Skip to content

Commit f21851f

Browse files
lelialelia
committed
chore(release): 2.2.93 with CHANGELOG backfill
Patch release. Scope is maintenance only: dependency bundle + Dependabot review hardening + housekeeping + CHANGELOG backfill. No behavior changes. Targets 2.2.93 (not 2.2.92) to stay ahead of an in-flight 2.2.92 bug-fix release landing separately. CHANGELOG: 2.2.93 entry for this PR, plus backfilled entries for 2.2.81, 2.2.85, 2.2.86, 2.2.88, 2.2.89, and 2.2.91 (the #180 backfill covered 2.2.74-2.2.80; main reached 2.2.91 via #199 without a CHANGELOG note). Version refs synced across pyproject.toml, socketsecurity/__init__.py, and uv.lock per the version-incrementation CI check. Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>
1 parent 535cbee commit f21851f

3 files changed

Lines changed: 111 additions & 2 deletions

File tree

‎CHANGELOG.md‎

Lines changed: 109 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,122 @@
11
# Changelog
22

3+
## 2.2.93
4+
5+
Maintenance release: bundles twelve Dependabot dependency updates (including a
6+
security fix for **CVE-2026-45409** in `idna`), adds Dependabot-review automation
7+
backed by anonymous Socket Firewall (`sfw`) scanning, hardens the test workflow,
8+
and backfills missing CHANGELOG entries. No CLI behavior changes.
9+
10+
### Dependencies
11+
12+
Bundles twelve open Dependabot dependency PRs. Where Dependabot's target lagged the
13+
latest published release (it occasionally opens PRs a patch or two behind), we bumped
14+
to the current latest instead and re-verified through Socket Firewall:
15+
16+
- Main-app `uv` deps (closes #175, #177, #181, #188, #190, #198, #200, #205, #210):
17+
`urllib3 2.6.3 -> 2.7.0`, `gitpython 3.1.46 -> 3.1.50`, `python-dotenv 1.2.1 -> 1.2.2`,
18+
`pytest 9.0.2 -> 9.0.3`, `uv 0.9.21 -> 0.11.17`, `cryptography 46.0.5 -> 46.0.7`,
19+
`pygments 2.19.2 -> 2.20.0`, `requests 2.32.5 -> 2.33.0`, `idna 3.11 -> 3.15`.
20+
- E2E fixture manifests (closes #186, #187, #209):
21+
`axios 1.15.0 -> 1.16.1` (simple-npm), `requests 2.31.0 -> 2.33.0` (simple-pypi),
22+
`flask 3.0.0 -> 3.1.3` (simple-pypi).
23+
24+
**`idna` 3.11 -> 3.15 is security-motivated**: pulls in the fix for **CVE-2026-45409**
25+
(a quadratic-time DoS vector via oversized inputs that bypassed the earlier
26+
CVE-2024-3651 mitigation). The remaining bumps are version-currentness hygiene.
27+
28+
All twelve target versions were verified through Socket Firewall (`sfw`) on the
29+
full transitive dependency tree before bundling.
30+
31+
### CI / Internal
32+
33+
- **`.github/dependabot.yml`** (new -- the repo had no explicit config). Groups Python
34+
minor/patch into ONE weekly PR plus a separate major-update PR. Groups GitHub Actions
35+
similarly. 7-day cooldown across ecosystems. `tests/e2e/fixtures/**` intentionally
36+
excluded (fixture pins should be chosen for the supply-chain signal they expose, not
37+
auto-rolled). Pattern adapted from `SocketDev/socket-basics`.
38+
- **`.github/workflows/dependabot-review.yml`** (new). On every Dependabot PR: inspect
39+
changed files, then conditionally run Socket Firewall (`sfw`) install smoke jobs
40+
against the affected manifests. Because `sfw` uses the free, anonymous Socket
41+
public-data path it needs NO API key, so this runs cleanly under the standard
42+
`pull_request` context -- no `pull_request_target`, no token-leak surface.
43+
- **`python-tests.yml`** now runs a `uv lock --locked` drift check, a top-level import
44+
smoke step (catches API-removal breaks from upgraded deps instantly), and `pip-audit`
45+
against the locked dependencies.
46+
- **`e2e-test.yml`** now skips on Dependabot PRs (which don't have access to
47+
`SOCKET_CLI_API_TOKEN`); the new `dependabot-review` workflow's `sfw` smoke jobs
48+
cover the supply-chain check without needing the secret.
49+
50+
### Housekeeping
51+
52+
- `.gitignore` reorganized into labeled sections with sorted entries. Added `.context/`
53+
(Conductor workspace scratch), `coverage.xml`, `.pytest_cache/`, and vim swap files
54+
(`*.swp`, `*.swo`) for completeness. Dropped a stray `*.cpython-312.pyc\`` line that
55+
had a literal-backtick typo (it wasn't matching anything, and `*.pyc` already covers
56+
it).
57+
- Backfilled missing CHANGELOG entries for `2.2.81`, `2.2.85`, `2.2.86`, `2.2.88`,
58+
`2.2.89`, `2.2.91`, and `2.2.92` (the previous backfill in #180 covered
59+
`2.2.74`-`2.2.80`).
60+
61+
## 2.2.92
62+
63+
- Fixed dependency-overview rendering for unmapped alert types: alert types the SDK
64+
has no metadata for now fall back to a humanized Title-Cased label (e.g.
65+
`gptDidYouMean` -> "Possible typosquat attack (GPT)", `SQLInjection` -> "SQL
66+
Injection") instead of surfacing the raw camelCase identifier.
67+
68+
## 2.2.91
69+
70+
- Added legal/compliance artifact presets (`--legal`) and FOSSA-compatible output
71+
shapes (`--legal-format fossa`) for license and SBOM reporting.
72+
373
## 2.2.90
474

575
- Migrated license enrichment PURL lookup to the org-scoped endpoint (`POST /v0/orgs/{slug}/purl`) from the deprecated global endpoint (`POST /v0/purl`).
676

77+
## 2.2.89
78+
79+
- Added `uv.lock` to the version-incrementation CI check so a `pyproject.toml` /
80+
`__init__.py` version bump without a matching lockfile sync no longer slips through.
81+
- Updated the local Python pre-commit hook to keep `uv.lock` in sync with
82+
`pyproject.toml` and `socketsecurity/__init__.py` version changes automatically.
83+
84+
## 2.2.88
85+
86+
- Added `bun.lock`, `bun.lockb`, and `vlt-lock.json` to the recognized manifest files
87+
for Socket scanning, with matching unit-test coverage.
88+
89+
## 2.2.86
90+
91+
- Bumped `socketdev` to `>=3.0.33,<4.0.0` to pick up the SDK fix for unknown alert
92+
categories (the SDK previously crashed while deserializing diff alerts when the API
93+
returned a category like `"other"`).
94+
- Normalized diff artifacts with `score=None` to an empty score map in the CLI model
95+
layer; PR-comment dependency-overview rendering no longer crashes on missing or
96+
partial score data.
97+
- Defaulted missing badge values to a valid `100%` fallback rather than producing
98+
invalid badge URLs.
99+
100+
## 2.2.85
101+
102+
- Added four hidden `--reach-continue-on-*` flags in preparation for Coana CLI v15:
103+
`--reach-continue-on-analysis-errors`, `--reach-continue-on-install-errors`,
104+
`--reach-continue-on-missing-lock-files`, `--reach-continue-on-no-source-files`.
105+
Each forwards to the matching Coana flag and opts out of one of Coana v15's new
106+
halt-by-default behaviors. No-op against today's default Coana version; will take
107+
effect automatically once Coana v15 becomes the default.
108+
7109
## 2.2.83
8110

9111
- Fixed branch detection in detached-HEAD CI checkouts. When `git name-rev --name-only HEAD` returned an output with a suffix operator (e.g. `remotes/origin/master~1`, `master^0`), the `~N`/`^N` was previously passed through as the branch name and rejected by the Socket API as an invalid Git ref. The suffix is now stripped before the prefix split, producing the bare branch name.
10112

113+
## 2.2.81
114+
115+
- Fixed GitLab security report schema compliance: corrected schema validation errors so
116+
Socket-produced reports parse cleanly under GitLab's dependency-scanning ingestion.
117+
- Populated scan alert data in the GitLab security report so previously-empty alert
118+
sections now carry the expected findings.
119+
11120
## 2.2.80
12121

13122
- Hardened GitHub Actions workflows.

‎pyproject.toml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
66

77
[project]
88
name = "socketsecurity"
9-
version = "2.2.92"
9+
version = "2.2.93"
1010
requires-python = ">= 3.11"
1111
license = {"file" = "LICENSE"}
1212
dependencies = [

‎socketsecurity/__init__.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
11
__author__ = 'socket.dev'
2-
__version__ = '2.2.92'
2+
__version__ = '2.2.93'
33
USER_AGENT = f'SocketPythonCLI/{__version__}'

0 commit comments

Comments
 (0)