chore(release): 3.1.0 - #109
Merged
Merged
Conversation
Socket npm CLI 1.1.154 -> 1.1.165 across all three images, matching the current npm release. Socket Python CLI 2.6.3 -> 2.7.0 in the heavy and app-tests images. 2.7.0 is NOT published to PyPI yet (latest is 2.6.11), so this is scaffolding: the heavy and app-tests image builds and core-tool-watch both fail until it lands. Keep this commit separate so it can be dropped or held if the CLI release slips. The socketdev Python SDK is already current at 3.5.0, so no change.
Version metadata, uv.lock, CHANGELOG date stamp, and 74 current-release documentation references, via scripts/prep_release.py --version 3.1.0.
lelia
had a problem deploying
to
socket-firewall
September 2, 2026 23:01 — with 
GitHub Actions
Failure
GitHub Actions
Failure
This install pins an exact version, so a stale cached uv index response makes a freshly published release look like it does not exist. Use --refresh-package for just this package rather than --no-cache, which would discard the cache mount's benefit for bandit and built wheels. Dockerfile.heavy already passes --no-cache-dir on its pip equivalent.
The assertion matched an exact literal, so it broke when the install gained a --refresh-package flag and a line continuation even though the version pin it guards was unchanged. Collapse continuations and match the ARG-pinned spec after 'uv tool install' instead. Verified the guard still fails for an unpinned spec and for a hardcoded version that bypasses the ARG.
David Larsen (dc-larsen)
approved these changes
Sep 2, 2026
David Larsen (dc-larsen)
left a comment
David Larsen (dc-larsen)
left a comment
Contributor
There was a problem hiding this comment.
Approved. Verified this is release plumbing only:
- Version bump 3.0.0 → 3.1.0 across
pyproject.toml,socket_basics/version.py,uv.lock,action.ymlimage tag - Socket-owned pin refresh only (npm CLI 1.1.154 → 1.1.165, Python CLI 2.6.3 → 2.7.0); OpenGrep/TruffleHog drift left alone as stated
- Doc/README reference sync, no third-party pins rewritten
app_tests/Dockerfile--refresh-package socketsecurityis the right fix for the stale index-metadata failure on a freshly published pin, and it's scoped to one package rather than dropping the cache mounttests/test_check_core_tools.pystill asserts the exact pin; only the line-continuation sensitivity was removed- CHANGELOG matches the merged behavior, including the
changed_filesfail-vs-green change that justifies MINOR - 17/17 checks passing
MINOR is the correct bump: new declared inputs plus a previously-green pipeline that can now fail.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Cuts 3.1.0, bundling everything merged since the
v3.0.0tag: #97, #98, #104, #105, #106, plus Dependabot #107/#108, and a refresh of the Socket-owned tool pins.Why minor, not patch
Two independent reasons:
pr_comment_enabledandpr_comment_collapse_allaction inputs, and fix: changed_files resolved to zero files in the Docker container action (git dubious ownership) #105 promotesscan_allto a declared input. New backward-compatible functionality is a MINOR bump.changed_filesscope is now a configuration error rather than a silent green run. A patch release should be a safe drop-in; this isn't one for anyone whose diff-only setup is quietly broken.Changes
c52aed6CHANGELOG.mdentry for the bundled release1306abb3f0ed2aprep_release.pyoutput — version metadata,uv.lock, 74 doc references493add1socketsecurityindex metadata on installaf893edRUN's formattingTool pins
Everything Socket controls is now current:
socket)socketsecurity)Non-Socket drift (OpenGrep
v1.26.0→v1.29.0, TruffleHog3.96.0→v3.97.2) is not addressed here — deliberately out of scope for this release.Testing
uv run --no-sync pytest -q— 339 passeduv lock --locked— cleanpython3 scripts/sync_release_version.py --check— in sync at 3.1.0python3 scripts/check_release_docs.py --check— in sync at 3.1.0python3 scripts/check_core_tools.py --mode watch— confirms the pin states aboveChangelog accuracy
The
changed_filesentries were written against the merged code rather than the pre-merge PR descriptions, since #98 was rebased onto #105's design after the fact. Two claims that would otherwise have been carried over are corrected:scan_allwidening is not partial — every enabled scanner widens consistently on the failure path.scan_allno longer overrides a successfully resolvedchanged_filesscope; the resolved scope is now authoritative, which reverses the earlier precedence.Release checklist
python3 scripts/prep_release.py --version 3.1.0completed successfullyuv.lockare synchronizedCHANGELOG.mdcontains reviewed, human-authored notes for this version