Socket now correctly scans crates.io package versions that have been yanked but remain pinned in a project’s Cargo.lock, preventing failures for projects that still depend on archived crate versions.
Repository-scoped API tokens can now retrieve the supported-files list required to start reachability scans. This fixes an issue where scans authenticated with a repository-scoped token could fail with a 403 error before analysis began, making it easier to use least-privilege credentials with the Socket API.
","date_published":"2026-07-09T03:23:00.000Z"},{"id":"https://socket.dev/changelog/packagist-package-pages-now-surface-force-pushed-tags","url":"https://socket.dev/changelog/packagist-package-pages-now-surface-force-pushed-tags?utm_medium=feed","title":"Packagist Package Pages Now Surface Force-Pushed Tags","content_html":"Packagist package pages now show the full commit history for tags that have been force-pushed, with the commit currently associated with the tag highlighted. This makes it easier to identify when a published package version has been retagged and review the commits it previously referenced.
","date_published":"2026-07-06T04:03:00.000Z"},{"id":"https://socket.dev/changelog/fix-full-scan-metadata-now-matches-the-api-contract","url":"https://socket.dev/changelog/fix-full-scan-metadata-now-matches-the-api-contract?utm_medium=feed","title":"Fix: Full Scan Metadata Now Matches the API Contract","content_html":"Full scan metadata responses now consistently include the repository, workspace, report URL, API URL, and scan type fields documented in the API contract.
","date_published":"2026-07-03T03:50:00.000Z"},{"id":"https://socket.dev/changelog/private-package-scores-now-display-as-n-a","url":"https://socket.dev/changelog/private-package-scores-now-display-as-n-a?utm_medium=feed","title":"Private Package Scores Now Display as N/A","content_html":"Private packages that Socket cannot score now display N/A instead of a numeric score in pull request comments and dependency views. This prevents private packages from appearing to have passed or failed analysis when no score is available.
","date_published":"2026-07-03T03:45:00.000Z"},{"id":"https://socket.dev/changelog/fix-pull-request-pages-no-longer-break-after-renaming-a-workspace","url":"https://socket.dev/changelog/fix-pull-request-pages-no-longer-break-after-renaming-a-workspace?utm_medium=feed","title":"Fix: Pull Request Pages No Longer Break After Renaming a Workspace","content_html":"Fixed an issue where pull request detail pages could return a "Not Found" error after a workspace was renamed, even though the pull request still appeared in the list. Existing pull request links now continue to work after workspace renames without requiring any additional action.
","date_published":"2026-07-02T03:28:00.000Z"},{"id":"https://socket.dev/changelog/ai-reviewed-reachability-specifications","url":"https://socket.dev/changelog/ai-reviewed-reachability-specifications?utm_medium=feed","title":"New: AI-Reviewed Reachability Specifications","content_html":"Organizations can now opt in to include AI-generated reachability specifications alongside human-verified ones, giving more vulnerabilities a reachability verdict.
This setting can be enabled under Settings → Alert Scans → Reachability. Once enabled, it applies across reachability analysis and broadens coverage, with a slightly higher risk of an incorrect result.
Alert details now include a Specification field that shows whether a reachability result came from an AI-generated or human-verified specification.
The organization switcher has been redesigned to make it faster and easier to navigate. It now surfaces Settings and your organizations up front, and adds a searchable All organizations view for users who belong to multiple organizations.
","date_published":"2026-06-29T04:22:00.000Z"},{"id":"https://socket.dev/changelog/alert-titles-added-to-csv-exports","url":"https://socket.dev/changelog/alert-titles-added-to-csv-exports?utm_medium=feed","title":"Alert Titles Added to CSV Exports","content_html":"Alerts CSV exports now include a human-readable Alert Title column, making it easier to identify CVEs directly from the export without cross-referencing the dashboard. Upgrade Version values are also now populated more consistently for vulnerability alerts.
","date_published":"2026-06-23T04:28:00.000Z"},{"id":"https://socket.dev/changelog/add-firewall-events-data-export","url":"https://socket.dev/changelog/add-firewall-events-data-export?utm_medium=feed","title":"Add Firewall events data export","content_html":"For customers using Socket Firewall, it's now possible to export event logs to an external data source. To do so, click "Settings" -> "Data Export" -> "Create Integration" and choose "Telemetry events" as the data type.
","date_published":"2026-06-16T15:27:39.629Z"}]}