feat(manifest): name JVM Socket facts files after their build

CHANGELOG.md

@@ -7,6 +7,8 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 ## [Unreleased]
 
 ### Changed
+- Socket facts for Maven, Gradle and sbt builds are now written per build — `pom.xml.socket.facts.json` (named after the POM Maven runs on, so `-f other-pom.xml` gets its own), `gradle.socket.facts.json` and `sbt.socket.facts.json` — so builds sharing a directory no longer overwrite each other. Delete any `.socket.facts.json` an earlier run left behind.
+- Reachability scans no longer feed a leftover `.socket.facts.json` report from an earlier run back into the analysis.
 - Updated the Coana CLI to v `15.12.4`.
 
 ## [1.6.2](https://github.com/SocketDev/socket-cli/releases/tag/v1.6.2) - 2026-10-09

src/commands/manifest/README.md

@@ -153,7 +153,7 @@ underlying flow is identical to the gradle subcommand.
 
 ## socket manifest maven [beta]
 
-Generates a Socket facts file (`.socket.facts.json`) from a Maven `pom.xml`
+Generates a Socket facts file (`pom.xml.socket.facts.json`) from a Maven `pom.xml`
 project, using `mvn` (override with `--bin`, e.g. a project `./mvnw` wrapper).
 Pass extra options through to maven with `--maven-opts` (e.g.
 `--maven-opts="-P release -s settings.xml"`).

src/commands/manifest/cmd-manifest-dynamic-sbom-inference.mts

@@ -38,7 +38,10 @@ const config: CliCommandConfig = {
       $ ${command} [options] [CWD=.]
 
     Recursively walks CWD, discovers independent gradle, sbt, and maven build
-    roots, and generates a Socket facts SBOM (.socket.facts.json) for each,
+    roots, and generates a Socket facts SBOM for each
+    (pom.xml.socket.facts.json, gradle.socket.facts.json, or
+    sbt.socket.facts.json, so builds sharing a directory never overwrite each
+    other),
     skipping subproject/reactor-module directories a parent build root already
     covers. Unlike \`socket manifest auto\`, this looks beyond CWD itself.
 

src/commands/manifest/cmd-manifest-dynamic-sbom-inference.test.mts

@@ -24,7 +24,10 @@ describe('socket manifest dynamic-sbom-inference', async () => {
             $ socket manifest dynamic-sbom-inference [options] [CWD=.]
 
           Recursively walks CWD, discovers independent gradle, sbt, and maven build
-          roots, and generates a Socket facts SBOM (.socket.facts.json) for each,
+          roots, and generates a Socket facts SBOM for each
+          (pom.xml.socket.facts.json, gradle.socket.facts.json, or
+          sbt.socket.facts.json, so builds sharing a directory never overwrite each
+          other),
           skipping subproject/reactor-module directories a parent build root already
           covers. Unlike \`socket manifest auto\`, this looks beyond CWD itself.
 

src/commands/manifest/cmd-manifest-gradle.mts

@@ -38,12 +38,12 @@ const config: CliCommandConfig = {
     facts: {
       type: 'boolean',
       description:
-        'Emit a Socket facts JSON file (`.socket.facts.json`) describing the resolved dependency graph. This is the default; pass `--pom` to generate `pom.xml` files instead',
+        'Emit a Socket facts JSON file (`gradle.socket.facts.json`) describing the resolved dependency graph. This is the default; pass `--pom` to generate `pom.xml` files instead',
     },
     pom: {
       type: 'boolean',
       description:
-        'Generate `pom.xml` manifest file(s) instead of the default Socket facts file (`.socket.facts.json`)',
+        'Generate `pom.xml` manifest file(s) instead of the default Socket facts file (`gradle.socket.facts.json`)',
     },
     includeConfigs: {
       type: 'string',
@@ -78,9 +78,9 @@ const config: CliCommandConfig = {
     Options
       ${getFlagListOutput(config.flags)}
 
-    By default, emits a single \`.socket.facts.json\` describing the resolved
-    dependency graph of the whole build, using gradle (preferably your local
-    \`gradlew\`). An unresolved dependency is a fatal error. You can pass
+    By default, emits a single \`gradle.socket.facts.json\` describing the
+    resolved dependency graph of the whole build, using gradle (preferably your
+    local \`gradlew\`). An unresolved dependency is a fatal error. You can pass
     --include-configs / --exclude-configs (comma-separated glob patterns) to
     control which configurations are resolved (e.g.
     --include-configs=\`*CompileClasspath,*RuntimeClasspath\`), and

src/commands/manifest/cmd-manifest-gradle.test.mts

@@ -26,16 +26,16 @@ describe('socket manifest gradle', async () => {
             --bin               Location of the gradle binary to use, default: ./gradlew if present, else gradle on PATH
             --exclude-configs   When generating facts: comma-separated glob patterns; Gradle configurations matching any pattern are skipped (applied after --include-configs)
             --exclude-paths     List of glob patterns to exclude from manifest/facts generation. Patterns are anchored micromatch globs matched relative to CWD (\`--cwd\` if set): \`tests\` matches only \`<cwd>/tests\`; use \`**/tests\` to match at any depth. Negation patterns (\`!path\`) are not supported. Accepts a comma-separated value or multiple flags.
-            --facts             Emit a Socket facts JSON file (\`.socket.facts.json\`) describing the resolved dependency graph. This is the default; pass \`--pom\` to generate \`pom.xml\` files instead
+            --facts             Emit a Socket facts JSON file (\`gradle.socket.facts.json\`) describing the resolved dependency graph. This is the default; pass \`--pom\` to generate \`pom.xml\` files instead
             --gradle-opts       Additional options to pass on to ./gradlew, see \`./gradlew --help\`
             --ignore-unresolved  When generating facts: warn on unresolved dependencies instead of failing the run (unresolved deps are not emitted to the facts file)
             --include-configs   When generating facts: comma-separated glob patterns matched against Gradle configuration names (case-sensitive; \`*\`, \`?\`, and \`[...]\` wildcards). Only configurations matching at least one pattern are resolved. e.g. \`*CompileClasspath,*RuntimeClasspath\`. Default: every resolvable configuration
-            --pom               Generate \`pom.xml\` manifest file(s) instead of the default Socket facts file (\`.socket.facts.json\`)
+            --pom               Generate \`pom.xml\` manifest file(s) instead of the default Socket facts file (\`gradle.socket.facts.json\`)
             --verbose           Print debug messages
 
-          By default, emits a single \`.socket.facts.json\` describing the resolved
-          dependency graph of the whole build, using gradle (preferably your local
-          \`gradlew\`). An unresolved dependency is a fatal error. You can pass
+          By default, emits a single \`gradle.socket.facts.json\` describing the
+          resolved dependency graph of the whole build, using gradle (preferably your
+          local \`gradlew\`). An unresolved dependency is a fatal error. You can pass
           --include-configs / --exclude-configs (comma-separated glob patterns) to
           control which configurations are resolved (e.g.
           --include-configs=\`*CompileClasspath,*RuntimeClasspath\`), and

src/commands/manifest/cmd-manifest-kotlin.mts

@@ -43,12 +43,12 @@ const config: CliCommandConfig = {
     facts: {
       type: 'boolean',
       description:
-        'Emit a Socket facts JSON file (`.socket.facts.json`) describing the resolved dependency graph. This is the default; pass `--pom` to generate `pom.xml` files instead',
+        'Emit a Socket facts JSON file (`gradle.socket.facts.json`) describing the resolved dependency graph. This is the default; pass `--pom` to generate `pom.xml` files instead',
     },
     pom: {
       type: 'boolean',
       description:
-        'Generate `pom.xml` manifest file(s) instead of the default Socket facts file (`.socket.facts.json`)',
+        'Generate `pom.xml` manifest file(s) instead of the default Socket facts file (`gradle.socket.facts.json`)',
     },
     includeConfigs: {
       type: 'string',
@@ -83,9 +83,9 @@ const config: CliCommandConfig = {
     Options
       ${getFlagListOutput(config.flags)}
 
-    By default, emits a single \`.socket.facts.json\` describing the resolved
-    dependency graph of the whole build, using gradle (preferably your local
-    \`gradlew\`). An unresolved dependency is a fatal error. You can pass
+    By default, emits a single \`gradle.socket.facts.json\` describing the
+    resolved dependency graph of the whole build, using gradle (preferably your
+    local \`gradlew\`). An unresolved dependency is a fatal error. You can pass
     --include-configs / --exclude-configs (comma-separated glob patterns) to
     control which configurations are resolved (e.g.
     --include-configs=\`*CompileClasspath,*RuntimeClasspath\`), and

src/commands/manifest/cmd-manifest-kotlin.test.mts

@@ -26,16 +26,16 @@ describe('socket manifest kotlin', async () => {
             --bin               Location of the gradle binary to use, default: ./gradlew if present, else gradle on PATH
             --exclude-configs   When generating facts: comma-separated glob patterns; Gradle configurations matching any pattern are skipped (applied after --include-configs)
             --exclude-paths     List of glob patterns to exclude from manifest/facts generation. Patterns are anchored micromatch globs matched relative to CWD (\`--cwd\` if set): \`tests\` matches only \`<cwd>/tests\`; use \`**/tests\` to match at any depth. Negation patterns (\`!path\`) are not supported. Accepts a comma-separated value or multiple flags.
-            --facts             Emit a Socket facts JSON file (\`.socket.facts.json\`) describing the resolved dependency graph. This is the default; pass \`--pom\` to generate \`pom.xml\` files instead
+            --facts             Emit a Socket facts JSON file (\`gradle.socket.facts.json\`) describing the resolved dependency graph. This is the default; pass \`--pom\` to generate \`pom.xml\` files instead
             --gradle-opts       Additional options to pass on to ./gradlew, see \`./gradlew --help\`
             --ignore-unresolved  When generating facts: warn on unresolved dependencies instead of failing the run (unresolved deps are not emitted to the facts file)
             --include-configs   When generating facts: comma-separated glob patterns matched against Gradle configuration names (case-sensitive; \`*\`, \`?\`, and \`[...]\` wildcards). Only configurations matching at least one pattern are resolved. e.g. \`*CompileClasspath,*RuntimeClasspath\`. Default: every resolvable configuration
-            --pom               Generate \`pom.xml\` manifest file(s) instead of the default Socket facts file (\`.socket.facts.json\`)
+            --pom               Generate \`pom.xml\` manifest file(s) instead of the default Socket facts file (\`gradle.socket.facts.json\`)
             --verbose           Print debug messages
 
-          By default, emits a single \`.socket.facts.json\` describing the resolved
-          dependency graph of the whole build, using gradle (preferably your local
-          \`gradlew\`). An unresolved dependency is a fatal error. You can pass
+          By default, emits a single \`gradle.socket.facts.json\` describing the
+          resolved dependency graph of the whole build, using gradle (preferably your
+          local \`gradlew\`). An unresolved dependency is a fatal error. You can pass
           --include-configs / --exclude-configs (comma-separated glob patterns) to
           control which configurations are resolved (e.g.
           --include-configs=\`*CompileClasspath,*RuntimeClasspath\`), and

src/commands/manifest/cmd-manifest-maven.mts

@@ -67,8 +67,8 @@ const config: CliCommandConfig = {
     Options
       ${getFlagListOutput(config.flags)}
 
-    Emits a single \`.socket.facts.json\` describing the resolved dependency
-    graph of your Maven project, using maven (\`mvn\` on PATH by default). It
+    Emits a single \`pom.xml.socket.facts.json\` (named after the POM Maven
+    runs on) describing the resolved dependency graph of your Maven project, using maven (\`mvn\` on PATH by default). It
     reads dependency metadata only and never downloads artifacts; an unresolved
     dependency is a fatal error. You can pass --include-configs /
     --exclude-configs (comma-separated glob patterns) to control which Maven

src/commands/manifest/cmd-manifest-maven.test.mts

@@ -30,8 +30,8 @@ describe('socket manifest maven', async () => {
             --maven-opts        Additional options to pass on to maven, e.g. \`-P <profile> -s <settings.xml>\`
             --verbose           Print debug messages
 
-          Emits a single \`.socket.facts.json\` describing the resolved dependency
-          graph of your Maven project, using maven (\`mvn\` on PATH by default). It
+          Emits a single \`pom.xml.socket.facts.json\` (named after the POM Maven
+          runs on) describing the resolved dependency graph of your Maven project, using maven (\`mvn\` on PATH by default). It
           reads dependency metadata only and never downloads artifacts; an unresolved
           dependency is a fatal error. You can pass --include-configs /
           --exclude-configs (comma-separated glob patterns) to control which Maven

src/commands/manifest/cmd-manifest-scala.mts

@@ -37,12 +37,12 @@ const config: CliCommandConfig = {
     facts: {
       type: 'boolean',
       description:
-        'Emit a Socket facts JSON file (`.socket.facts.json`) describing the resolved dependency graph. This is the default; pass `--pom` to generate `pom.xml` files instead',
+        'Emit a Socket facts JSON file (`sbt.socket.facts.json`) describing the resolved dependency graph. This is the default; pass `--pom` to generate `pom.xml` files instead',
     },
     pom: {
       type: 'boolean',
       description:
-        'Generate `pom.xml` manifest file(s) instead of the default Socket facts file (`.socket.facts.json`)',
+        'Generate `pom.xml` manifest file(s) instead of the default Socket facts file (`sbt.socket.facts.json`)',
     },
     includeConfigs: {
       type: 'string',
@@ -63,7 +63,7 @@ const config: CliCommandConfig = {
     out: {
       type: 'string',
       description:
-        'Only with --pom: path of the output `pom.xml`, see also --stdout. Does not apply when generating Socket facts (always written to the project root as `.socket.facts.json`)',
+        'Only with --pom: path of the output `pom.xml`, see also --stdout. Does not apply when generating Socket facts (always written to the project root as `sbt.socket.facts.json`)',
     },
     stdout: {
       type: 'boolean',
@@ -86,8 +86,8 @@ const config: CliCommandConfig = {
     Options
       ${getFlagListOutput(config.flags)}
 
-    By default, emits a single \`.socket.facts.json\` describing the resolved
-    dependency graph of the whole build. It reads dependency metadata only and
+    By default, emits a single \`sbt.socket.facts.json\` describing the
+    resolved dependency graph of the whole build. It reads dependency metadata only and
     never downloads artifacts; an unresolved dependency is a fatal error. You
     can pass --include-configs / --exclude-configs (comma-separated glob
     patterns) to control which sbt configurations are resolved (e.g.
@@ -304,7 +304,7 @@ async function run(
   //       would the file name be?
 
   // --out / --stdout only affect the pom path. Socket facts are always written
-  // to the project root as `.socket.facts.json` so that `socket scan create`
+  // to the project root as `sbt.socket.facts.json` so that `socket scan create`
   // picks them up, so reject these flags in facts mode rather than silently
   // ignoring an explicitly-passed output location.
   const wasValidInput = checkCommandInput(
@@ -322,7 +322,7 @@ async function run(
         (cli.flags['out'] !== undefined || cli.flags['stdout'] !== undefined)
       ),
       message:
-        'The `--out` and `--stdout` options only apply with `--pom`; Socket facts are always written to the project root as `.socket.facts.json`',
+        'The `--out` and `--stdout` options only apply with `--pom`; Socket facts are always written to the project root as `sbt.socket.facts.json`',
       fail: 'remove --out/--stdout, or pass --pom',
     },
   )

src/commands/manifest/cmd-manifest-scala.test.mts

@@ -26,17 +26,17 @@ describe('socket manifest scala', async () => {
             --bin               Location of sbt binary to use
             --exclude-configs   When generating facts: comma-separated glob patterns; sbt configurations matching any pattern are skipped (applied after --include-configs)
             --exclude-paths     List of glob patterns to exclude from manifest/facts generation. Patterns are anchored micromatch globs matched relative to CWD (\`--cwd\` if set): \`tests\` matches only \`<cwd>/tests\`; use \`**/tests\` to match at any depth. Negation patterns (\`!path\`) are not supported. Accepts a comma-separated value or multiple flags.
-            --facts             Emit a Socket facts JSON file (\`.socket.facts.json\`) describing the resolved dependency graph. This is the default; pass \`--pom\` to generate \`pom.xml\` files instead
+            --facts             Emit a Socket facts JSON file (\`sbt.socket.facts.json\`) describing the resolved dependency graph. This is the default; pass \`--pom\` to generate \`pom.xml\` files instead
             --ignore-unresolved  When generating facts: warn on unresolved dependencies instead of failing the run (unresolved deps are not emitted to the facts file)
             --include-configs   When generating facts: comma-separated glob patterns matched against sbt configuration names (case-sensitive; \`*\`, \`?\`, and \`[...]\` wildcards). Only configurations matching at least one pattern are resolved. e.g. \`compile,test\`. Default: compile,optional,provided,runtime,test
-            --out               Only with --pom: path of the output \`pom.xml\`, see also --stdout. Does not apply when generating Socket facts (always written to the project root as \`.socket.facts.json\`)
-            --pom               Generate \`pom.xml\` manifest file(s) instead of the default Socket facts file (\`.socket.facts.json\`)
+            --out               Only with --pom: path of the output \`pom.xml\`, see also --stdout. Does not apply when generating Socket facts (always written to the project root as \`sbt.socket.facts.json\`)
+            --pom               Generate \`pom.xml\` manifest file(s) instead of the default Socket facts file (\`sbt.socket.facts.json\`)
             --sbt-opts          Additional options to pass on to sbt, as per \`sbt --help\`
             --stdout            Only with --pom: print the resulting \`pom.xml\` to stdout (supersedes --out). Does not apply when generating Socket facts
             --verbose           Print debug messages
 
-          By default, emits a single \`.socket.facts.json\` describing the resolved
-          dependency graph of the whole build. It reads dependency metadata only and
+          By default, emits a single \`sbt.socket.facts.json\` describing the
+          resolved dependency graph of the whole build. It reads dependency metadata only and
           never downloads artifacts; an unresolved dependency is a fatal error. You
           can pass --include-configs / --exclude-configs (comma-separated glob
           patterns) to control which sbt configurations are resolved (e.g.

src/commands/manifest/convert-gradle-to-facts.mts

@@ -2,7 +2,8 @@ import { runManifestFacts } from './run-manifest-facts.mts'
 
 import type { SidecarAccumulator } from './scripts/sidecar.mts'
 
-// Generates `.socket.facts.json` for a Gradle project via the bundled init script.
+// Generates `gradle.socket.facts.json` for a Gradle project via the bundled
+// init script.
 export async function convertGradleToFacts({
   bin,
   cwd,

src/commands/manifest/convert-maven-to-facts.mts

@@ -2,7 +2,8 @@ import { runManifestFacts } from './run-manifest-facts.mts'
 
 import type { SidecarAccumulator } from './scripts/sidecar.mts'
 
-// Generates `.socket.facts.json` for a Maven project via the bundled extension.
+// Generates `pom.xml.socket.facts.json` (named after the POM Maven runs on)
+// for a Maven project via the bundled extension.
 export async function convertMavenToFacts({
   bin,
   cwd,

src/commands/manifest/convert-sbt-to-facts.mts

@@ -2,7 +2,7 @@ import { runManifestFacts } from './run-manifest-facts.mts'
 
 import type { SidecarAccumulator } from './scripts/sidecar.mts'
 
-// Generates `.socket.facts.json` for an sbt project via the bundled sbt plugin.
+// Generates `sbt.socket.facts.json` for an sbt project via the bundled sbt plugin.
 // sbt 0.13/early 1.x can't run on modern JDKs — pass a compatible JDK via
 // `--sbt-opts "--java-home <path>"` or `JAVA_HOME`.
 export async function convertSbtToFacts({