upgrading coana to version 15.10.4

[socket-pr-bot]

Summary

• Upgrades @coana-tech/cli from 15.10.3 to 15.10.4 and bumps the Socket CLI version to 1.1.154.
• This PR was created automatically by a bot.

Coana Changelog

For details on what's included in this Coana release, see the Coana Changelogs.

---

Note

Low Risk
Routine dependency pin and version bump with no CLI logic changes; behavior shifts only follow the Coana 15.10.4 release.

Overview
Releases Socket CLI 1.1.154 by bumping the bundled Coana dependency from 15.10.3 to 15.10.4 in package.json and refreshing pnpm-lock.yaml.

CHANGELOG.md adds the 1.1.154 release note documenting the Coana upgrade. There are no Socket application source changes in this diff—reachability, manifest, and socket fix flows pick up Coana behavior from the new devDependency version at build time.

^{Reviewed by Cursor Bugbot for commit 114eed4. Configure here.}

[socket-security-staging]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​coana-tech/​cli@​15.10.4

View full report

[John-David Dalton (jdalton)]

[agent] Heads up — the check rollup on this PR currently looks green but is not trustworthy. Do not merge on it.

What happened:

• The original pull_request E2E run failed one test, cmd-fix.e2e.test.mts > Python projects, with django should be upgraded from 3.0.0 to 3.0.0: expected 0 to be greater than 0. That is the known flake, not anything this coana bump touched.
• I requested a rerun of just that failed job. GitHub never scheduled it — the run has sat with zero jobs since. That rerun request removed the FAILURE entry from the rollup, so E2E Tests no longer appears here at all.
• I then dispatched e2e-tests.yml manually on this branch to get a clean answer. That run (31128630624) also failed, but for an unrelated reason: SOCKET_CLI_API_TOKEN is empty under workflow_dispatch, so the suite aborts before running. Disregard it as a signal.

Net effect: E2E Tests is missing from the rollup rather than passing. To get a real result, push to the branch (or otherwise re-fire a pull_request event) so the workflow runs with its secrets. Everything else — Lint, Type Check, both Test Matrix jobs, Socket Security, Bugbot — is genuinely green.

For reference on the flake: E2E Tests went green at 09:56 and 11:02 today and red at 18:09 and 18:20 on an unrelated branch, and v1.x itself failed 4 of its last 12 CI runs.

[John-David Dalton (jdalton)]

[agent] Correction — this was already merged at 21:56:41Z, 65 seconds before my comment above posted at 21:57:46Z. The "do not merge" framing arrived too late to be actionable, so read it as a record rather than a request.

On the substance the merge looks fine. The diff is 12 additions and 7 deletions across CHANGELOG.md, package.json and pnpm-lock.yaml — a pure coana version bump. The one red e2e test was the known django flake in cmd-fix.e2e.test.mts, which nothing in those three files can affect, and Lint, Type Check, both Test Matrix jobs, Socket Security and Bugbot were all genuinely green.

The part that is on me and worth knowing: my rerun request had removed the E2E Tests FAILURE entry from the rollup about an hour before the merge, so this PR was presenting as clean at the moment it was merged. No harm here given what the diff was, but that is a way an agent can quietly turn a red PR green, and it is worth avoiding on a PR where the failing test actually covers the change.