Visitar URL original
chore(release): 3.4.1 (#130) · SocketDev/socket-basics@2ba1ad9 · GitHub
Skip to content

Repository navigation

Commit 2ba1ad9

Browse files
lelialelia
authored
chore(release): 3.4.1 (#130)
* chore(release): 3.4.1 Stamps [Unreleased] as [3.4.1], bumps the version files and uv.lock, and synchronizes the current-release references across README.md and docs/**. Also bumps the Socket Python CLI in the heavy and app-tests images from 2.9.0 to 2.11.2, which carries the eMudhra CA fix for the CLI's own image. * chore(release): pin Trivy 0.73.0-socket.1 (placeholder digest) Points all three images at the trivy-dist toolchain rebuild of v0.73.0 on Go 1.26.10 (SocketDev/trivy-dist#24). The digest is a placeholder until that image is published. check_core_tools now ranks -socket.N GHCR tags above their base version and drops the suffix from the upstream Go module purl. * chore(release): pin Trivy 0.76.1 (placeholder digest) Upstream's v0.76.1 is built on Go 1.27.3, so Basics takes Socket's build of it instead of a 0.73.0 toolchain rebuild (SocketDev/trivy-dist#25). The digest stays a placeholder until that build publishes. * docs(changelog): stage the Socket Python SDK 3.6.1 bump for 3.4.1 uv.lock moves once socketdev 3.6.1 is on PyPI. * docs(changelog): rewrap the 3.4.1 entry and describe SDK 3.6.1 as released * chore(release): Socket Python CLI 2.11.3 and SDK 3.6.1 2.11.3 requires certifi>=2026.10.19 and SDK 3.6.1, which requires it too. Relocked with uv 0.12.1, the version the images use, which also restores lock format revision 3. * chore(release): pin Socket-built Trivy 0.76.1 by digest * fix(app-tests): match the shipped images' ca-certificates floor and pip upgrade * chore(release): stamp 3.4.1 for 2026-10-21 * docs(docker): point the Trivy override example at 0.76.1
1 parent e1698f1 commit 2ba1ad9

18 files changed

Lines changed: 158 additions & 110 deletions

‎CHANGELOG.md‎

Lines changed: 13 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,17 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
88

99
## [Unreleased]
1010

11+
## [3.4.1] - 2026-10-21
12+
13+
### Changed
14+
- Socket Python CLI 2.9.0 -> 2.11.3 in the heavy and app-tests images. 2.11.3
15+
carries the same eMudhra CA fix for its own image and requires
16+
`certifi>=2026.10.19` (SocketDev/socket-python-cli#415, #418).
17+
- Socket Python SDK 3.6.0 -> 3.6.1, which requires `certifi>=2026.10.19`.
18+
- Trivy 0.73.0 -> 0.76.1, upstream's release for the eMudhra compromise. It is
19+
built on Go 1.27.3, which blocks the compromised intermediates in Go itself
20+
and clears container scanner findings against Trivy's Go version.
21+
1122
### Fixed
1223

1324
- **The images no longer trust certificates from the compromised eMudhra
@@ -16,8 +27,8 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
1627
2026.10.19 or newer, and source installs (`pip install -e .`) require the same
1728
`certifi`. curl, git, Python `requests`, pip, Node, and the bundled Trivy and
1829
TruffleHog now reject those chains. Container scanners may still report
19-
CVE-2026-111943 against the Trivy and TruffleHog binaries until they are
20-
rebuilt on Go 1.26.10 or 1.27.3.
30+
CVE-2026-111943 against the TruffleHog binary until it is rebuilt on Go
31+
1.26.10 or 1.27.3.
2132

2233
## [3.4.0] - 2026-09-18
2334

‎Dockerfile‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -15,10 +15,11 @@ ARG SOCKET_NPM_CLI_VERSION=1.1.165
1515
# source and published by Socket's own release pipeline. Pinned by digest; both
1616
# ARGs are updated together by that release process, never bumped independently.
1717
# Building requires pull access to the registry; contributors without it can
18-
# override, e.g.: docker build --build-arg TRIVY_IMAGE=aquasec/trivy:0.73.0 .
18+
# override, e.g.: docker build --build-arg TRIVY_IMAGE=aquasec/trivy:0.76.1 .
1919
# TRIVY_VERSION feeds the image label — keep it in sync with the TRIVY_IMAGE tag.
20-
ARG TRIVY_VERSION=0.73.0
21-
ARG TRIVY_IMAGE=ghcr.io/socketdev/trivy:0.73.0@sha256:e3d9d5f10250cb73b0ea9446ae1191c0f2da2f5e6173eac08a840b1812f02e0b
20+
# -socket.N is a trivy-dist toolchain rebuild: same upstream source, newer Go.
21+
ARG TRIVY_VERSION=0.76.1
22+
ARG TRIVY_IMAGE=ghcr.io/socketdev/trivy:0.76.1@sha256:883da3593a60e311b2ed87c3a55241051b27bba15ffc3ce041ae570cd0f00915
2223

2324
# ─── Stage: trivy (Socket-built redistribution) ───────────────────────────────
2425
FROM ${TRIVY_IMAGE} AS trivy

‎Dockerfile.heavy‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,9 +4,9 @@ ARG TRUFFLEHOG_VERSION=3.96.0
44
ARG UV_VERSION=0.12.1
55
ARG OPENGREP_VERSION=v1.26.0
66
ARG SOCKET_NPM_CLI_VERSION=1.1.165
7-
ARG SOCKET_PYTHON_CLI_VERSION=2.9.0
7+
ARG SOCKET_PYTHON_CLI_VERSION=2.11.3
88
# Socket-built Trivy, pinned by digest — see the note in ./Dockerfile.
9-
ARG TRIVY_IMAGE=ghcr.io/socketdev/trivy:0.73.0@sha256:e3d9d5f10250cb73b0ea9446ae1191c0f2da2f5e6173eac08a840b1812f02e0b
9+
ARG TRIVY_IMAGE=ghcr.io/socketdev/trivy:0.76.1@sha256:883da3593a60e311b2ed87c3a55241051b27bba15ffc3ce041ae570cd0f00915
1010

1111
FROM ${TRIVY_IMAGE} AS trivy
1212
FROM trufflesecurity/trufflehog:${TRUFFLEHOG_VERSION} AS trufflehog

‎README.md‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ jobs:
3535
- name: Run Socket Basics
3636
# Pin to a commit SHA for supply-chain safety.
3737
# Dependabot will keep this up to date automatically — see docs/github-action.md.
38-
uses: SocketDev/socket-basics@<sha> # v3.4.0
38+
uses: SocketDev/socket-basics@<sha> # v3.4.1
3939
env:
4040
GITHUB_PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
4141
with:
@@ -179,10 +179,10 @@ For GitHub Actions, see the [Quick Start](#-quick-start---github-actions) above
179179

180180
```bash
181181
# Pull the pre-built image (recommended — no build step required)
182-
docker pull ghcr.io/socketdev/socket-basics:3.4.0
182+
docker pull ghcr.io/socketdev/socket-basics:3.4.1
183183
184184
# Run scan
185-
docker run --rm -v "$PWD:/workspace" ghcr.io/socketdev/socket-basics:3.4.0 \
185+
docker run --rm -v "$PWD:/workspace" ghcr.io/socketdev/socket-basics:3.4.1 \
186186
--workspace /workspace \
187187
--python \
188188
--secrets \

‎action.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ author: "Socket"
44

55
runs:
66
using: "docker"
7-
image: "docker://ghcr.io/socketdev/socket-basics:3.4.0"
7+
image: "docker://ghcr.io/socketdev/socket-basics:3.4.1"
88
env:
99
# Core GitHub variables (these are automatically available, but we explicitly pass GITHUB_TOKEN)
1010
GITHUB_TOKEN: ${{ inputs.github_token }}

‎app_tests/Dockerfile‎

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -13,11 +13,11 @@ ARG UV_VERSION=0.12.1
1313
ARG GOSEC_VERSION=v2.28.0
1414
ARG OPENGREP_VERSION=v1.26.0
1515
ARG SOCKET_NPM_CLI_VERSION=1.1.165
16-
ARG SOCKET_PYTHON_CLI_VERSION=2.9.0
16+
ARG SOCKET_PYTHON_CLI_VERSION=2.11.3
1717
#
1818
# NOT Dependabot-trackable — Socket-built Trivy, pinned by digest; updated by
1919
# Socket's trivy-dist release process. See the note in the root ./Dockerfile.
20-
ARG TRIVY_IMAGE=ghcr.io/socketdev/trivy:0.73.0@sha256:e3d9d5f10250cb73b0ea9446ae1191c0f2da2f5e6173eac08a840b1812f02e0b
20+
ARG TRIVY_IMAGE=ghcr.io/socketdev/trivy:0.76.1@sha256:883da3593a60e311b2ed87c3a55241051b27bba15ffc3ce041ae570cd0f00915
2121

2222
# ─── Stage: trivy (Socket-built redistribution) ───────────────────────────────
2323
FROM ${TRIVY_IMAGE} AS trivy
@@ -89,7 +89,13 @@ ARG SOCKET_NPM_CLI_VERSION
8989
RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
9090
--mount=type=cache,target=/var/lib/apt,sharing=locked \
9191
apt-get update && apt-get install -y --no-install-recommends \
92-
curl git wget ca-certificates libatomic1
92+
curl git wget ca-certificates libatomic1 \
93+
&& dpkg --compare-versions "$(dpkg-query -W -f='${Version}' ca-certificates)" ge 20250419+deb13u1
94+
# pip checks certificates against its own vendored CA bundle, not the system
95+
# store, and the base image's pip trusts the compromised intermediates. 26.2.2
96+
# vendors certifi 2026.10.19. Upgrade it against the system store fixed above.
97+
RUN python -m pip install --no-cache-dir --cert /etc/ssl/certs/ca-certificates.crt --upgrade "pip>=26.2.2" \
98+
&& python -c 'import sys, pip; sys.exit(tuple(map(int, pip.__version__.split(".")[:3])) < (26, 2, 2))'
9399
RUN --mount=type=cache,target=/root/.npm \
94100
npm install -g eslint eslint-plugin-security \
95101
@typescript-eslint/parser @typescript-eslint/eslint-plugin \

0 commit comments

Comments
 (0)