fix(manifest): resolve Maven dependencies through Maven's own resolver

.claude/skills/bump-coana/SKILL.md

@@ -54,7 +54,8 @@ advance.
 1. Read `CHANGELOG.md` in the repository root.
 2. Find the `## [Unreleased]` heading. If it is absent — the previous release
    consumes it — recreate it directly after the header section (which ends with
-   "The format is based on...").
+   "The format is based on..."), spelled exactly `## [Unreleased]` and nothing
+   else.
 3. Add the entry under `## [Unreleased]`, in its `### Changed` subsection,
    creating that subsection if it is missing. If a Coana line is already there
    from an earlier unreleased bump, update it in place rather than adding a
@@ -65,6 +66,15 @@ release workflow, which promotes the whole `## [Unreleased]` block under the
 version it derives. Writing one here both names a version that may never exist
 and consumes the block, leaving the real release with empty notes.
 
+🚨 **Never put a date on the `## [Unreleased]` heading.** `unreleasedRange()` in
+`scripts/release/changelog.mts` finds the block by matching that heading for
+equality (case-insensitively, but otherwise exactly), so a heading like
+`## [Unreleased] - 2026-08-27` is invisible to it. The release then promotes
+nothing, falls back to a section derived from the commits in range, and inserts
+its own heading *above* the block it could not see — stranding the entry below a
+released version, where no release will ever pick it up. Dates belong only on
+release headings, which the workflow writes.
+
 **Resulting shape**:
 ```markdown
 ## [Unreleased]

CHANGELOG.md

@@ -4,16 +4,14 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
-## [1.1.161](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.161) - 2026-08-27
-
-### Fixed
-- **`release`** — stop the coana bump from hand-writing versions (#1515)
-
-## [Unreleased] - 2026-08-27
+## [Unreleased]
 
 ### Changed
 - Updated the Coana CLI to v `15.10.25`.
 
+### Fixed
+- Maven reachability scans now resolve dependencies through Maven itself, so they see the same artifacts a Maven build does — including one served only by a repository that a single module declares.
+
 ## [1.1.160](https://github.com/SocketDev/socket-cli/releases/tag/v1.1.160) - 2026-08-26
 
 ### Changed

src/commands/manifest/scripts/maven-extension/pom.xml

@@ -43,8 +43,9 @@
         </executions>
       </plugin>
 
-      <!-- Single self-contained jar, merging the Sisu indexes from our code and from the bundled
-           maven-dependency-tree so the container discovers everything in the ext realm. -->
+      <!-- Single self-contained jar. Everything the extension compiles against lives in the Maven
+           core realm at runtime, so nothing is bundled; shade stays for the Sisu index transformer
+           that lets the container discover the participants in the ext realm. -->
       <plugin>
         <groupId>org.apache.maven.plugins</groupId>
         <artifactId>maven-shade-plugin</artifactId>
@@ -97,32 +98,18 @@
       <version>${maven.version}</version>
       <scope>provided</scope>
     </dependency>
+    <!-- Aether graph/artifact types: what ProjectDependenciesResolver hands back. -->
     <dependency>
       <groupId>org.apache.maven.resolver</groupId>
       <artifactId>maven-resolver-api</artifactId>
       <version>1.9.18</version>
       <scope>provided</scope>
     </dependency>
-    <!-- maven-dependency-tree pulls this at compile scope; it's in the core realm at runtime, so
-         declare it provided to keep it out of the shaded jar. -->
-    <dependency>
-      <groupId>org.apache.maven.resolver</groupId>
-      <artifactId>maven-resolver-util</artifactId>
-      <version>1.9.18</version>
-      <scope>provided</scope>
-    </dependency>
     <dependency>
       <groupId>org.slf4j</groupId>
       <artifactId>slf4j-api</artifactId>
       <version>1.7.36</version>
       <scope>provided</scope>
     </dependency>
-
-    <!-- NOT part of Maven core: bundled (shaded) into the extension jar. -->
-    <dependency>
-      <groupId>org.apache.maven.shared</groupId>
-      <artifactId>maven-dependency-tree</artifactId>
-      <version>3.3.0</version>
-    </dependency>
   </dependencies>
 </project>

src/commands/manifest/scripts/maven-extension/src/main/java/tech/coana/ext/CoanaFactsLifecycleParticipant.java

@@ -3,9 +3,8 @@
 import org.apache.maven.AbstractMavenLifecycleParticipant;
 import org.apache.maven.MavenExecutionException;
 import org.apache.maven.execution.MavenSession;
+import org.apache.maven.project.ProjectDependenciesResolver;
 import org.apache.maven.rtinfo.RuntimeInformation;
-import org.apache.maven.shared.dependency.graph.DependencyGraphBuilder;
-import org.eclipse.aether.RepositorySystem;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import tech.coana.socket.SocketFactsRecordsEngine;
@@ -28,17 +27,13 @@ public class CoanaFactsLifecycleParticipant extends AbstractMavenLifecyclePartic
 
   private static final Logger LOG = LoggerFactory.getLogger("coana");
 
-  private final RepositorySystem repoSystem;
-  private final DependencyGraphBuilder dependencyGraphBuilder;
+  private final ProjectDependenciesResolver dependenciesResolver;
   private final RuntimeInformation runtimeInformation;
 
   @Inject
   public CoanaFactsLifecycleParticipant(
-      RepositorySystem repoSystem,
-      DependencyGraphBuilder dependencyGraphBuilder,
-      RuntimeInformation runtimeInformation) {
-    this.repoSystem = repoSystem;
-    this.dependencyGraphBuilder = dependencyGraphBuilder;
+      ProjectDependenciesResolver dependenciesResolver, RuntimeInformation runtimeInformation) {
+    this.dependenciesResolver = dependenciesResolver;
     this.runtimeInformation = runtimeInformation;
   }
 
@@ -60,7 +55,7 @@ public void afterSessionEnd(MavenSession session) throws MavenExecutionException
     opts.excludePaths = opt(session, "socket.excludePaths");
     File rootDir = new File(session.getExecutionRootDirectory());
     try {
-      new SocketFactsRecordsEngine(repoSystem, dependencyGraphBuilder, runtimeInformation.getMavenVersion(), LOG)
+      new SocketFactsRecordsEngine(dependenciesResolver, runtimeInformation.getMavenVersion(), LOG)
           .run(session, session.getProjects(), rootDir, opts);
     } catch (IOException exception) {
       throw new MavenExecutionException("Cannot write socket facts records", exception);