correctly targets the default-workspace repository for full or diff scans

1 detail in Everything

New: “Summarize With AI” Links to Blog Posts Feb 26, 2026 · release notes

Socket adds Summarize With AI links to blog posts for quick TL;DR via external AI assistants.

Added Generic Bucket Export Integration Feb 14, 2026 · release notes

Socket adds generic bucket export integration supporting AWS S3, GCS, Azure Blob with CSV/JSON/Parquet formats.

Adds aws_s3 bucket support for generic alert data export
Adds google_cloud_storage (GCS) bucket support for generic alert data export
Adds azure_blob_storage bucket support for generic alert data export
Adds csv, json, and parquet output format support for bucket exports

4 details in Everything

Display Scan Type Indicator On SBOM Report Page Feb 14, 2026 · release notes

SBOM report pages now display a scan type indicator in the header.

New: Scan Type Column And Filtering In Full Scans Feb 13, 2026 · release notes

New Scan Type column and filtering in Full Scans UI and API to distinguish socket, tier1, or basics scans.

New Triage Page in Organization Settings Feb 5, 2026 · release notes

Socket introduces a centralized UI for organization-level triage policy management.

The new Triage page consolidates visibility of PURL-based and Alert Key-based rules.

1 detail in Everything

Universal PURL Redirect for Package Pages Feb 3, 2026 · release notes

Adds https://socket.dev/purl/<purl> endpoint for universal package page redirects

Adds a new standardized PURL-based redirect endpoint at /purl/$URL_ENCODED_PURL that routes to the correct package page regardless of ecosystem

1 detail in Everything

Improved Alert Triage API Controls Jan 29, 2026 · release notes

Socket Alert Triage API gains required ?force parameter and DELETE support.

Adds ?force query parameter to the Alert Triage API to require confirmation for broad triage operations
Adds DELETE method support to the Alert Triage API to remove previously applied triage

2 details in Everything

Improved Alert Details With Associated Files Jan 26, 2026 · release notes

Improved Alert Details With Associated Files

New: Configurable Display Options for Alert Tables Jan 15, 2026 · release notes

Socket adds configurable display options for alert table badges via a new UI menu

Customizable Alert Table Badges and Display Options Jan 15, 2026 · release notes

Alert table supports configurable display options for grouping and badge ordering.

Adds configurable display options to alert tables, allowing users to control how alerts are grouped and which badges (e.g., priority, severity, action) appear first.

1 detail in Everything

More Flexible Alert Table Display Options Jan 15, 2026 · release notes

Socket adds configurable badge display options for dashboard alert tables

Socket CLI 1.1.58 Jan 15, 2026 · release notes

Socket CLI 1.1.58 adds --reach-enable-analysis-splitting to control analysis splitting for reachability scans.

Adds --reach-enable-analysis-splitting flag to opt-in to multiple analysis runs per workspace for reachability scans
Analysis splitting is now disabled by default for reachability scans

2 details in Everything

New: Organization-Scoped PURL Endpoint Jan 8, 2026 · release notes

Socket adds POST /v0/orgs/{org_slug}/purl endpoint for organization-specific policy application

Adds POST /v0/orgs/{org_slug}/purl endpoint to apply organization-specific policies based on repository labels
Deprecates POST /v0/purl legacy endpoint, scheduled for removal on 2026-07-30

2 details in Everything

└──▷ BREAKING ON UPGRADE

!The POST /v0/purl endpoint is deprecated and will be removed on 2026-07-30, requiring migration to POST /v0/orgs/{org_slug}/purl

New: Wildcard Scope Support for API Tokens Jan 8, 2026 · release notes

API tokens now support a wildcard [*] scope to automatically inherit all future scopes.

PublishedAt Field Added to Threat Feed API Jan 7, 2026 · release notes

Threat Feed API adds publishedAt field to result objects

Adds publishedAt field to Threat Feed API responses (ISO 8601 or null)
Exposes new timestamp in GET /v0/orgs/{org_slug}/threat-feed endpoint

2 details in Everything

Python CLI: Slack Bot Mode Support Added Jan 5, 2026 · release notes

Socket Python CLI adds Slack bot mode for multi-channel alerting

Adds Slack bot mode to the Socket Python CLI alongside existing webhook-based notifications
Enables posting alerts to multiple Slack channels using a bot token
Supports configurable filters per channel
Supports reachability alerts during full scans

4 details in Everything

Update Swift repository metadata Jan 4, 2026 · release notes

Swift package pages now surface source repo metadata like avatar, issues, PRs, archive status, and stars.

Swift package pages now link to the source repository
Surface related GitHub metadata including repository avatar, open issues, pull requests, archived or disabled status, and stargazer reputation

2 details in Everything

Socket CLI 1.1.52 Jan 3, 2026 · release notes

Socket CLI 1.1.52 updates the internal Coana CLI engine.

Python CLI: Slack Formatter Added for Reachability Analysis Jan 3, 2026 · release notes

Socket Python CLI now supports Slack notifications with reachability-prioritized formatting for Socket Facts.

Slack formatter prioritizes reachable vulnerabilities and respects Slack block size limits

1 detail in Everything

Python SDK: Custom User Agent Support Jan 2, 2026 · release notes

Socket Python SDK adds custom User Agent support for library users

Adds the ability to override the default User Agent string in the Socket Python SDK.

1 detail in Everything

Python SDK: Expanded Endpoint Coverage and Enhancements Jan 2, 2026 · release notes

Socket Python SDK gains OpenVEX export, archive support, and env var token auth

Adds openvex_bom method for exporting Software Bill of Materials in OpenVEX format
Adds support for initializing API tokens via environment variables instead of only constructor arguments
Adds new endpoint modules for Alerts, full scan search, Fixes, Supported Files, Webhooks, and Telemetry to the Socket API
Adds archive upload support for .tar, .tar.gz, .tgz, and .zip files
Adds lazy file loading for improved performance when scanning large workspaces

+2 more show less

Adds full scan rescan support and archive download capabilities
Adds dependencies_trend method for dependency history analysis

7 details in Everything

API Token Security Enhancement Dec 16, 2025 · release notes

Socket adds SHA-512 hash-based operations for API tokens to reduce exposure in logs and requests.

sha512- SRI format hashes are now included with newly created or rotated API tokens
API endpoints now accept token hashes for rotation, update, and revocation operations

2 details in Everything

Socket CLI 1.1.47 Dec 15, 2025 · release notes

Socket CLI 1.1.47 adds a --debug flag to socket fix for verbose logging.

Contributor Access to Dependencies Dec 15, 2025 · release notes

Adds Contributor-level access to the organization's Dependencies tab in Socket UI.

New: Webhook Testing and Debugging Dec 15, 2025 · release notes

New Webhook Testing and Debugging view in Socket for inspecting delivery logs

Adds a new Debug Webhook view showing a paginated table of sent messages with detailed request/response delivery logs

1 detail in Everything

Socket CLI 1.1.45 Dec 10, 2025 · release notes

Adds --reach-use-only-pregenerated-sboms to restrict reachability analysis to pre-computed SBOMs

Adds --reach-use-only-pregenerated-sboms flag to run Tier 1 reachability using only pre-computed CDX and SPDX SBOMs
Updated the Coana CLI dependency to v 14.12.122

2 details in Everything

New Campaigns Tab on the Threat Intel Page Dec 8, 2025 · release notes

New Campaigns tab on Threat Intel page adds supply chain attack visibility

Expands the logged-in dashboard Threat Feed with an Insights panel
Introduces a dedicated campaign detail page linking back to impacted repositories in your dashboard

2 details in Everything

Socket CLI 1.1.43 Dec 8, 2025 · release notes

Socket CLI 1.1.43 adds --all flag to process all vulnerabilities in local mode

Create Full Scans from the Dashboard via Manifest Uploads Dec 5, 2025 · release notes

Dashboard allows full scans via manifest file upload for CI-free testing

Adds ability to create a full scan from the Socket dashboard by uploading manifest files

1 detail in Everything

Socket CLI 1.1.41 Dec 3, 2025 · release notes

Socket CLI 1.1.41 adds --reach-version and --fix-version flags to override @coana-tech/cli versions

Socket CLI 1.1.39 Dec 2, 2025 · release notes

Socket CLI 1.1.39 introduces a file output capability for the socket scan reach command via the --output flag and updates its underlying Coana CLI engine.

socket scan reach now supports the --output <path> flag (e.g., --output scan-report.json) to write the scan result to a file

1 detail in Everything

Socket CLI 1.1.35 Nov 26, 2025 · release notes

Socket CLI 1.1.35 adds --reach-debug for verbose reachability logging

New: Webhook Events for Alert Changes Nov 22, 2025 · release notes

Socket adds real-time webhook events for alert lifecycle changes (create, update, clear)

Adds socket webhook events that fire when an alert is created, updated, or cleared across repositories

1 detail in Everything

Org-level Telemetry Configuration Nov 21, 2025 · release notes

Org-level telemetry configuration via API endpoints and dashboard settings

Adds GET /api/telemetry and PUT /api/telemetry endpoints to retrieve and update org-level telemetry settings
Introduces a new dashboard settings page for admins and owners to enable or disable telemetry at the organization level

2 details in Everything

New: OpenVSX Extension Scanning Nov 21, 2025 · release notes

Socket adds experimental scanning for OpenVSX extensions to surface supply chain threats in developer tools

Add Search to the Package File Explorer Nov 21, 2025 · release notes

Adds search capability to the Package File Explorer in Socket's UI.

Bun and vlt Support Now in Beta Nov 20, 2025 · release notes

Socket adds beta coverage for Bun and vlt package managers

Adds bun.lock and vlt-lock.json file detection to automatically analyze dependency graphs for Bun and vlt projects

1 detail in Everything

Reachability for Ruby Now in Beta Nov 18, 2025 · release notes

Socket adds function-level reachability analysis for Ruby in beta to identify exploitable vulnerabilities.

API Support for Managing Webhooks Nov 18, 2025 · release notes

Socket API v0 gains full CRUD endpoints for programmatic webhook management

Adds create, get, list, update, and delete API endpoints for managing webhooks in Socket API v0

1 detail in Everything

SBOM generation for vlt lockfiles Nov 18, 2025 · release notes

Socket adds full SBOM generation from vlt lockfiles (vlt-lock.json) with workspace, git, and file dependency support.

Adds vlt arborist integration for accurate dependency resolution from vlt-lock.json
Enables full SBOM output pipeline for vlt projects including workspaces, git dependencies, and file dependencies

2 details in Everything

Socket CLI 1.1.29 Nov 17, 2025 · release notes

Socket CLI 1.1.29 adds concurrency and analysis splitting controls for socket scan create --reach.

Python CLI: New Reachability Flag and Improved Docker Entrypoint Nov 16, 2025 · release notes

The Socket Python CLI now allows disabling analysis splitting for reachability scans via a new flag, and fixes Docker entrypoint compatibility.

Add Option to Disable SSL Verification in Python SDK Nov 14, 2025 · release notes

Socket Python SDK gains allow_unverified parameter in constructor to skip SSL verification

Adds allow_unverified optional parameter to the socketdev constructor to disable SSL certificate verification

1 detail in Everything

Improve Reachability Analysis Options and SSL Handling in Python CLI Nov 14, 2025 · release notes

Socket CLI adds --reach-concurrency and --reach-additional-params flags and fixes SSL verification.

Added --reach-concurrency flag to control parallel execution in reachability analysis (minimum value: 1)
Added --reach-additional-params flag to pass custom parameters to the coana CLI tool

2 details in Everything

Add Optional Summary Parameter to Batch PURL Endpoint Nov 14, 2025 · release notes

Socket's /v0/purl batch endpoint adds optional summary=true parameter for batch resolution counts

Socket CLI 1.1.27 Nov 13, 2025 · release notes

Socket CLI v1.1.27 enables selective package remediation by adding --exclude and --include arguments to the socket fix command, mirroring functionality available in v2.

--exclude flag added to socket fix.

1 detail in Everything

Restore Settings for Disabling Ecosystems on the Alerts Scans Page Nov 12, 2025 · release notes

Socket adds UI toggles on Settings > Alerts > Scans to control which ecosystems are scanned for alerts

Socket CLI 1.1.26 Nov 9, 2025 · release notes

Adds debug logging for API requests and responses in Socket CLI 1.1.26

Python CLI: Added UV to Docker Image Nov 8, 2025 · release notes

Socket Python CLI Docker image now includes uv for reliable Coana reachability analysis.

Python CLI: Reachability Analysis Support Nov 7, 2025 · release notes

Socket CLI adds --reach for dependency reachability analysis to filter non-exploitable vulnerabilities

Adds the --reach flag to enable reachability analysis of vulnerable dependencies
Adds the --only-facts-file flag to submit reachability results independently

2 details in Everything

License Policy API Now Includes 'deny' Field Nov 1, 2025 · release notes

License Policy API now exposes a deny field in responses and exports to list all unallowed licenses.

deny field added to JSON exports of license policies

1 detail in Everything

Added Support for TypeScript Declaration File Extensions Oct 29, 2025 · release notes

Package diff viewer adds support for TypeScript and JavaScript declaration file extensions

Added CSV Export to Scans View Oct 29, 2025 · release notes

Adds CSV export capability to the Scans view (SBOM Report Page)

CSV Export to Scans View

1 detail in Everything

New: Socket Firewall Enterprise Oct 24, 2025 · release notes

Socket Firewall Enterprise adds on-prem HTTPS proxy deployment, org-wide policy controls, and multi-ecosystem support.

Adds Socket Firewall Enterprise edition with flexible deployment options including long-lived HTTPS proxy for on-prem environments
Adds configurable organization-wide policies to customize which alerts trigger warnings or blocks via integration with Socket's security and license policies
Adds support for Maven, Go modules, RubyGems, and NuGet package ecosystems alongside existing JavaScript, Python, and Rust coverage
Introduces MUSL build for improved compatibility with CI pipelines and containerized deployments

4 details in Everything

New: GitHub Actions Scanning Support Oct 23, 2025 · release notes

Socket adds experimental scanning of GitHub Actions workflows for security and license risks.

Supports scanning GitHub Actions workflows for security and license risks via deep package inspection
Detects malicious or obfuscated code in action dependencies using the Argus taint-tracking engine

2 details in Everything

New: Webhook Events for Pull Request Scans Oct 23, 2025 · release notes

Socket adds webhook events for pull request scans to push results directly to Slack, Jira, or CI pipelines.

Adds Webhook Events for Pull Request Scans, allowing automatic receipt of scan results and security alerts in real time.
Webhook payloads include detailed information about changed dependencies, new alerts, and direct links to the Socket dashboard and API.

2 details in Everything

New: Socket Basics Oct 21, 2025 · release notes

Socket launches Basics to unify SAST, secret detection, container scanning, CVE checks, and policy management via Dashboard.

Unifies Static analysis (SAST) for 14 programming languages, Secrets detection, Container/Dockerfile scanning, and CVE scanning under one workflow
Centralizes policy management through the Socket Dashboard

2 details in Everything

Expanded: Socket Basics Configuration Oct 21, 2025 · release notes

Socket Basics expands configuration options for SAST, secrets, and notifications with UI updates

Adds over 100 new configuration options for Socket Basics to control security scanning settings
Supports per-language rule customization across 17 language SAST scanners
Enables secret and container scanning configuration via expanded config keys
Adds Socket Tier 1 reachability analysis controls in the configuration
Integrates 12 notification channels (Slack, Jira, GitHub, Microsoft Teams) via config settings

+1 more show less

Redesigns the UI with organized sections and an All Languages toggle

6 details in Everything

Added: Critical Alert Priority and Colorful Priority Icons Oct 21, 2025 · release notes

Socket introduces a new critical alert priority level and updates UI icons to be color-coded for better visibility.

Introduces critical as a new alert priority level alongside high, medium, and low.
Renders priority icons with color-coding for easier scanning in the UI.

2 details in Everything

Experimental Malware Scanning for Hugging Face Models Oct 21, 2025 · release notes

Socket introduces experimental supply chain protection for AI models, allowing users to detect hidden payloads in major frameworks and integrate scanning via API or AIBOM.

Socket Firewall v0.14.0 Oct 18, 2025 · release notes

Socket Firewall v0.14.0 adds configurable action for unrecognized hostnames and graceful API retry handling

action configuration added to control the default network behavior for unrecognized hostnames.
Graceful retry handling introduced for failed API calls or non-2xx responses.

2 details in Everything

Socket CLI 1.1.24–1.1.25 Oct 10, 2025 · release notes

Socket CLI 1.1.24–1.1.25 adds flags to control dependency update scope and support local analysis.

Adds --minimum-release-age flag for the socket fix command to skip fixes for recently released dependencies
Supports SOCKET_CLI_COANA_LOCAL_PATH environment variable to configure local Coana analysis paths
Adds --no-major-updates flag to prevent major version upgrades during remediation
Adds --show-affected-direct-dependencies flag to display direct dependencies impacted by a fix

4 details in Everything

New: Support for Python Vulnerability Fixes in socket fix Oct 8, 2025 · release notes

socket fix now auto-upgrades affected Python dependencies in requirements.txt and uv.lock.

New: Custom Tabs in Org Alerts Oct 3, 2025 · release notes

Adds custom tabs in org alerts to save, name, and share filter sets across the organization.

Adds the ability to create, rename, duplicate, and delete custom tabs on the org alerts page for business and enterprise plans.

1 detail in Everything

Filter by Repository Labels in RepoSwitcher Sep 25, 2025 · release notes

RepoSwitcher now supports filtering repositories by label to scope dashboard content.

Adds label selection in RepoSwitcher dropdown to filter repositories across the entire dashboard
Auto-persists selected label in internal navigation links within RepoSwitcher
Highlights matched text in RepoSwitcher search results

3 details in Everything

New: Bulk Label Assignment for Repositories Sep 23, 2025 · release notes

Adds bulk label assignment for multiple repositories via the UI

New: PyPI Version Diff Support Sep 23, 2025 · release notes

Socket adds PyPI package version diff support alongside npm

Extends version diff functionality to PyPI packages with side-by-side insights for TAR, WHL, and EGG artifact types
Adds accurate semantic version detection and comparison specifically for Python packages

2 details in Everything

Socket CLI v1.1.21 Sep 21, 2025 · release notes

Socket CLI v1.1.21 adds --compact-header for cleaner output and improves package manager interception.

Adds --compact-header flag to stream CLI output display
Improves package manager interception for more accurate scanning
Enhances detection of temporary package execution environments

3 details in Everything

Export Alerts as CSV Sep 20, 2025 · release notes

Socket adds Export as CSV button on Organization Alerts page to download filtered alerts.

Socket CLI v1.1.20 Sep 20, 2025 · release notes

Socket CLI v1.1.20 adds terminal link support for richer output and improves Windows package manager compatibility.

Reintroduced Repository Page with Improved Label Management Sep 19, 2025 · release notes

Reintroduced Repository details page with simplified label management and reorganized dependencies view.

Adds a reintroduced Repository details page providing quick access to dependencies, alerts, and scans.
Introduces new, simplified label management for repositories.
Moves attribution download to the top-right corner of the Dependencies page with support for organization-wide attribution.

3 details in Everything

Socket CLI v1.1.13–v1.1.15 Sep 17, 2025 · release notes

Socket CLI v1.1.13–v1.1.15 expands the socket fix command with new CLI flags for export and dry-run modes.

Adds --output-file <path> flag to socket fix to save computed fixes to a JSON file
Adds --only-compute flag to socket fix to compute fixes without applying them

2 details in Everything

Improved Alert Filtering with Semantic Grouping Sep 17, 2025 · release notes

Improved Alert Filtering with Semantic Grouping organizes alert types into user-friendly categories via existing backend schemas.

Python SDK: Support for base_paths in FullScans and DiffScans Sep 12, 2025 · release notes

Socket Python SDK adds base_paths parameter to FullScans and DiffScans APIs.

Python CLI: Enhanced Monorepo Support with Multiple Sub-paths Sep 12, 2025 · release notes

Socket CLI --sub-path flag allows specifying multiple directories for a single monorepo workspace scan.

Adds --sub-path CLI argument to socket scan commands, allowing the flag to be passed multiple times to include several directories in a single workspace scan
Integrates --sub-path with the base_paths parameter in the fullscans API endpoint

2 details in Everything

Python CLI: Monorepo Workspace Support Sep 12, 2025 · release notes

Adds --sub-path and --workspace-name CLI flags to socket scan for individual monorepo workspaces

Adds --sub-path and --workspace-name options to the Python CLI enabling scanning of individual workspaces in monorepos while preserving git context.

1 detail in Everything

Rust Support In Beta Sep 11, 2025 · release notes

Socket moves Rust scanning from Experimental to Beta with full SBOM generation

Enables full Rust project analysis including Cargo workspaces and Cargo.toml-only crates
Unlocks full SBOM generation for Rust dependencies
Activates Rust-aware supply chain checks in the general beta tier

3 details in Everything

Socket Fix 2.0 Released Sep 10, 2025 · release notes

Socket Fix 2.0 adds socket fix --id targeted remediation and Coana-powered upgrade planning across six ecosystems

socket fix --id <GHSA> allows targeted remediation of specific CVEs via a new CLI flag

1 detail in Everything

└──▷ BREAKING ON UPGRADE

!The --test flag is removed from the socket fix command; validation now relies on existing CI gates.

Python SDK: Align Endpoints and Tests with OpenAPI Spec Sep 9, 2025 · release notes

Socket Python SDK adds apitokens.list() and base_path param

Adds apitokens.list() method to list API tokens programmatically.
Adds base_path parameter support in file upload methods to override default URL paths.
Updates multiple API endpoints to align with the OpenAPI specification, correcting URL paths and HTTP methods.

3 details in Everything

Tier 1 Reachability Now Available for Enterprise Teams Sep 9, 2025 · release notes

Socket adds Tier 1 Reachability to scan for exploitable vulnerabilities in JS, TS, Python, Go, Java, and .NET

└──▷ USE IT

Run a scan focusing only on exploitable reachability in supported languages to filter out irrelevant CVEs.

shell

socket scan create --reach

Adds socket scan create --reach flag for full application reachability analysis to identify actually exploitable vulnerabilities.
Introduces Trace View capability showing exact call paths from source code into vulnerable functions for evidence-based remediation.
Extends ecosystem support for Tier 1 Reachability analysis to JavaScript, TypeScript, Python, Go, Java, and .NET.

3 details in Everything

Add Autofix Command for CVEs in Alert Modal Sep 4, 2025 · release notes

Socket CLI adds socket fix --ghsa <GHSA> command to compute and apply vulnerability fixes.

Adds the socket fix --ghsa <GHSA> subcommand to the Socket CLI for computing and applying fixes for vulnerabilities.

1 detail in Everything

API: Improved Error Handling for Malformed PURLs Sep 4, 2025 · release notes

Socket API /v0/purl now returns 400 with actionable error details for malformed PURLs

GET /v0/purl returns a 400 Bad Request with specific guidance when a submitted PURL is malformed (e.g. missing pkg: prefix) or unknown.

1 detail in Everything

Python SDK: v3.0.3 Released with Complete API Coverage Sep 2, 2025 · release notes

Socket.dev Python SDK v3.0.3 expands API coverage with new client modules for analytics, threats, and auditing.

Analytics, ThreatFeed, ApiTokens, AuditLog, and AlertTypes client classes now available in the Python SDK
Enhanced DiffScans and Triage client functionality for scanning and workflow management
New OpenAPI client support for API schema interaction

3 details in Everything

Alert Modal Updated to Show Affected Versions Aug 29, 2025 · release notes

Socket's alert modal now shows specific affected versions for improved clarity.

Customize Pull Request Alert Comment Headers Aug 29, 2025 · release notes

Socket lets you customize Pull Request alert comment headers via a Markdown editor in the dashboard.

Show Patched and Vulnerable Versions on Alerts Page Aug 28, 2025 · release notes

Alerts page now displays vulnerable version range and first patched version for each alert.

Python CLI: Update to socketdev 3.0.0 Aug 23, 2025 · release notes

Socket Python CLI updates package name to socketdev and migrates dependency management to uv.

Migrates the package from socket to socketdev, making it the primary installable name for version 3.0.0.
Moves dependency management tooling from Rye to uv, aligning with modern Python workflow standards.

2 details in Everything

└──▷ BREAKING ON UPGRADE

!Users must replace socket package imports and dependencies with socketdev to use version 3.0.0.

Support SBOM Generation from Cargo.toml-only Crates Aug 16, 2025 · release notes

Socket adds SBOM generation for Cargo.toml-only crates missing lockfiles.

Adds support for generating Software Bill of Materials (SBOM) for Rust crates that contain only a Cargo.toml file without a Cargo.lock.

1 detail in Everything

New PR Stories Tab Aug 15, 2025 · release notes

Adds a PRs tab to the Scans page in Socket showing PR status for dependency changes and alerts

Adds PRs tab to the Scans page UI to view pull requests alongside their dependency change and alert status

1 detail in Everything

New Feedback Popover on Pull Request Scans Page Aug 14, 2025 · release notes

Adds a feedback popover on the Pull Request Scans page to collect UX input via emojis and free-form text.

Enable Resizing of Insights Panels Aug 13, 2025 · release notes

Socket adds resizable insights panels on Alerts, Dependencies, and Repositories pages

Document Support for Crates, NuGet, and RubyGems Ecosystems Aug 7, 2025 · release notes

SBOM export endpoints now officially document support for NuGet, Crates, and RubyGems ecosystems

Add Insights Panel on Dashboard Repositories Page Aug 6, 2025 · release notes

Adds an Insights panel with a time-series chart and label filters to the dashboard's Repositories page

Introduces the new Insights panel on the Dashboard Repositories page showing repository counts and time series trends
Adds repository label filtering capability within the new Insights panel to update analytics views

2 details in Everything

Improve Support for Dependencies in Maven POM <profiles> Sections Aug 5, 2025 · release notes

Socket now resolves dependencies defined in Maven POM <profiles> sections for conditional support.

Add Insights Panel on Dashboard Dependencies Page Aug 5, 2025 · release notes

Socket adds an Insights Panel on the Dashboard Dependencies page with dependency counts and trend visualization

Adds a new Insights panel on the Dashboard Dependencies page providing direct and transitive dependency counts
Adds a time series chart within the Insights panel for visualizing dependency trends

2 details in Everything

Fix Maven BOM Tarball Processing to Enable File Explorer Support Aug 4, 2025 · release notes

Socket enables File Explorer visibility for Maven BOM projects

New: License Overlays for Custom License Management Jul 31, 2025 · release notes

Socket adds License Overlays for custom license management, allowing per-package license identification and author info edits.

Adds the ability to create license overlays in Socket for customizing license information in dependency trees.
Enables modifying license detection results on a per-package basis.
Supports applying changes across versions using glob patterns (e.g., 1.*).
Allows editing of license identifiers and author info for cleaner attribution files.
Adds support for overlay notes to provide additional context.

+1 more show less

Introduces the Settings → Legal → License Overlays interface for viewing and managing overlays.

6 details in Everything

Add RepoSwitcher to Dashboard for Improved Navigation Jul 31, 2025 · release notes

Adds RepoSwitcher component to Socket Dashboard for global repository filtering

Adds RepoSwitcher drop-down to the Dashboard next to the OrgSwitcher, acting as a global repository filter for PR Stories, Repositories, Dependencies, Alerts, Scans, PRs, and Analytics pages.
Adds dependencies and scans columns to the Repositories page in the dashboard UI.
Applies the global repository filter to the Alerts and Scans tables and removes unnecessary columns for a cleaner view.

3 details in Everything

Rust Support Now Available Jul 31, 2025 · release notes

Socket adds Rust/Cargo ecosystem support with crate search, security scores, and experimental SBOM generation.

Adds socket.dev crate search for all users covering the Rust and Cargo ecosystem
Provides security scores, maintainer info, and dependency insights for Rust packages
Enables experimental SBOM generation for enterprise Rust projects with full workspace support

3 details in Everything

Support for GitHub Merge Queues Now Available Jul 31, 2025 · release notes

Socket GitHub app triggers full scans and check runs for commits landing via GitHub Merge Queues

Requires the Merge queue permission for the Socket GitHub app; existing orgs will see a permission request to upgrade

1 detail in Everything

Precomputed Reachability Analysis Is Now Available Jul 30, 2025 · release notes

Precomputed reachability analysis now flags unreachable CVEs with no setup.

Adds automatic precomputed reachability analysis that flags up to 80% of vulnerabilities as irrelevant using only manifest files like package-lock.json and requirements.txt
Introduces a new CVE Reachability section in alert modals and a filter by reachability to prioritize actionable findings
Sets unreachable CVEs to default to the monitor action instead of active remediation

3 details in Everything

New Vulnerability Reachability Funnel Chart Jul 30, 2025 · release notes

Socket adds a CVE Funnel Chart on the Overview page to visualize vulnerability reachability across four stages.

Experimental Protection for Chrome Extensions Jul 29, 2025 · release notes

Experimental pilot for scanning Chrome extensions for malware and supply chain risks

Expands Socket's scope to scan Chrome extensions for malware, risky permissions, and silent supply chain attacks

1 detail in Everything

Socket MCP Now Available in Claude Desktop Extensions Jul 29, 2025 · release notes

Socket MCP now available as a Claude Desktop Extension enabling in-chat dependency scanning

Scala and Kotlin Support (Beta) Jul 28, 2025 · release notes

Socket adds beta support for scanning Scala and Kotlin JVM dependencies.

New: View EPSS Score History Jul 25, 2025 · release notes

Socket adds UI popover to view the last 7 EPSS scores with higher precision

Adds a new UI popover that displays the last 7 EPSS scores for dependencies
Increases precision for fractional digits in the EPSS score history renderings

2 details in Everything

Enhanced Dependency Search API Jul 25, 2025 · release notes

Dependency Search API now accepts purl list in request body

New Alerts Trend Chart in Insights Panel Jul 24, 2025 · release notes

Insights panel on Alerts page gains a trend chart to visualize alert patterns over time.

Increased File Limit for Full and Diff Scans Jul 24, 2025 · release notes

Socket increases the maximum number of files for full-scan and diff-scan API submissions from 1,000 to 5,000.

Raises the maximum file limit for full-scan and diff-scan API submissions from 1,000 to 5,000 files
Enables larger projects and repos to be scanned without hitting file count limits

2 details in Everything

EPSS Score Now Visible in Alert Modal Jul 19, 2025 · release notes

EPSS score and percentile now visible in the AlertModal for vulnerability prioritization.

Adds EPSS score and percentile display to the AlertModal UI component

1 detail in Everything

Alert Modal Now Displays Known Exploited Vulnerabilities (KEV) Data Jul 8, 2025 · release notes

Socket Dashboard alert modal now displays CISA Known Exploited Vulnerabilities (KEV) data.

Python CLI: GitLab api Event Support + Safer License File Naming Jul 4, 2025 · release notes

Socket Python CLI adds --license-file-name flag and GitLab API event support

Adds --license-file-name CLI flag to specify a static output filename for license reports instead of auto-generated names based on repo/branch

1 detail in Everything

SBOM Support for Rust/Cargo Projects Jul 3, 2025 · release notes

Socket adds comprehensive SBOM generation for Rust/Cargo projects via Cargo.toml and Cargo.lock files

Redesigned Scan Pages in the Dashboard Jul 3, 2025 · release notes

Socket updates Dashboard Scan Pages with simplified headers and a redesigned Insights panel for easier access.

Redesigned SBOM Report Page UI with simplified headers showing only repository, PR, and timestamp.
Removed redundant information such as duplicate Manifests labels and UUID-heavy scan IDs from scan pages.
Updated Insights panel layout and control buttons to improve accessibility within the Dashboard.

3 details in Everything

View Diff Scans by ID in the Dashboard Jun 26, 2025 · release notes

Socket Dashboard now supports viewing Diff Scans directly by ID via a new dedicated page and API routes.

Adds a dedicated page on the Socket Dashboard to view diff scans using their unique Diff Scan ID
Updates internal URLs in the API and GitHub app to link to the new diff scan route
Enables tracking and sharing of diff scans as standalone resources powered by stored multi-SBOM data

3 details in Everything

Changelog Notification Now Functions as Read Indicator Jun 26, 2025 · release notes

Changelog notification dot now clears immediately on open rather than persisting for 48 hours

Improves the pink dot indicator on the Socket dashboard to disappear immediately when the Help & Info popover is opened

1 detail in Everything

New API Endpoint for Alert Details Jun 25, 2025 · release notes

Socket adds /alert-types API endpoint to fetch detailed alert metadata programmatically.

Adds the /alert-types API endpoint for retrieving detailed information about specific alerts
Enables fetching alert context outside the UI to streamline integrations

2 details in Everything

New Collapse Sidebar Button in the Dashboard Jun 23, 2025 · release notes

Socket adds a collapse/expand button to the dashboard sidebar

Socket MCP Now Available as a Hosted Service Jun 19, 2025 · release notes

Socket MCP is now available as a hosted service on https://mcp.socket.dev for direct client integration.

Adds the option to use the Socket MCP server via the hosted service at https://mcp.socket.dev instead of running it locally.

1 detail in Everything

New Copy-to-Clipboard Button in File Viewer Jun 19, 2025 · release notes

Socket adds a copy-to-clipboard button to the File Explorer header for quick snippet sharing.

Adds a copy-to-clipboard button in the File Viewer header to quickly grab and share code snippets.

1 detail in Everything

Socket CLI v1 Released Jun 13, 2025 · release notes

Socket CLI v1 introduces streamlined commands with automated defaults for org/cwd and new subcommands like socket scan diff.

Dropped the need to manually pass org and cwd by using stored defaults and interactive prompts when needed
Reworked socket analytics, socket audit-log, and socket repository commands for simpler, more consistent usage
Added new socket scan diff, socket package score, and socket scan report commands to replace deprecated ones

3 details in Everything

└──▷ BREAKING ON UPGRADE

!Manual passing of org and cwd arguments is no longer supported; users must use stored defaults or prompts
!Older commands are deprecated and replaced by new subcommands (socket scan diff, socket package score, socket scan report)
!The CLI now defaults to the v1 experience, requiring migration via the provided guide

Improved Blog Search and Navigation Jun 13, 2025 · release notes

Socket adds blog search and back-button navigation on its website.

Adds a search bar to the Socket site for finding blog posts.
Adds a Back button on individual blog post pages.

2 details in Everything

New: Manual Alert Refresh Button Jun 12, 2025 · release notes

Socket adds a manual refresh button on the Alerts page to get fresher data outside the standard cycle

Adds a Request refresh action in the Alerts page top-right '...' menu for Enterprise (every 6 hours) and Team (every 12 hours) users.
Displays the timestamp of the last manual refresh on the Alerts page.
Shows an error message when the rate limit for manual alert refresh is exceeded.

3 details in Everything

New: Filter Alerts by Action Source Jun 5, 2025 · release notes

New UI filter to distinguish manual vs automated alert resolutions in Socket.

Adds the Alert Action Source filter to the alert table via UI path Filter → Alert Action Source

1 detail in Everything

└──▷ BREAKING ON UPGRADE

!The policy coverage filter is removed; users can no longer filter by policy coverage in the alert table.

Support for pylock.toml (PEP 751) Now Available Jun 4, 2025 · release notes

Socket adds support for analyzing pylock.toml (PEP 751) Python lock files

Supports pylock.toml (PEP 751) Python lock file format for secure, reproducible builds and hash-based security analysis

1 detail in Everything

New: Rename Repository Labels via API Jun 4, 2025 · release notes

Socket adds PUT /labels endpoint to rename repository labels via API

Python SDK: Added Support for Historical and Label Endpoints Jun 2, 2025 · release notes

Socket Python SDK adds endpoints for label management and historical alert data access

Adds labels endpoint group supporting create, list, get, and delete operations to manage labels programmatically
Adds labels/settings endpoints allowing get, update, and delete configuration for specific labels
Adds association capabilities to link or unlink labels with alerts via the SDK
Adds historical endpoint group for listing past alerts and viewing trend data over time
Adds snapshot management via list and create operations within the historical data endpoint

5 details in Everything

New Alerts Page is Generally Available May 30, 2025 · release notes

Socket GA release: new faster Alerts page with PDF export, filtering, and note-taking capabilities.

Makes the redesigned Alerts page the default view for all users
Adds PDF export option for alert lists via the new UI
Enables grouping alerts by repository in the Alerts view
Adds filtering by priority level within the Alerts interface
Supports search queries by package name, CVE ID, and license name

+3 more show less

Allows adding notes to individual alerts in the detail view
Permits changing the alert action directly from the UI
Displays the reason for a given alert action (e.g., security policy or repository label)

8 details in Everything

Socket MCP: Real-Time Dependency Scoring for AI Tools May 28, 2025 · release notes

New Socket MCP server adds real-time dependency scoring via Model Context Protocol for AI tools like Copilot and Claude.

Launches socket-mcp, an experimental MCP server that brings real-time dependency scoring to AI-assisted development
Enables tools such as GitHub Copilot, Claude, and other LLM integrations to query Socket’s depscore API directly during code generation

2 details in Everything

Improved GitHub App Visibility May 21, 2025 · release notes

Socket now creates a GitHub check run on every commit regardless of manifest files for consistent visibility.

Adds GitHub check run creation for all commits processed by the Socket GitHub App, even without manifest files.

1 detail in Everything

Improved Threat Feed Syncing May 20, 2025 · release notes

Socket adds a new threat feed API endpoint for syncing new and updated threats.

Faster, Smarter Org Alerts (Beta) May 6, 2025 · release notes

Socket rebuilds Organization Alerts (Beta) page with server-side filtering and All tab for faster large-org views

Adds All tab to Organization Alerts (Beta) UI to view all alerts in one place
Improves performance via server-side filtering and search powered by analytics backend

2 details in Everything

New: Socket Fix for Safe, Automated Dependency Upgrades Apr 25, 2025 · release notes

Socket introduces socket fix CLI for automated, safe dependency upgrades with --test and --autopilot modes

└──▷ TRY IT

Validate dependency upgrades safely by running the test suite before applying changes.

$ socket fix --test

Adds the socket fix subcommand to automatically update vulnerable dependencies
Adds --test mode to run tests during upgrade validation
Adds --autopilot mode for automated testing and merging in CI

3 details in Everything

Historical Analytics (Beta) Now Available Apr 24, 2025 · release notes

Socket adds 30 days of historical scan data access and new API endpoints for exporting past alerts.

New: Repository Labels + Security Policies Apr 22, 2025 · release notes

Socket adds repository labels and label-specific security policies via API

Adds custom labels to repositories for organizing repos by stack or sensitivity
Enables filter, sort, and search functionality based on repository labels
Allows applying custom security policies to specific labels instead of only org-wide settings
Permits overriding the org-wide security policy for labeled sets of repositories
Supports automation of label management and policy application via the public API

5 details in Everything

CDX Export Now Supports All Ecosystems Apr 22, 2025 · release notes

Socket CDX export endpoint now supports all ecosystems instead of a hardcoded subset.

.NET Support Now in Public Beta Apr 21, 2025 · release notes

Socket now scans .NET projects (NuGet/MSBuild) for supply chain threats in public beta.

Adds support for scanning .NET ecosystems using NuGet and MSBuild for supply chain threats
Enables deep analysis of .NET dependency graphs including transitive and conditionally imported packages
Improves SBOM accuracy for .NET projects

3 details in Everything

Exclude Ecosystems from Socket CLI Scans Apr 21, 2025 · release notes

Socket CLI now supports excluding specific ecosystems from scans via Supported Files API.

Set Repo Visibility When Creating via Python CLI Apr 21, 2025 · release notes

Socket's Python CLI now supports specifying public or private visibility when creating repositories

The socket Python CLI now lets you choose whether a newly created repository should be public or private.

1 detail in Everything

Go Support Now Generally Available Apr 17, 2025 · release notes

Socket now generally supports Go language scanning for supply chain threats with configurable alerts.

Adds Go ecosystem support to socket scanning, detecting obfuscation, backdoors, and exec.Command misuse in projects with go.mod and go.sum files
Enables management of Go-specific alerts via project settings

2 details in Everything

Slack Integration Now Available in Python CLI Apr 16, 2025 · release notes

Socket CLI gains Slack plugin for notifications.

Jira Integration Now Available in Python CLI Apr 15, 2025 · release notes

Socket CLI adds Jira integration for auto-creating tickets on Blocked/Warning issues

Rubygems Ecosystem Support Now Generally Available Apr 15, 2025 · release notes

Socket generally adds Rubygems ecosystem support and enables Ruby scanning by default

Adds general availability for Ruby project supply chain threat detection via Gemfile.lock analysis
Enables Ruby scanning by default for all users

2 details in Everything

Reintroduced Dependency Reachability Toggle with Improved Behavior Apr 15, 2025 · release notes

Socket reintroduces the Dependency Reachability toggle in organization settings with improved state persistence.

Adds a dependency reachability toggle to organization settings for all paid plans, allowing users to enable or disable unused dependency identification via code analysis.

1 detail in Everything

Improved Alert Details with Remediation Suggestions and Better CVE Readability Apr 15, 2025 · release notes

Socket dashboard AlertModal now shows remediation suggestions and renders CVE descriptions in Markdown.

Adds Remediation Suggestions to the AlertModal UI component for actionable guidance.
Renders CVE descriptions with Markdown formatting in the dashboard for improved readability.

2 details in Everything

New Toggle to Enable Reachability Analysis in Organization Settings Apr 10, 2025 · release notes

Adds a toggle to enable dependency reachability analysis in organization settings

Re-added Support for URL Search Params on the Repositories Page Apr 4, 2025 · release notes

Re-added URL search params (page, query, sort_by) on the Repositories page for shareable filtered views

page, query, and sort_by URL parameters are supported again on the Repositories dashboard page.

1 detail in Everything

New Tabs for Alerts, Dependencies, and Scans on Repository Pages Apr 2, 2025 · release notes

Adds Alerts, Dependencies, and Scans tabs to Socket dashboard repository pages

Adds an Alerts tab (default) showing a detailed table of current repo alerts
Adds a Dependencies tab that pre-filters org dependencies to the selected repository
Adds a Scans tab for accessing scan results on repository pages

3 details in Everything

Improved Scan Performance for Socket Python CLI Apr 1, 2025 · release notes

Socket Python CLI now excludes __pycache__ and node_modules folders by default to improve scan performance.

Significantly speeds up Python scans by preventing duplicate results

1 detail in Everything

Redesigned Repositories Page with Alert Severity Breakdown Apr 1, 2025 · release notes

Socket adds severity breakdown and column sorting to the Repositories page dashboard.

Redesigned the Repositories page in the dashboard to include alert count summary broken down by severity for each repository
Added support for column sorting on the new Repositories table view

2 details in Everything

Filter for Fixable Alerts in Bulk Packages API Mar 11, 2025 · release notes

Adds fixable query param and alert.fix property to the Socket.dev bulk packages API

Adds fixable=true query option to the batch PURL endpoint to retrieve only fixable artifact alerts.
Adds alert.fix object with type (cve | upgrade) and description fields to alert responses.

2 details in Everything

Bulk Packages API Now Respects Org Security and License Policies Mar 6, 2025 · release notes

Bulk Packages API now applies org security and license policies

Adds organization policy enforcement to the Bulk Packages API (purl) endpoint

1 detail in Everything

Fixed diff_report_url in Full Scan Diff Endpoint Mar 3, 2025 · release notes

Full Scan Diff API now uses Full Scan IDs for diff_report_url

diff_report_url field in the Full Scan Diff Endpoint now returns URLs generated using Full Scan IDs instead of SBOM IDs.
Response body of the Full Scan Diff Endpoint now includes repo and org slugs.

2 details in Everything

Improved Full Scan API Filtering Feb 28, 2025 · release notes

Socket adds query parameters branch, pull_request, commit_hash to Full Scan List API

Improved Bearer Authentication Header Support on All API Routes Feb 28, 2025 · release notes

Socket API now accepts standard unencoded Bearer tokens on all routes

Removes mandatory base64 encoding for Authorization: Bearer <token> headers across all API routes

1 detail in Everything

New 'compact' Parameter for Batch PURL and Full-Scans API Endpoints Feb 19, 2025 · release notes

Socket adds compact parameter to Batch PURL and Full-Scans API endpoints

Enables high-efficiency integrations by stripping optional data from API responses to reduce payload size

1 detail in Everything

New Integration: Microsoft Sentinel Support Added to Socket SIEM Connector Feb 18, 2025 · release notes

Socket SIEM Connector adds direct Microsoft Sentinel support for unified alerting

Dashboard Now Displays Full Numbers for Better Readability Feb 14, 2025 · release notes

Dashboard now displays full numbers with thin spaces for clarity

Adds thin-space separation and clearer formatting (e.g., 1.2B) to dashboard metrics for better readability

1 detail in Everything

New Discovery Period Filter for Threat-Feed API Feb 14, 2025 · release notes

Socket Threat-Feed API adds discovery_period filter for date-based threat querying

Adds discovery_period parameter to Threat-Feed API endpoints to filter threats by discovery date

1 detail in Everything

Fine-Tuned Full Scan Control with New Query Parameter for License Details Feb 14, 2025 · release notes

Socket adds include_license_details query param to streaming full_scan API for scan performance control.

└──▷ USE IT

Skip license details in a full scan to improve performance when scanning large organizations.

code

import socketdev from '@api/socketdev';

socketdev.getOrgFullScan({
  include_license_details: 'false',
  org_slug: 'org_slug',
  full_scan_id: 'full_scan_id',
  accept: 'application/x-ndjson'
})
  .then(({ data }) => console.log(data))
  .catch(err => console.error(err));

Alert Table Search Now Supports CVE and License IDs Feb 13, 2025 · release notes

Dashboard Alert Table Search now supports filtering by CVE and License IDs

Adds CVE ID recognition to the dashboard alerts page search field

1 detail in Everything

socket.yml Now Supports disableCommentsAndCheckRuns Override Feb 11, 2025 · release notes

socket.yml now supports disableCommentsAndCheckRuns override for repository-specific GitHub App configuration.

Adds disableCommentsAndCheckRuns as an overridable setting in socket.yml to control GitHub App behavior at the repository level.

1 detail in Everything

Search and Group By Now Reflected in Alert Table URL Feb 10, 2025 · release notes

Alert table search and Group By selection are now reflected in the URL for persistence and sharing.

Alert Table Filters Are Now Shareable via URL Feb 6, 2025 · release notes

Alert Table filters are now persisted in the browser URL for shareable views

Browser URL now dynamically reflects Alert Table filter selections to enable sharing and persistence

1 detail in Everything

New: API Scopes for Historical Alerts Access Feb 5, 2025 · release notes

Adds alerts:list and alerts:trend API scopes to Socket for accessing historical alert endpoints

Adds the alerts:list scope required to fetch a list of historical alerts via GET /v0/orgs/:org_slug/alerts/historical
Adds the alerts:trend scope required to fetch historical alert trend data via GET /v0/orgs/:org_slug/alerts/historical/trend

2 details in Everything

New: Public API Endpoints for Historical Alerts and Trends Feb 4, 2025 · release notes

New API endpoints provide programmatic access to historical alert data and trends.

Adds /v0/orgs/:org_slug/alerts/historical endpoint
Adds /v0/orgs/:org_slug/alerts/historical/trend endpoint

2 details in Everything

Expanded Alert Metadata in Full-Scan Diffs Jan 30, 2025 · release notes

Full-scan diff endpoint now includes expanded metadata for alerts and artifacts

New Modal Design for Alert, Dependency, and Threat Tables Jan 16, 2025 · release notes

Alert, Dependency, and Threat tables now use modals instead of sidebars for detailed inspection

Inspection of items in the Alert Table, Dependency Table, and Threat Feed Table opens a modal interface instead of a sidebar.
Alert modals now organize details into explicit sections: Alert details, Artifact details, and Installation details, with reorganized content hierarchy.
Triage notes within these tables gain an autosave feature and a sticky note visual style.

3 details in Everything

Added: Links to Specific File Locations for Alerts and License Info Jan 14, 2025 · release notes

Socket adds #T URL fragments to alerts and license info links for direct file navigation

Alerts and license information now include links to specific locations within the relevant file using the #T URL fragment.

1 detail in Everything

New: Dependency Tree in the Dependencies Tab Sidebar Jan 14, 2025 · release notes

Socket adds a Dependency Tree view accessible directly from the sidebar in the Dependencies tab.

Introducing created_at Sort Order in the Threat-Feed API Jan 3, 2025 · release notes

Socket adds created_at sort order to the Threat-Feed API

New Query Parameter: is_human_reviewed for Threat-Feed API Dec 17, 2024 · release notes

Socket adds is_human_reviewed query parameter to Threat-Feed API

Support for Parsing uv.lock Files Dec 7, 2024 · release notes

Socket adds parsing support for uv.lock dependency files.

Adds uv.lock file parsing to expand dependency tracking for Python projects.

1 detail in Everything

Introducing a New "AI-Detected Possible Typosquat" Alert Dec 6, 2024 · release notes

Socket introduces AI-detected possible typosquat alerts

Adds AI-detected possible typosquat alert to distinguish AI-flagged typosquat threats from human-reviewed ones

1 detail in Everything

New Support for pipfile.lock Files in Python Projects Dec 6, 2024 · release notes

Socket adds ParsePipfileLock task to parse pipfile.lock files for Pipenv projects

Enhanced PDF Export for Organization Alerts Dec 5, 2024 · release notes

Enhanced PDF export for organization alerts now includes repository and branch details

Organization alert PDF exports now include repositories and branches fields for each alert

1 detail in Everything

Package Search Improvements Nov 27, 2024 · release notes

Package search now accepts PURLs and ecosystem prefixes for direct navigation.

Adds support for full and abbreviated Package URLs (e.g., pkg:npm/react@18.0.0 or npm/react@18.0.0) in the package search bar to jump directly to a package
Enables ecosystem switching by typing prefixes like pypi/ or rubygems/ followed by space and query text, with case-insensitive matching

2 details in Everything

npm Security Holding Packages Now Flagged as Known Malware Nov 21, 2024 · release notes

Socket adds Known Malware alerts for npm security holding packages to clarify threat status of removed placeholders.

New Filters Added to the Threat Feed Endpoint Nov 21, 2024 · release notes

Threat feed endpoint now supports name, version, and ecosystem query parameters for precise filtering.

Focus on What Matters: New Security Policy Filter for Alerts Nov 21, 2024 · release notes

Socket adds Per Security Policy alert filter and updates SBOM dependency visualization

Adds the new Per Security Policy filter to alert management, flagging alerts as accepted or ignored based on your security policy configuration.
Updates SBOM dependency visualization so that dependencies with zero alerts or all ignored alerts are rendered as neutral white rectangles.

2 details in Everything

Weekly Download Counts Now Available on Package Search Results Nov 20, 2024 · release notes

Socket.dev now displays weekly download counts alongside package search results for npm.

Dashboard Reports Page Revamped Nov 19, 2024 · release notes

Socket Dashboard Reports page now supports searching by repo/branch/commit and filtering by creation date.

Adds search capability to filter Dashboard Reports by repository name, branch name, or commit message
Adds filtering of Dashboard Reports by creation date (e.g., the past X days)
Improves table UI with cleaner visuals and more on-brand design

3 details in Everything

New: License Policy API Endpoints Nov 8, 2024 · release notes

New GET /rest/findings/export and UI export allow programmatic and manual access to organization license policies via Socket's License Policy API

Adds the GET https://api.socket.dev/v0/orgs/{org_slug}/settings/license-policy endpoint to view an organization's license policy settings programmatically.
Adds the PATCH https://api.socket.dev/v0/orgs/{org_slug}/settings/license-policy endpoint to edit an organization's license policy settings programmatically.

2 details in Everything

Improved Capability Alerts: File Locations Now Included Nov 8, 2024 · release notes

Socket Capability alerts now include specific file locations for risks.

Capability alerts now display the specific files associated with potential risks.

1 detail in Everything

Web Extension Now Supports Go Nov 7, 2024 · release notes

Socket Web Extension gains Go language support with pkg.go.dev integration and real-time threat detection

Adds full Go package threat detection and security metrics in the Socket Web Extension for Chrome and Firefox
Enables direct linking to https://pkg.go.dev and external module URLs from detected Go packages
Supports parsing of Go PURLs (e.g., pkg:golang/google.golang.org/genproto) within browser context

3 details in Everything

Socket Optimize Update: Introducing --pin & --prod Options, Enhanced Workspaces, and Node 18+ Support Oct 31, 2024 · release notes

Enhanced workspace support and Node.js 18+ compatibility in Socket Optimize.

Improved workspace support for multi-package handling
Upgraded packages to support Node.js 18+
Added more intuitive error messages

3 details in Everything

Native Code Alert Enhanced to Support Multiple Ecosystems Oct 16, 2024 · release notes

Native Code Alert now scans multiple ecosystems beyond npm, including prebuilt binaries.

Expands the Native Code alert to detect prebuilt binaries and ecosystem-specific files across various programming languages, rather than just binding.gyp files in npm packages.

1 detail in Everything

New: Support for the Yarn 'resolutions' Field Oct 5, 2024 · release notes

Socket now supports the Yarn resolutions field for dependency override analysis.

Adds support for parsing and analyzing the resolutions field in Yarn lockfiles to detect enforced dependency versions.

1 detail in Everything

Full Scans API Expanded: More Dashboard Metrics and Better Repository Controls Oct 5, 2024 · release notes

Full Scans API expands metadata fields and dashboard metrics; drops branch name requirement.

API: Full scans now support api, github, gitlab, bitbucket and azure metadata fields in the dashboard
API: Creating a full scan via the API no longer requires a branch parameter
UI: Repositories created by the GitHub app can now be deleted from the Organization Dashboard

3 details in Everything

Web Extension Revamped: Improved Performance, UI Enhancements, and Essential Bug Fixes Oct 3, 2024 · release notes

Socket Web Extension adds stats reset button and improves SPA link handling

Adds a reset button in the extension popup to reset accumulated statistics.

1 detail in Everything

Introducing Support for Jenkins Jobs Sep 25, 2024 · release notes

Socket adds Jenkins Job integration for CI/CD security automation

Adds support for Jenkins Jobs to Socket's CI/CD integrations

1 detail in Everything

Initial Version 1.0.9 of the Socket Python SDK has been released! Sep 13, 2024 · release notes

Socket Python SDK 1.0.9 adds report filtering, API timeouts, and SBOM dict generation

Adds from_time parameter to report.list() function for unix timestamp filtering
Adds timeout argument to socketdev class constructor for API call duration control
Adds sbom.create_packages_dict() function for generating package dictionaries

3 details in Everything

Socket CLI Adds Threat Feed Command Sep 7, 2024 · release notes

Socket CLI adds socket threat-feed command to fetch threat feed data via flags.

Adds the socket threat-feed subcommand to retrieve Socket's threat feed directly from the CLI.
Adds --perPage, --page, --direction, and --filter flags to socket threat-feed for pagination and filtering.
Adds --json flag to socket threat-feed to return output as a JSON object.

3 details in Everything

GitHub App Now Creates Full-Scans on Push Events Sep 6, 2024 · release notes

GitHub app now creates full-scan resources on push events, accessible via the full_scans API endpoint

Adds the full_scans API endpoint to retrieve a paginated list of full scans for an organization, excluding SBOM artifacts

1 detail in Everything

Ruby Now Available (Experimental) Sep 5, 2024 · release notes

Socket adds experimental Ruby gem security scanning and core alerts

New Dashboard Analytics Sep 4, 2024 · release notes

Socket introduces new dashboard analytics with graphs for alerts and CSV/JSON export

Adds dashboard analytics view showing total critical/high alerts in main branches, daily merged alerts, prevented merges, and top 5 alert types
Adds data filters to display ingested data from the last 7, 30 or 90 days
Enables exporting dashboard data as CSV or JSON

3 details in Everything

API: Added Support for a "from" Query Filter to the Audit-Log Endpoint Aug 28, 2024 · release notes

API: Added Support for a from Query Filter to the Audit-Log Endpoint

New Alert: Suspicious Stars on GitHub Aug 27, 2024 · release notes

Socket adds Suspicious Stars on GitHub high-severity supply chain alert

Version 1.0.17 of the Socket Python CLI has been released! Aug 22, 2024 · release notes

Socket Python CLI v1.0.17 adds GitLab web event support and handles unknown events gracefully.

New Default Security Policies Aug 14, 2024 · release notes

Socket introduces Low Noise, Default, and Higher Noise default security policies with new alert types (Block, Warn, Monitor, Ignore).

Adds three customizable default security policy profiles: Low Noise (traditional SCA), Default, and Higher Noise to reduce alert noise and manage false positives.
Enables four new alert types: Block, Warn, Monitor, and Ignore for granular control over CI/CD flow and dashboard visibility.
Allows users to lock in specific settings during the transition period (August 14-28, 2024) before new defaults automatically take effect on August 28.

3 details in Everything

Revamped Web Extension Aug 14, 2024 · release notes

Socket web extension adds PyPI/Go/Maven support and threat detection metrics

Expands threat detection to PyPI, Go, and Maven ecosystems beyond previous scope
Displays real-time threat detection metrics directly within the browser extension UI
Reduces extension footprint by 1500x (~0.02MB) with lower memory usage

3 details in Everything

PDF Export for Dependencies in the Dashboard Aug 13, 2024 · release notes

PDF export capability added to Socket Dashboard for dependency views, alert tables, and overview statistics.

Adds PDF export capability for the Dependency Overview view in the dashboard
Adds PDF export capability for the Alert Table view (up to 2,500 alerts) in the dashboard
Adds PDF export capability for organization overview statistics, repositories, and threat feed samples in the dashboard

3 details in Everything

Version 1.0.1 of the Socket Python CLI has been released! Jul 30, 2024 · release notes

Adds pull_request event support with opened state handling to Socket Python CLI

Version 1.0.0 of the Socket Python CLI has been released! Jul 29, 2024 · release notes

Socket Python CLI v1.0.0 adds Security Policy Modes (Block/Warn) and --ignore-commit-files flag.

--ignore-commit-files option added to scan all manifest files regardless of commit history
Security Policy Modes Block and Warn now supported for CI integration
Console output includes CI Status indicating Block/Warn policy result

3 details in Everything

New 'from' and 'repo' fields added to reports endpoint Jul 20, 2024 · release notes

Socket adds from and repo query parameters to its reporting API endpoints for filtered scanning.

Adds from (unix timestamp) and repo (repo slug) querystring filters to the GET /report/list endpoint
Adds from (unix timestamp) and repo (repo slug) querystring filters to the GET /orgs/{org_slug}/full-scans endpoint

2 details in Everything

Use yarn alternative resolution by default Jul 18, 2024 · release notes

Socket now uses a new yarn module resolution algorithm by default to generate npm v1 lockfiles from yarn.lock.

Replaces the previous yarn resolution method with an alternative algorithm that maps package.json dependencies to the yarn lock file and traverses it to generate an npm v1 lockfile for module resolution.

1 detail in Everything

Socket API adds new 'licenseattrib' option to the /v0/purl endpoint Jul 18, 2024 · release notes

Socket API adds licenseattrib query parameter to /v0/purl for license attribution data

Add unmaintained alert for Maven packages Jul 16, 2024 · release notes

Socket expands its Maven package analysis capabilities.

Maven packages are now evaluated for maintenance status.

1 detail in Everything

Display alert count on alert package pages Jul 16, 2024 · release notes

Adds estimated alert count badges to alerts/[alertType]/packages pages to gauge alert frequency.

Add Deprecated alert for PyPI packages Jul 16, 2024 · release notes

Socket adds Deprecated alert for PyPI packages to detect yanked releases

Adds support for detecting Deprecated alerts on PyPI packages marked as yanked in their release metadata

1 detail in Everything

Add CycloneDX export API endpoint Jul 11, 2024 · release notes

Adds a new API endpoint to export CycloneDX SBOMs from SocketSBOM reports or full scan IDs.

GET /v0/orgs/{org_slug}/export/cdx/{id} — Export CycloneDX SBOM from a report ID or full scan ID

1 detail in Everything

Socket CLI: Add dependencies search command Jun 27, 2024 · release notes

A new CLI capability allows practitioners to programmatically search for dependencies across their organization using the Socket cyber tooling.

Add socket dependencies search command to query organization-wide dependency usage.

1 detail in Everything

Socket CLI: Add audit log feature Jun 21, 2024 · release notes

Socket CLI adds socket audit-log command to retrieve organizational audit trails.

Socket CLI: Add repos command Jun 21, 2024 · release notes

Socket CLI gains the repos subcommand with CRUD operations for managing organizational repositories.

Adds the socket repos subcommand to view, list, create, update, and delete organization repositories

1 detail in Everything

Socket CLI: Add full scans feature Jun 18, 2024 · release notes

Socket CLI adds socket scan command with create, list, stream, delete and metadata subcommands for full scans.

socket scan command is added to control full scans directly from the CLI
socket scan list <org slug> lists available full scans for an organization
socket scan create <org slug> <flags> creates a new full scan
socket scan stream <org slug> <full scan ID> [output path] streams or exports scan results
socket scan delete <org slug> <full scan ID> removes a specified full scan

+1 more show less

socket scan metadata <org slug> <full scan ID> retrieves metadata for a specific full scan

6 details in Everything

Filter alerts by alert triage in GitHub bot Jun 13, 2024 · release notes

Adds filtering of Socket GitHub bot alerts by their triage status.

Socket for GitHub now allows users to filter alerts by alert triage

1 detail in Everything

Implement audit log API endpoint Jun 10, 2024 · release notes

Socket implements an audit log API endpoint to match dashboard features.

Adds the GET /api/v1/audit-logs endpoint for retrieving audit logs.

1 detail in Everything

Add API endpoints for license data and attribution Jun 3, 2024 · release notes

Adds /license-details and /license-attrib API endpoints to retrieve license and attribution data for artifacts via purl.

Adds /license-details endpoint to get artifact license information
Adds /license-attrib endpoint to get artifact license attribution information

2 details in Everything

Socket

Summary

How Socket helps

Languages

Features

What Socket offers you

release 23 total

release

release 45 total

docs

example

release

docs

release 56 total

example

release 55 total

release 35 total

docs 10 total

example

release 25 total

docs 10 total

example

release 18 total

example

release 14 total

release 12 total

release 11 total

release 8 total

release

example

release 7 total

release 7 total

release

example

release

example

release

example

release

example

release

example

release

release

release

release

release

release

example

release

release

example

release

release

release

release

release

release

release

release

release

release

release

release

release

release

release

release

release

release

Command line

Screenshots

Score card

Trajectory

Release-note detail over time

Commercials

Plans by offering

Plan relaunches

Website history

Rebranding timeline