feat(manifest): add socket manifest maven (1.1.124, Coana 15.5.5)

[Jeppe Fredsgaard Blaabjerg (jfblaa)]

Summary

Adds a new socket manifest maven command that generates a Socket facts file (.socket.facts.json) from a Maven pom.xml project, mirroring the existing gradle / scala (sbt) facts flows. socket-cli delegates to the Coana CLI's manifest maven command (which owns the Maven extension that resolves the dependency graph); socket-cli only constructs the args and verifies the emitted facts file.

This is the 1.1.124 release: the feature plus the Coana bump it depends on.

What's included

• New command cmd-manifest-maven.mts — facts-only (Maven is already pom-native, so there is no --pom path). Flags: --bin (defaults to mvn on PATH; point at ./mvnw to use a wrapper), --maven-opts (e.g. -P <profile> -s <settings.xml>), --include-configs / --exclude-configs (Maven scopes), --ignore-unresolved, --verbose. Reads defaults from socket.json like the other JVM tools.
• convert-maven-to-facts.mts — thin delegate to the shared runCoanaManifestFacts (widened to accept ecosystem: 'maven' / --maven-opts).
• Auto-detection — pom.xml → maven in detect-manifest-actions.mts, wired into socket manifest auto (generate_auto_manifest.mts).
• Setup wizard — a Maven choice + setupMaven in the socket manifest setup configurator.
• Types — maven entry in socket.json manifest defaults.
• Docs/changelog — README section and a 1.1.124 changelog entry.
• Coana bump — @coana-tech/cli 15.5.0 → 15.5.5, which adds the manifest maven command this delegates to.

Verification

• pnpm build:dist:src, pnpm check:tsc, pnpm check:lint, biome format all clean.
• New cmd-manifest-maven.test.mts (help + dry-run); updated cmd-manifest.test.mts snapshot; setup/auto/detect/generate-auto suites pass.
• End-to-end smoke test against a real Maven project with the published 15.5.5 produces a complete graph (direct + transitive deps, correct tool: "maven" metadata).

---

Note

Low Risk
Additive beta manifest feature following existing Coana delegation; main dependency is the Coana 15.5.5 bump for Maven support.

Overview
Release 1.1.124 adds Maven to the manifest toolchain and bumps @coana-tech/cli to 15.5.5 so Coana can run manifest maven.

socket manifest maven [beta] writes .socket.facts.json from a pom.xml project by delegating to Coana (same pattern as Gradle/sbt facts). Flags cover --bin (default mvn, or ./mvnw), --maven-opts, scope filters via --include-configs / --exclude-configs, and --ignore-unresolved; defaults can live in socket.json.

Wiring: pom.xml is auto-detected for socket manifest auto, the setup wizard gets a Maven path (setupMaven), and runCoanaManifestFacts now accepts ecosystem: 'maven' with --maven-opts. Docs, changelog, help snapshots, and CLI tests were updated accordingly.

^{Reviewed by Cursor Bugbot for commit dec47bf. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​coana-tech/​cli@​15.5.5

View full report

[Martin Torp (mtorp)]

Approving — clean, low-risk addition that faithfully mirrors the existing Gradle/sbt facts delegation: type-safe flag/socket.json plumbing, an argv-based (no-shell) spawn path, and good rationale comments. CI is green across the board.

Two non-blocking notes inline:

• CHANGELOG version label — the new section is the 1.1.125 release (per package.json) but is labeled 1.1.124; suggestion attached. Worth reconciling with the PR title/body too (they say 1.1.124).
• --maven-opts space-splitting — a pre-existing, consistent limitation shared with --gradle-opts/--sbt-opts; flagged only because the Maven help text advertises the spaced-path case.

[Martin Torp (mtorp)]

Version label mismatch. package.json bumps to 1.1.125, so this section is the 1.1.125 release — but the heading reads [1.1.124] and the link text (1.1.124) disagrees with its target tag (v1.1.125). It also leaves two ## [1.1.124] … - 2026-06-19 headings in the file (this one + the pre-existing one below). The PR title/body also say 1.1.124, so worth aligning all of package.json / changelog / title on one version.

Suggested change

	## [1.1.124](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.125) - 2026-06-19
	## [1.1.125](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.125) - 2026-06-19

[Martin Torp (mtorp)]

--maven-opts is split on every space, so a value with a spaced path — e.g. --maven-opts="-s my settings.xml" — becomes three separate tokens (-s, my, settings.xml). This matches the existing --gradle-opts/--sbt-opts parsing, so it's consistent and not a regression — flagging only because the Maven help text and changelog advertise exactly this -s settings.xml case. Non-blocking; if you want it to work, best fixed across gradle/sbt/maven together with a shell-style tokenizer.