chore(deps): bump Socket npm CLI to 1.14.0

1.14.0 carries reachability fixes for --dynamic-sbom-inference builds and
the same Coana CLI (15.14.1) and Node requirement as 1.13.1.

Verified with the standard image: a Tier 1 scan returns full results
(1 reachable, 4 unreachable) directly and on a network whose only egress
is an HTTPS_PROXY.

Author: lelia

CHANGELOG.md

@@ -31,7 +31,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
   list-valued flags, such as
   `--exclude-paths=tests --exclude-paths=fixtures`.
 - Bundled tools: OpenGrep v1.26.0 -> v1.33.1, TruffleHog 3.96.0 -> 3.99.8,
-  Socket npm CLI 1.1.165 -> 1.13.1, Socket Python CLI 2.11.3 -> 2.11.11, uv
+  Socket npm CLI 1.1.165 -> 1.14.0, Socket Python CLI 2.11.3 -> 2.11.11, uv
   0.12.1 -> 0.13.7; in the app-tests image, gosec v2.28.0 -> v2.30.0 and Go
   1.26.5 -> 1.27.3. Java SAST benchmark results are unchanged on OpenGrep 1.33.1.
 - Socket Python SDK (`socketdev`) 3.6.1 -> 3.6.2, which Socket Python CLI

Dockerfile

@@ -13,7 +13,7 @@
 #    Dependabot to read, so they keep an ARG pin and are bumped by hand. These
 #    stay overridable: docker build --build-arg OPENGREP_VERSION=v1.33.1 .
 ARG OPENGREP_VERSION=v1.33.1
-ARG SOCKET_NPM_CLI_VERSION=1.13.1
+ARG SOCKET_NPM_CLI_VERSION=1.14.0
 #
 # 3. Socket-built Trivy, rebuilt from unmodified upstream source and published
 #    by Socket's own release pipeline. Deliberately kept out of Dependabot's

Dockerfile.heavy

@@ -4,7 +4,7 @@
 # installed by a script or package manager keep an ARG pin and are bumped by
 # hand. See the note at the top of ./Dockerfile for why.
 ARG OPENGREP_VERSION=v1.33.1
-ARG SOCKET_NPM_CLI_VERSION=1.13.1
+ARG SOCKET_NPM_CLI_VERSION=1.14.0
 ARG SOCKET_PYTHON_CLI_VERSION=2.11.11
 # Socket-built Trivy, pinned by digest — see the note in ./Dockerfile.
 ARG TRIVY_IMAGE=ghcr.io/socketdev/trivy:0.76.1@sha256:883da3593a60e311b2ed87c3a55241051b27bba15ffc3ce041ae570cd0f00915

app_tests/Dockerfile

@@ -9,7 +9,7 @@
 #   docker build --build-arg OPENGREP_VERSION=v1.33.1 -f app_tests/Dockerfile app_tests
 ARG GOSEC_VERSION=v2.30.0
 ARG OPENGREP_VERSION=v1.33.1
-ARG SOCKET_NPM_CLI_VERSION=1.13.1
+ARG SOCKET_NPM_CLI_VERSION=1.14.0
 ARG SOCKET_PYTHON_CLI_VERSION=2.11.11
 #
 # Socket-built Trivy, pinned by digest and deliberately kept out of Dependabot's

docs/local-install-docker.md

@@ -220,7 +220,7 @@ script or package manager are build args and can be overridden:
 ```bash
 docker build \
   --build-arg OPENGREP_VERSION=v1.33.1 \
-  --build-arg SOCKET_NPM_CLI_VERSION=1.13.1 \
+  --build-arg SOCKET_NPM_CLI_VERSION=1.14.0 \
   -t socket-basics:3.4.1 .
 ```
 

docs/parameters.md

@@ -726,7 +726,7 @@ host:
 | `storage.googleapis.com` | Downloading the Coana reachability engine and its analyzers (about 120 MB) | Tier 1 fails: `Failed to get the Coana CLI <version>: getaddrinfo ENOTFOUND storage.googleapis.com` |
 | The package registry of each scanned ecosystem, for example `registry.npmjs.org` | Installing the project's dependencies so the engine can analyze them | Tier 1 still reports success, but the affected vulnerabilities come back as `INSTALL ERROR` with no reachability verdict |
 
-Socket CLI 1.9.0 and later (Socket Basics 3.5.0 bundles 1.13.1) download the
+Socket CLI 1.9.0 and later (Socket Basics 3.5.0 bundles 1.14.0) download the
 engine from Socket rather than npm, with no npm fallback, so an npm mirror does
 not cover the second row. The registry row does not apply when the workspace
 already has its dependencies installed (for example a `node_modules` directory