[Jeppe Fredsgaard Blaabjerg (jfblaa)]

LLM Description written by Claude Code:claude-opus-5-5

Fixes REA-990: a --reach scan of a JVM build with Socket facts files stored no private libraries or build modules, and their dependencies had no parent. The same scan without --reach keeps them.

Cause: with --reach, socket-cli uploaded Coana's report in place of every *.socket.facts.json. In Coana's report, components with no public metadata (private libraries, build modules) carry missingMetadata, which depscan strips at scan create, so the report alone cannot carry them.

Change: upload the files Coana was given (detected facts files minus reachability reports) next to its report, as --reach-use-only-pregenerated-sboms already did. depscan merges them, so the facts files contribute the private components and their edges, and the report contributes reachability. Earlier reports (bare .socket.facts.json) stay out.

Notes:

• Named facts files go up uncompressed, as in a scan without --reach: depscan only decodes the bare .socket.facts.json.br (REA-895).
• Coana's input and the upload now use the same filter, but it is still written out separately in each place; computing it once in performReachabilityAnalysis is left as a follow-up.

🤖 Generated with Claude Code

---

Note

Medium Risk
Changes scan upload composition for all --reach runs and affects how depscan merges SBOMs; scope is limited to the reach success path with regression tests.

Overview
socket scan create --reach no longer uploads only Coana’s reachability report in place of every *.socket.facts.json. It now uploads the same inputs Coana analyzed—build facts such as pom.xml.socket.facts.json and gradle.socket.facts.json, plus other manifests—along with the fresh report, while still omitting stale bare .socket.facts.json reachability reports.

That fixes JVM reach scans where private libraries and build modules disappeared from the stored SBOM because depscan strips missingMetadata components from the report alone; merged uploads preserve those components and parent/child edges from the facts files while the report still supplies reachability.

Tests and the changelog were updated to match the new upload set (including --reach-use-only-pregenerated-sboms behavior).

^{Reviewed by Cursor Bugbot for commit 514229f. Configure here.}