[lelia]

Refreshes every bundled tool pin to its latest release, makes the image pins readable by Dependabot so they stop going stale, documents Socket Tier 1's new network requirements, and makes Tier 1 work behind an HTTP(S) proxy. This PR now owns every dependency and toolchain bump for 3.5.0; #134 is pure release prep.

Pins

Tool	main	This PR	Images
OpenGrep	v1.26.0	v1.33.1	all three
TruffleHog	3.96.0	3.99.8	all three
Socket npm CLI	1.1.165	1.14.0	all three
Socket Python CLI	2.11.3	2.11.11 (moved from #134)	heavy, app-tests
Socket Python SDK	3.6.1	3.6.2 (moved from #134)	standard, heavy, source installs
uv	0.12.1	0.13.7	all three
gosec	v2.28.0	v2.30.0	app-tests
Go	1.26.5	1.27.3	app-tests

Trivy 0.76.1 is already current on main (#128). socketdev moves here because socketsecurity==2.11.11 pins socketdev==3.6.2 exactly; split across PRs, the heavy image would run 3.6.2 in its system interpreter and 3.6.1 in the locked venv. The source-install floor rises to socketdev>=3.6.2. Python 3.12 and Node 22 are intentional major-line pins.

Dependabot fix

Dependabot's Dockerfile parser (shared_file_parser.rb) does no ARG substitution, so FROM image:${VERSION} lines are matched with no version and silently skipped. No Docker-ecosystem Dependabot PR has ever been opened here.

• Base and tool images are now literal FROM image:tag lines; the PYTHON_VERSION, UV_VERSION, GOLANG_VERSION and NODE_VERSION ARGs are gone.
• app-tests allow list adds node and ghcr.io/astral-sh/uv, drops securego/gosec (installed by script, no FROM line).
• check_core_tools.py and check_release_docs.py read the TruffleHog pin from its FROM line.
• tests/test_dockerfile_pins.py transcribes the upstream regexes and fails if a FROM line becomes unparseable, an image is missing from an allow list, or the TruffleHog label ARG drifts from its FROM tag.
• Trade-offs: --build-arg TRUFFLEHOG_VERSION no longer has any effect. FROM ${TRIVY_IMAGE} stays interpolated on purpose, since Socket's digest-pinned Trivy moves only with trivy-dist releases.

User-visible changes

• TruffleHog 3.97.0 retired the AppOptics and Bing Subscription Key detectors.
• TruffleHog 3.99.8 is built on Go 1.27.3, clearing the CVE-2026-111943 finding called out in 3.4.1.
• Tier 1 network requirements change. Socket npm CLI 1.9.0 and later fetch the Coana reachability engine from Socket instead of npm (feat: launch the Coana CLI from GCS instead of npm socket-cli#1629). The CLI gets a signed URL from api.socket.dev and downloads from storage.googleapis.com, with no npm fallback. SOCKET_CLI_COANA_LAUNCHER no longer has any effect, and a --reach-version older than the move fails. The heavy image's Python CLI made the same change in 2.11.0, which shipped undocumented in 3.4.1. This is now an upgrade note in the changelog and a new Network access for Tier 1 section (hosts, failure modes, proxy limitation, cache), linked from the action, Docker, local install and README docs, and verified with a live run below.

Tier 1 behind a proxy

All three images now set NODE_USE_ENV_PROXY=1. The Socket npm CLI doesn't apply HTTPS_PROXY to its own requests, so Tier 1 behind a proxy failed with getaddrinfo EAI_AGAIN api.socket.dev. With the variable set, Node applies HTTPS_PROXY, HTTP_PROXY and NO_PROXY, and it does nothing when none of them is set. This is beyond a pin refresh, but it came out of validating this PR, so it ships here. Verified with the rebuilt standard image: with only HTTPS_PROXY set, Tier 1 returns full results through the proxy, and the no-proxy run is unchanged. The CLI-side docs are SocketDev/socket-cli#1700 and SocketDev/socket-python-cli#441.

Verification

• pytest: 508 passed, 1 skipped (intended: app-tests has no TruffleHog label), with SOCKET_BASICS_REQUIRE_OPENGREP=1 on OpenGrep 1.33.1.

• OWASP BenchmarkJava (51f0a7c): 1.30.0 and 1.33.1 produce the same 1,527 findings; score is still 48.9 (precision 76.7%, recall 71.3%).

• check_release_docs.py --check in sync; docker build --check clean on all three Dockerfiles.

• Live Tier 1 run (standard image, real org, SKIP_SOCKET_SUBMISSION=1, npm project on lodash@4.17.15), with hostname allowlisting through a DNS sidecar:

  Allowed	Result
  everything	5 vulns: 1 reachable, 4 unreachable. Lookups: api.socket.dev, storage.googleapis.com, registry.npmjs.org
  api.socket.dev, storage.googleapis.com	reports success, but all 5 come back as INSTALL ERROR (no registry to install deps)
  same, with node_modules preinstalled	full results
  storage.googleapis.com blocked	Failed to get the Coana CLI 15.14.1: getaddrinfo ENOTFOUND storage.googleapis.com
  cache volume warm, storage.googleapis.com blocked	full results in 10 s, no engine download

  Repeated with the heavy image's Python CLI (socketcli 2.11.11 --reach): same three hosts and the same INSTALL ERROR degradation without the registry. With storage blocked it exits 3.

  Proxy behavior: the Socket npm CLI ignores HTTPS_PROXY and SOCKET_CLI_API_PROXY (1.1.165 behaves the same, so not a regression) and fails with getaddrinfo EAI_AGAIN api.socket.dev. Adding NODE_USE_ENV_PROXY=1 routes everything through the proxy, and a full Basics Tier 1 scan completes (1 reachable, 4 unreachable). socketcli honors HTTPS_PROXY on its own. A Basics Tier 1 failure leaves the scan's exit code at 0. All of this is now documented.

• Socket npm CLI 1.14.0: the rebuilt standard image reports socket 1.14.0, and a Tier 1 scan returns full results both directly and with only HTTPS_PROXY available. The other runs above used 1.13.1, which bundles the same Coana CLI (15.14.1).

• Heavy image built end to end with the documented TRIVY_IMAGE=aquasec/trivy:0.76.1 override. Inside it: opengrep 1.33.1, trufflehog 3.99.8, socket 1.13.1, socketcli 2.11.11, uv 0.13.7, Python 3.12.16, Node 22.23.4. The OCI labels match.

Merge order

#125 (merged) → this PR → #134. Rebased on main after #125; both [Unreleased] entries sit side by side. After this merges, #134 reruns prep_release.py to fold them into [3.5.0].

---

Note

Medium Risk
Bundled tool upgrades and Tier 1 network/proxy requirements affect customer egress and scan behavior; Dockerfile pin strategy changes build overrides but is mostly maintenance and supply-chain hygiene.

Overview
Refreshes bundled scanner and CLI versions across all Docker images and raises the source-install floor to socketdev>=3.6.2. TruffleHog 3.99.8 clears the Go CVE called out in 3.4.1; OpenGrep, Socket npm/Python CLIs, uv, gosec, and app-tests Go move to current pins with benchmark/docs updated accordingly.

Dependabot fix: Base and tool images (python, trufflehog, uv, golang, node) are now literal FROM image:tag lines because Dependabot does not substitute ARGs—interpolated FROM lines were silently skipped, so pins never moved. Script-installed tools (OpenGrep, gosec, Socket CLIs) stay on ARG pins; --build-arg TRUFFLEHOG_VERSION no longer affects the build. New tests/test_dockerfile_pins.py mirrors Dependabot’s parser and checks allow-lists; check_core_tools.py / check_release_docs.py read TruffleHog from its FROM tag.

Tier 1 behavior and ops: Documents that Socket npm CLI 1.9+ downloads the Coana engine from api.socket.dev and storage.googleapis.com (not npm). All three images set NODE_USE_ENV_PROXY=1 so Tier 1 works behind HTTPS_PROXY when the Socket CLI would otherwise ignore it. Changelog/README/action/Docker guides add upgrade notes, network egress, cache volume hints, and troubleshooting.

^{Reviewed by Cursor Bugbot for commit f4d92ab. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/​socketdev@​3.6.1 ⏵ 3.6.2	+1

View full report