Skip to content

Commit 4663c2a

Browse files
lelialelia
committed
chore(release): 2.2.93 with CHANGELOG backfill
Patch release. Scope is maintenance only: dependency bundle + Dependabot review hardening + housekeeping + CHANGELOG backfill. No behavior changes. Targets 2.2.93 (not 2.2.92) to stay ahead of an in-flight 2.2.92 bug-fix release landing separately. CHANGELOG: 2.2.93 entry for this PR, plus backfilled entries for 2.2.81, 2.2.85, 2.2.86, 2.2.88, 2.2.89, and 2.2.91 (the #180 backfill covered 2.2.74-2.2.80; main reached 2.2.91 via #199 without a CHANGELOG note). Version refs synced across pyproject.toml, socketsecurity/__init__.py, and uv.lock per the version-incrementation CI check. Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>
1 parent 7e98f83 commit 4663c2a

3 files changed

Lines changed: 106 additions & 2 deletions

File tree

‎CHANGELOG.md‎

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,117 @@
11
# Changelog
22

3+
## 2.2.93
4+
5+
### Dependencies
6+
7+
Bundles twelve open Dependabot dependency PRs. Where Dependabot's target lagged the
8+
latest published release (it occasionally opens PRs a patch or two behind), we bumped
9+
to the current latest instead and re-verified through Socket Firewall:
10+
11+
- Main-app `uv` deps (closes #175, #177, #181, #188, #190, #198, #200, #205, #210):
12+
`urllib3 2.6.3 -> 2.7.0`, `gitpython 3.1.46 -> 3.1.50`, `python-dotenv 1.2.1 -> 1.2.2`,
13+
`pytest 9.0.2 -> 9.0.3`, `uv 0.9.21 -> 0.11.17`, `cryptography 46.0.5 -> 46.0.7`,
14+
`pygments 2.19.2 -> 2.20.0`, `requests 2.32.5 -> 2.33.0`, `idna 3.11 -> 3.15`.
15+
- E2E fixture manifests (closes #186, #187, #209):
16+
`axios 1.15.0 -> 1.16.1` (simple-npm), `requests 2.31.0 -> 2.33.0` (simple-pypi),
17+
`flask 3.0.0 -> 3.1.3` (simple-pypi).
18+
19+
**`idna` 3.11 -> 3.15 is security-motivated**: pulls in the fix for **CVE-2026-45409**
20+
(a quadratic-time DoS vector via oversized inputs that bypassed the earlier
21+
CVE-2024-3651 mitigation). The remaining bumps are version-currentness hygiene.
22+
23+
All twelve target versions were verified through Socket Firewall (`sfw`) on the
24+
full transitive dependency tree before bundling.
25+
26+
### CI / Internal
27+
28+
- **`.github/dependabot.yml`** (new -- the repo had no explicit config). Groups Python
29+
minor/patch into ONE weekly PR plus a separate major-update PR. Groups GitHub Actions
30+
similarly. 7-day cooldown across ecosystems. `tests/e2e/fixtures/**` intentionally
31+
excluded (fixture pins should be chosen for the supply-chain signal they expose, not
32+
auto-rolled). Pattern adapted from `SocketDev/socket-basics`.
33+
- **`.github/workflows/dependabot-review.yml`** (new). On every Dependabot PR: inspect
34+
changed files, then conditionally run Socket Firewall (`sfw`) install smoke jobs
35+
against the affected manifests. Because `sfw` uses the free, anonymous Socket
36+
public-data path it needs NO API key, so this runs cleanly under the standard
37+
`pull_request` context -- no `pull_request_target`, no token-leak surface.
38+
- **`python-tests.yml`** now runs a `uv lock --locked` drift check, a top-level import
39+
smoke step (catches API-removal breaks from upgraded deps instantly), and `pip-audit`
40+
against the locked dependencies.
41+
- **`e2e-test.yml`** now skips on Dependabot PRs (which don't have access to
42+
`SOCKET_CLI_API_TOKEN`); the new `dependabot-review` workflow's `sfw` smoke jobs
43+
cover the supply-chain check without needing the secret.
44+
45+
### Housekeeping
46+
47+
- `.gitignore` reorganized into labeled sections with sorted entries. Added `.context/`
48+
(Conductor workspace scratch), `coverage.xml`, `.pytest_cache/`, and vim swap files
49+
(`*.swp`, `*.swo`) for completeness. Dropped a stray `*.cpython-312.pyc\`` line that
50+
had a literal-backtick typo (it wasn't matching anything, and `*.pyc` already covers
51+
it).
52+
- Backfilled missing CHANGELOG entries for `2.2.81`, `2.2.85`, `2.2.86`, `2.2.88`,
53+
`2.2.89`, `2.2.91`, and `2.2.92` (the previous backfill in #180 covered
54+
`2.2.74`-`2.2.80`).
55+
56+
## 2.2.92
57+
58+
- Fixed dependency-overview rendering for unmapped alert types: alert types the SDK
59+
has no metadata for now fall back to a humanized Title-Cased label (e.g.
60+
`gptDidYouMean` -> "Possible typosquat attack (GPT)", `SQLInjection` -> "SQL
61+
Injection") instead of surfacing the raw camelCase identifier.
62+
63+
## 2.2.91
64+
65+
- Added legal/compliance artifact presets (`--legal`) and FOSSA-compatible output
66+
shapes (`--legal-format fossa`) for license and SBOM reporting.
67+
368
## 2.2.90
469

570
- Migrated license enrichment PURL lookup to the org-scoped endpoint (`POST /v0/orgs/{slug}/purl`) from the deprecated global endpoint (`POST /v0/purl`).
671

72+
## 2.2.89
73+
74+
- Added `uv.lock` to the version-incrementation CI check so a `pyproject.toml` /
75+
`__init__.py` version bump without a matching lockfile sync no longer slips through.
76+
- Updated the local Python pre-commit hook to keep `uv.lock` in sync with
77+
`pyproject.toml` and `socketsecurity/__init__.py` version changes automatically.
78+
79+
## 2.2.88
80+
81+
- Added `bun.lock`, `bun.lockb`, and `vlt-lock.json` to the recognized manifest files
82+
for Socket scanning, with matching unit-test coverage.
83+
84+
## 2.2.86
85+
86+
- Bumped `socketdev` to `>=3.0.33,<4.0.0` to pick up the SDK fix for unknown alert
87+
categories (the SDK previously crashed while deserializing diff alerts when the API
88+
returned a category like `"other"`).
89+
- Normalized diff artifacts with `score=None` to an empty score map in the CLI model
90+
layer; PR-comment dependency-overview rendering no longer crashes on missing or
91+
partial score data.
92+
- Defaulted missing badge values to a valid `100%` fallback rather than producing
93+
invalid badge URLs.
94+
95+
## 2.2.85
96+
97+
- Added four hidden `--reach-continue-on-*` flags in preparation for Coana CLI v15:
98+
`--reach-continue-on-analysis-errors`, `--reach-continue-on-install-errors`,
99+
`--reach-continue-on-missing-lock-files`, `--reach-continue-on-no-source-files`.
100+
Each forwards to the matching Coana flag and opts out of one of Coana v15's new
101+
halt-by-default behaviors. No-op against today's default Coana version; will take
102+
effect automatically once Coana v15 becomes the default.
103+
7104
## 2.2.83
8105

9106
- Fixed branch detection in detached-HEAD CI checkouts. When `git name-rev --name-only HEAD` returned an output with a suffix operator (e.g. `remotes/origin/master~1`, `master^0`), the `~N`/`^N` was previously passed through as the branch name and rejected by the Socket API as an invalid Git ref. The suffix is now stripped before the prefix split, producing the bare branch name.
10107

108+
## 2.2.81
109+
110+
- Fixed GitLab security report schema compliance: corrected schema validation errors so
111+
Socket-produced reports parse cleanly under GitLab's dependency-scanning ingestion.
112+
- Populated scan alert data in the GitLab security report so previously-empty alert
113+
sections now carry the expected findings.
114+
11115
## 2.2.80
12116

13117
- Hardened GitHub Actions workflows.

‎pyproject.toml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
66

77
[project]
88
name = "socketsecurity"
9-
version = "2.2.92"
9+
version = "2.2.93"
1010
requires-python = ">= 3.11"
1111
license = {"file" = "LICENSE"}
1212
dependencies = [

‎socketsecurity/__init__.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
11
__author__ = 'socket.dev'
2-
__version__ = '2.2.92'
2+
__version__ = '2.2.93'
33
USER_AGENT = f'SocketPythonCLI/{__version__}'

0 commit comments

Comments
 (0)