Bump pinned Coana CLI to 15.13.0 and patch brotli / brotlicffi (#423)

* Bump pinned Coana CLI to 15.13.0

* Bump brotli and brotlicffi to patched versions

brotli 1.2.1 and brotlicffi 1.2.1.0 fix CVE-2026-111497
(GHSA-9v8h-qqgm-4m35), an out-of-bounds write in the Brotli decoder.
The exact pins kept installs from picking up the fix.

Relocking also moves the dev-only filelock to 4.2.4, the other finding
failing dependency-audit.

* Release the Coana bump in 2.11.4

2.11.4 isn't on PyPI yet, so ship the engine bump with it instead of
cutting 2.11.5.

* Drop the claim that the CLI never runs the Brotli decoder

With brotli installed, requests advertises br and urllib3 decodes
br-encoded responses with it, so the affected decoder is reachable
through the CLI's HTTP calls.

---------

Co-authored-by: socket-pr-bot[bot] <294242679+socket-pr-bot[bot]@users.noreply.github.com>
Co-authored-by: lelia <2418071+lelia@users.noreply.github.com>

Author: socket-pr-bot[bot]

CHANGELOG.md

@@ -2,6 +2,14 @@
 
 ## 2.11.4
 
+### Fixed: bump `brotli` and `brotlicffi` to patched versions
+
+- Bumped the pinned `brotli` (CPython) from `1.2.0` to `1.2.1` and `brotlicffi`
+  (other implementations) from `1.2.0.2` to `1.2.1.0`, which fix
+  CVE-2026-111497 (GHSA-9v8h-qqgm-4m35), an out-of-bounds write in the Brotli
+  decoder. The pins are exact, so earlier releases couldn't be installed
+  alongside the patched versions.
+
 ### Fixed: find the reachability facts file when `--target-path` isn't the working directory
 
 - `--only-facts-file` and `--reach-use-only-pregenerated-sboms` now submit the
@@ -13,6 +21,13 @@
   `7.3.20` (Python 3.11). The reachability engine uses it to speed up Python
   analysis.
 
+### Changed: bump pinned Coana CLI to 15.13.0
+
+- Bumped the pinned reachability engine (the Coana CLI) from `15.12.11` to
+  `15.13.0`. See the
+  [reachability analysis changelog](https://docs.socket.dev/docs/reachability-analysis-changelog)
+  for engine changes.
+
 ## 2.11.3
 
 ### Fixed: finish rejecting the compromised eMudhra intermediate CAs

docs/cli-reference.md

@@ -338,7 +338,7 @@ If you don't want to provide the Socket API Token every time then you can use th
 | Parameter                        | Required | Default | Description                                                                                                                |
 |:---------------------------------|:---------|:--------|:---------------------------------------------------------------------------------------------------------------------------|
 | `--reach`                          | False    | False   | Enable reachability analysis to identify which vulnerable functions are actually called by your code. Creates a full application reachability scan (`scan_type=socket_tier1`). |
-| `--reach-version`                  | False    | 15.12.11 | Version of the Coana CLI to use. Defaults to the pinned version that ships with this CLI release, so the engine only changes when you upgrade the Socket CLI. Pass `latest` to always use the newest published version (opt-in auto-update), or an explicit version (e.g. `1.2.3`) to pin it. |
+| `--reach-version`                  | False    | 15.13.0 | Version of the Coana CLI to use. Defaults to the pinned version that ships with this CLI release, so the engine only changes when you upgrade the Socket CLI. Pass `latest` to always use the newest published version (opt-in auto-update), or an explicit version (e.g. `1.2.3`) to pin it. |
 | `--reach-analysis-timeout`         | False    | 10m     | Timeout for each reachability analysis run, e.g. `90s`, `10m` or `1h`. Omitted by default, so coana applies its own default (`10m`). Alias: `--reach-timeout` |
 | `--reach-analysis-memory-limit`    | False    | 8GB     | Memory limit for each reachability analysis run, e.g. `512MB` or `8GB`. Omitted by default, so coana applies its own default (`8GB`). Alias: `--reach-memory-limit` |
 | `--reach-concurrency`              | False    | 1       | Control parallel analysis execution (must be >= 1). Omitted by default, so coana applies its own default.                  |

pyproject.toml

@@ -19,8 +19,8 @@ dependencies = [
     "socketdev==3.6.1",
     "beautifulsoup4==4.15.0",
     "markdown==3.11.1",
-    "brotli==1.2.0; platform_python_implementation == 'CPython'",
-    "brotlicffi==1.2.0.2; platform_python_implementation != 'CPython'",
+    "brotli==1.2.1; platform_python_implementation == 'CPython'",
+    "brotlicffi==1.2.1.0; platform_python_implementation != 'CPython'",
     # requests' CA bundle. A floor rather than an exact pin, so later trust-store
     # fixes still reach installs; 2026.10.19 drops the roots behind the
     # compromised eMudhra intermediates.

socketsecurity/core/tools/reachability.py

@@ -22,7 +22,7 @@
 # Pinned Coana CLI version. Bumped deliberately per Python CLI release so the
 # reachability engine version only changes through a standard pip upgrade (advance notice).
 # Pass --reach-version latest to opt into the newest published version instead.
-DEFAULT_COANA_CLI_VERSION: Final = "15.12.11"
+DEFAULT_COANA_CLI_VERSION: Final = "15.13.0"
 
 # Vendored from coana-package-manager, where it is generated; the only code that may read or
 # write the cache Coana shares with the Socket CLIs. See "Launching Coana" in that repo's