fix(manifest): merge JVM facts components by coordinate (#1557)

* fix(manifest): merge JVM facts components by coordinate

Drop the path-sensitive subtree hashing and `resolvedAs` from
.socket.facts.json and write it compact. The Socket backend never used the
per-path precision, and it inflated facts files for large builds.

Reachability still needs each subproject's exact classpath, so the
compute-artifacts sidecar now carries `projects[].classpath`: the component
ids resolved for that subproject across all its configurations.

* feat(manifest): record the socket-cli version in JVM facts metadata

A facts file carried no trace of which CLI release generated it, so a stale
file uploaded by a newer CLI was indistinguishable from fresh output.

* upgrading coana to version 15.10.55

Author: jfblaa

CHANGELOG.md

@@ -7,7 +7,8 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 ## [Unreleased]
 
 ### Changed
-- Updated the Coana CLI to v `15.10.54`.
+- Updated the Coana CLI to v `15.10.55`.
+- Generated Maven, Gradle and sbt `.socket.facts.json` files are now substantially smaller, making uploads for large JVM projects faster and more reliable.
 
 ## [1.1.178](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.178) - 2026-09-23
 

package.json

@@ -105,7 +105,7 @@
     "@babel/preset-typescript": "7.27.1",
     "@babel/runtime": "7.28.4",
     "@biomejs/biome": "2.2.4",
-    "@coana-tech/cli": "15.10.54",
+    "@coana-tech/cli": "15.10.55",
     "@cyclonedx/cdxgen": "12.1.2",
     "@dotenvx/dotenvx": "1.49.0",
     "@eslint/compat": "1.3.2",

pnpm-lock.yaml

@@ -20,7 +20,6 @@ function okResult(): WorkspaceEnumerationResult {
         name: 'root',
         subprojectDir: '.',
         dependencies: [],
-        resolvedAs: [],
       },
     ],
     stderr: '',

src/commands/manifest/enumerate-workspaces.test.mts

@@ -61,14 +61,12 @@ describe('generateRecursiveManifests', () => {
                 name: 'moduleA',
                 subprojectDir: 'moduleA',
                 dependencies: [],
-                resolvedAs: [],
               },
               {
                 type: 'maven',
                 name: 'moduleB',
                 subprojectDir: 'moduleB',
                 dependencies: [],
-                resolvedAs: [],
               },
             ],
           }
@@ -137,7 +135,6 @@ describe('generateRecursiveManifests', () => {
                   name: 'shared-lib',
                   subprojectDir: `../${sharedLibName}`,
                   dependencies: [],
-                  resolvedAs: [],
                 },
               ],
             }

src/commands/manifest/generate-recursive-manifests.test.mts

@@ -221,7 +221,11 @@ export async function runManifestFacts({
     return
   }
 
-  await fs.writeFile(factsPath, JSON.stringify(facts, null, 2), 'utf8')
+  const socketCliVersion = constants.ENV.INLINED_SOCKET_CLI_VERSION
+  if (facts.metadata && socketCliVersion) {
+    facts.metadata.socketCliVersion = socketCliVersion
+  }
+  await fs.writeFile(factsPath, JSON.stringify(facts), 'utf8')
 
   if (withFiles && sidecarAcc) {
     // Key by the symlink-resolved path so the sidecar's keys are comparable

src/commands/manifest/run-manifest-facts.mts

@@ -10,6 +10,7 @@ vi.mock('./scripts/run.mts', () => ({
 
 import { runManifestFacts } from './run-manifest-facts.mts'
 import { runManifestScript } from './scripts/run.mts'
+import constants from '../../constants.mts'
 
 import type { ManifestRunResult } from './scripts/run.mts'
 import type { SidecarAccumulator } from './scripts/sidecar.mts'
@@ -29,6 +30,7 @@ function okResult(): ManifestRunResult {
       targetsByGav: new Map(),
       sourcesByCoord: new Map(),
       coords: new Set(),
+      classpathByProject: new Map(),
     },
     stderr: '',
     stdout: '',
@@ -122,7 +124,6 @@ describe('runManifestFacts - sidecar', () => {
         version: '1.0',
         subprojectDir: '.',
         dependencies: [],
-        resolvedAs: [],
       },
     ]
     vi.mocked(runManifestScript).mockResolvedValue(result)
@@ -137,4 +138,24 @@ describe('runManifestFacts - sidecar', () => {
     const bucket = sidecarAcc.get(expectedFactsFile)
     expect(bucket?.projects.find(m => m.name === 'app')).toBeDefined()
   })
+  it('stamps the inlined socket-cli version into the written facts metadata', async () => {
+    const result = okResult()
+    result.facts.metadata = {
+      format: 'socket-facts-sbom',
+      tool: 'maven',
+      toolVersion: '3.9.9',
+    }
+    vi.mocked(runManifestScript).mockResolvedValue(result)
+
+    await runManifestFacts({ ...baseArgs, cwd })
+
+    const written = JSON.parse(
+      await fs.readFile(path.join(cwd, '.socket.facts.json'), 'utf8'),
+    )
+    // Unit tests run unbuilt, where the version isn't inlined; the field is
+    // then omitted rather than written empty.
+    expect(written.metadata.socketCliVersion).toBe(
+      constants.ENV.INLINED_SOCKET_CLI_VERSION || undefined,
+    )
+  })
 })