chore(deps): refresh bundled tool pins and make them Dependabot-readable

.github/dependabot.yml

@@ -8,8 +8,12 @@
 # - Python deps (idna, urllib3, pygments, pytest, ...) are uv-tracked via
 #   uv.lock — the `uv` ecosystem governs them. Without this entry the uv PRs
 #   pile up ungrouped.
-# - The two Dockerfiles track their pinned tool/base images; OPENGREP_VERSION
-#   is NOT Dependabot-trackable (no Docker image) — bump it manually.
+# - The Dockerfiles track their base and tool images, which is why those are
+#   pinned as literal tags on the FROM lines: Dependabot's Dockerfile parser
+#   does no ARG substitution, so a `FROM image:${VERSION}` line is matched with
+#   no version and skipped entirely. Anything installed by a script or package
+#   manager (opengrep, gosec, the two Socket CLIs) has no FROM line at all and
+#   is bumped by hand — `scripts/check_core_tools.py` reports that drift.
 # - GitHub Actions scans the workflows AND the local composite actions under
 #   /.github/actions/*.
 
@@ -44,12 +48,15 @@ updates:
       default-days: 7
 
   # Main Dockerfile — tracks trufflesecurity/trufflehog, ghcr.io/astral-sh/uv,
-  # and the python base image.
-  # NOTE: OPENGREP_VERSION is not trackable via Dependabot (no Docker image);
-  #       update it manually in the Dockerfile ARG.
+  # and the python base image. Covers Dockerfile.heavy too: both live at the
+  # repo root, and the docker ecosystem scans every Dockerfile* in a directory.
+  # NOTE: opengrep and the Socket CLIs are installed by script/npm/pip, so they
+  #       have no FROM line to track; update those ARGs manually.
   # NOTE: trivy is deliberately NOT tracked here — it comes from Socket's own
   #       build (ghcr.io/socketdev/trivy, digest-pinned) and is updated by that
-  #       release process, never bumped independently.
+  #       release process, never bumped independently. It is also the one image
+  #       still referenced as `FROM ${TRIVY_IMAGE}`, which Dependabot cannot
+  #       parse — that is the intent, not an oversight.
   - package-ecosystem: "docker"
     directory: "/"
     schedule:
@@ -80,7 +87,9 @@ updates:
     cooldown:
       default-days: 7
 
-  # app_tests Dockerfile — same as above, plus golang and securego/gosec.
+  # app_tests Dockerfile — same as above, plus golang and node.
+  # NOTE: gosec is installed by a shell script, not a FROM line, so it cannot be
+  #       tracked here; bump GOSEC_VERSION manually.
   - package-ecosystem: "docker"
     directory: "/app_tests"
     schedule:
@@ -89,7 +98,8 @@ updates:
     allow:
       - dependency-name: "python"
       - dependency-name: "golang"
-      - dependency-name: "securego/gosec"
+      - dependency-name: "node"
+      - dependency-name: "ghcr.io/astral-sh/uv"
       - dependency-name: "trufflesecurity/trufflehog"
     groups:
       docker-app-tests-minor-patch:

CHANGELOG.md

@@ -8,15 +8,42 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
-### Changed
+### Upgrade notes
+- **Socket Tier 1 needs outbound access to `api.socket.dev` and
+  `storage.googleapis.com`.** Socket npm CLI 1.9.0 and later download the
+  Coana reachability engine from Socket instead of npm, with no npm fallback.
+  An npm mirror no longer covers it, `SOCKET_CLI_COANA_LAUNCHER` has no
+  effect, and a `--reach-version` older than the move fails. The heavy image's
+  Python CLI made the same change in 2.11.1, which shipped in 3.4.1. See
+  [Network access for Tier 1](docs/parameters.md#network-access-for-tier-1).
 
+### Changed
+- The images set `NODE_USE_ENV_PROXY=1`, so Socket Tier 1 honors `HTTPS_PROXY`
+  and `NO_PROXY`. The Socket npm CLI does not apply `HTTPS_PROXY` to its own
+  requests, and Tier 1 behind a proxy failed with `getaddrinfo EAI_AGAIN
+  api.socket.dev`. Node only acts on it when a proxy variable is set. Native
+  installs need it set by hand.
 - **Behavior change:** `socket_additional_params` now uses shell-style,
   space-separated arguments and preserves commas within argument values. A
   comma acts as a legacy separator only when it is unquoted and followed by a
   hyphen (normally another option). Configurations that used commas as general
   separators (for example, `--view,full`) must use a space or `=` instead. Repeat
   list-valued flags, such as
   `--exclude-paths=tests --exclude-paths=fixtures`.
+- Bundled tools: OpenGrep v1.26.0 -> v1.33.1, TruffleHog 3.96.0 -> 3.99.8,
+  Socket npm CLI 1.1.165 -> 1.14.0, Socket Python CLI 2.11.3 -> 2.11.11, uv
+  0.12.1 -> 0.13.7; in the app-tests image, gosec v2.28.0 -> v2.30.0 and Go
+  1.26.5 -> 1.27.3. Java SAST benchmark results are unchanged on OpenGrep 1.33.1.
+- Socket Python SDK (`socketdev`) 3.6.1 -> 3.6.2, which Socket Python CLI
+  2.11.11 pins exactly. Source installs now require `socketdev>=3.6.2`.
+- TruffleHog no longer reports AppOptics or Bing Subscription Key credentials;
+  upstream retired both detectors in 3.97.0.
+- Base and tool images are pinned as literal `FROM` tags so Dependabot can
+  update them. `--build-arg TRUFFLEHOG_VERSION` no longer has any effect.
+
+### Fixed
+- TruffleHog 3.99.8 is built on Go 1.27.3, clearing the CVE-2026-111943
+  finding noted in 3.4.1.
 
 ## [3.4.1] - 2026-10-21
 

Dockerfile

@@ -1,41 +1,45 @@
-# ─── Global version pins (single source of truth) ────────────────────────────
-# Dependabot tracks all ARGs below via the FROM lines that reference them.
-# To override at build time: docker build --build-arg TRUFFLEHOG_VERSION=3.93.8 .
+# ─── Pinned build inputs ──────────────────────────────────────────────────────
+# Two kinds of pin live in this file, and they look different because Dependabot
+# can only read one of them.
 #
-# Dependabot-trackable (each has a corresponding FROM <image>:<ARG> stage):
-ARG PYTHON_VERSION=3.12
-ARG TRUFFLEHOG_VERSION=3.96.0
-ARG UV_VERSION=0.12.1
+# 1. Images are pinned as literal tags on the FROM lines below. Dependabot's
+#    Dockerfile parser is a regex over FROM lines whose image and tag groups
+#    both require literal characters (`[a-z\d]` / `[\w]`); it does no ARG
+#    substitution, so `FROM image:${VERSION}` and `FROM ${IMAGE}` are matched
+#    with no version and silently skipped. Carrying the version inline is the
+#    only form it updates. To use a different tag locally, edit the FROM line.
 #
-# NOT Dependabot-trackable (no official Docker image with a stable binary path):
-ARG OPENGREP_VERSION=v1.26.0
-ARG SOCKET_NPM_CLI_VERSION=1.1.165
+# 2. Tools installed by a script or package manager have no FROM line for
+#    Dependabot to read, so they keep an ARG pin and are bumped by hand. These
+#    stay overridable: docker build --build-arg OPENGREP_VERSION=v1.33.1 .
+ARG OPENGREP_VERSION=v1.33.1
+ARG SOCKET_NPM_CLI_VERSION=1.14.0
 #
-# NOT Dependabot-trackable — Socket-built Trivy, rebuilt from unmodified upstream
-# source and published by Socket's own release pipeline. Pinned by digest; both
-# ARGs are updated together by that release process, never bumped independently.
-# Building requires pull access to the registry; contributors without it can
-# override, e.g.: docker build --build-arg TRIVY_IMAGE=aquasec/trivy:0.76.1 .
-# TRIVY_VERSION feeds the image label — keep it in sync with the TRIVY_IMAGE tag.
-# -socket.N is a trivy-dist toolchain rebuild: same upstream source, newer Go.
+# 3. Socket-built Trivy, rebuilt from unmodified upstream source and published
+#    by Socket's own release pipeline. Deliberately kept out of Dependabot's
+#    reach: it is pinned by digest and both ARGs move together with that
+#    release process, never independently. Building requires pull access to the
+#    registry; contributors without it can override, e.g.:
+#    docker build --build-arg TRIVY_IMAGE=aquasec/trivy:0.76.1 .
+#    TRIVY_VERSION feeds the image label — keep it in sync with the tag.
+#    -socket.N is a trivy-dist toolchain rebuild: same upstream source, newer Go.
 ARG TRIVY_VERSION=0.76.1
 ARG TRIVY_IMAGE=ghcr.io/socketdev/trivy:0.76.1@sha256:883da3593a60e311b2ed87c3a55241051b27bba15ffc3ce041ae570cd0f00915
 
 # ─── Stage: trivy (Socket-built redistribution) ───────────────────────────────
 FROM ${TRIVY_IMAGE} AS trivy
 
-# ─── Stage: trufflehog (Dependabot-trackable) ─────────────────────────────────
-FROM trufflesecurity/trufflehog:${TRUFFLEHOG_VERSION} AS trufflehog
+# ─── Stage: trufflehog ────────────────────────────────────────────────────────
+FROM trufflesecurity/trufflehog:3.99.8 AS trufflehog
 
-# ─── Stage: uv (Dependabot-trackable) ─────────────────────────────────────────
+# ─── Stage: uv ────────────────────────────────────────────────────────────────
 # Named stage required — COPY --from does not support ARG variable expansion.
-FROM ghcr.io/astral-sh/uv:${UV_VERSION} AS uv
+FROM ghcr.io/astral-sh/uv:0.13.7 AS uv
 
 # ─── Stage: opengrep-installer ────────────────────────────────────────────────
 # OpenGrep does not publish an official Docker image with a stable binary path,
 # so we install via their official script in a dedicated build stage.
-# NOTE: OPENGREP_VERSION is not Dependabot-trackable; update manually above.
-FROM python:${PYTHON_VERSION}-slim AS opengrep-installer
+FROM python:3.12-slim AS opengrep-installer
 ARG OPENGREP_VERSION
 RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
     --mount=type=cache,target=/var/lib/apt,sharing=locked \
@@ -45,7 +49,7 @@ RUN curl -fsSL https://raw.githubusercontent.com/opengrep/opengrep/main/install.
     | bash -s -- -v "${OPENGREP_VERSION}"
 
 # ─── Stage: runtime ───────────────────────────────────────────────────────────
-FROM python:${PYTHON_VERSION}-slim AS runtime
+FROM python:3.12-slim AS runtime
 
 WORKDIR /socket-basics
 
@@ -76,6 +80,10 @@ RUN curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \
 ARG SOCKET_NPM_CLI_VERSION
 RUN --mount=type=cache,target=/root/.npm \
     npm install -g "socket@${SOCKET_NPM_CLI_VERSION}"
+# The Socket CLI does not send its requests through HTTPS_PROXY on its own.
+# This makes Node apply HTTPS_PROXY, HTTP_PROXY and NO_PROXY, and does nothing
+# when none of them is set.
+ENV NODE_USE_ENV_PROXY=1
 
 # Python project files
 COPY socket_basics  /socket-basics/socket_basics
@@ -92,8 +100,11 @@ ARG SOCKET_BASICS_VERSION=dev
 ARG VCS_REF=unknown
 ARG BUILD_DATE=unknown
 ARG TRIVY_VERSION
-ARG TRUFFLEHOG_VERSION
 ARG OPENGREP_VERSION
+# Mirrors the trufflehog FROM tag above. A literal FROM tag cannot be read back
+# into an ARG, so this is the one pin stated twice;
+# tests/test_dockerfile_pins.py fails if the two ever disagree.
+ARG TRUFFLEHOG_VERSION=3.99.8
 ARG SOCKET_NPM_CLI_VERSION
 LABEL org.opencontainers.image.title="Socket Basics" \
       org.opencontainers.image.source="https://github.com/SocketDev/socket-basics" \

Dockerfile.heavy

@@ -1,18 +1,19 @@
 # Heavy POC image: socket-basics plus a pinned stable Python Socket CLI.
-ARG PYTHON_VERSION=3.12
-ARG TRUFFLEHOG_VERSION=3.96.0
-ARG UV_VERSION=0.12.1
-ARG OPENGREP_VERSION=v1.26.0
-ARG SOCKET_NPM_CLI_VERSION=1.1.165
-ARG SOCKET_PYTHON_CLI_VERSION=2.11.3
+#
+# Images are pinned as literal FROM tags so Dependabot can read them; tools
+# installed by a script or package manager keep an ARG pin and are bumped by
+# hand. See the note at the top of ./Dockerfile for why.
+ARG OPENGREP_VERSION=v1.33.1
+ARG SOCKET_NPM_CLI_VERSION=1.14.0
+ARG SOCKET_PYTHON_CLI_VERSION=2.11.11
 # Socket-built Trivy, pinned by digest — see the note in ./Dockerfile.
 ARG TRIVY_IMAGE=ghcr.io/socketdev/trivy:0.76.1@sha256:883da3593a60e311b2ed87c3a55241051b27bba15ffc3ce041ae570cd0f00915
 
 FROM ${TRIVY_IMAGE} AS trivy
-FROM trufflesecurity/trufflehog:${TRUFFLEHOG_VERSION} AS trufflehog
-FROM ghcr.io/astral-sh/uv:${UV_VERSION} AS uv
+FROM trufflesecurity/trufflehog:3.99.8 AS trufflehog
+FROM ghcr.io/astral-sh/uv:0.13.7 AS uv
 
-FROM python:${PYTHON_VERSION}-slim AS opengrep-installer
+FROM python:3.12-slim AS opengrep-installer
 ARG OPENGREP_VERSION
 RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
     --mount=type=cache,target=/var/lib/apt,sharing=locked \
@@ -21,7 +22,7 @@ RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
 RUN curl -fsSL https://raw.githubusercontent.com/opengrep/opengrep/main/install.sh \
     | bash -s -- -v "${OPENGREP_VERSION}"
 
-FROM python:${PYTHON_VERSION}-slim AS runtime
+FROM python:3.12-slim AS runtime
 
 WORKDIR /socket-basics
 
@@ -49,6 +50,8 @@ RUN curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \
 ARG SOCKET_NPM_CLI_VERSION
 RUN --mount=type=cache,target=/root/.npm \
     npm install -g "socket@${SOCKET_NPM_CLI_VERSION}"
+# Routes the Socket CLI through HTTPS_PROXY; see the note in ./Dockerfile.
+ENV NODE_USE_ENV_PROXY=1
 
 COPY socket_basics  /socket-basics/socket_basics
 COPY pyproject.toml README.md LICENSE uv.lock /socket-basics/
@@ -68,8 +71,9 @@ RUN chmod +x /usr/local/bin/docker-heavy-entrypoint.sh
 ARG SOCKET_BASICS_VERSION=dev
 ARG VCS_REF=unknown
 ARG BUILD_DATE=unknown
-ARG TRUFFLEHOG_VERSION
 ARG OPENGREP_VERSION
+# Mirrors the trufflehog FROM tag above; see the note in ./Dockerfile.
+ARG TRUFFLEHOG_VERSION=3.99.8
 ARG SOCKET_NPM_CLI_VERSION
 ARG SOCKET_PYTHON_CLI_VERSION
 LABEL org.opencontainers.image.title="Socket Basics Heavy" \

README.md

@@ -209,6 +209,11 @@ The API key is read from the environment (`SOCKET_SECURITY_API_KEY`; there is de
 
 **For GitHub Actions & Docker:** No local installation needed for the supported bundled scanners.
 
+**Network access:** Socket Tier 1 downloads its reachability engine at run time
+from `api.socket.dev` and `storage.googleapis.com`, not from npm, and installs
+dependencies from each scanned ecosystem's registry. Allow these hosts on
+restricted networks. See [Network access for Tier 1](docs/parameters.md#network-access-for-tier-1).
+
 **For Local Installation:**
 - Python 3.10+
 - [Socket CLI](https://docs.socket.dev/docs/cli) (for dependency analysis)
@@ -273,6 +278,12 @@ Add new connectors by:
 **Workflow inputs have no effect, or Dockerfile and image scanning finds nothing:**
 - If the log shows `Loaded Socket Basics API configuration (overrides environment defaults)`, the dashboard configuration took precedence over your inputs, blank fields included (see [Dashboard Settings and Workflow Inputs](docs/github-action.md#dashboard-settings-and-workflow-inputs))
 
+**Socket Tier 1 fails, or reports `INSTALL ERROR` instead of reachability results:**
+- `Failed to get the Coana CLI`: allow `api.socket.dev` and `storage.googleapis.com`; an npm mirror does not cover the engine download. `getaddrinfo EAI_AGAIN api.socket.dev` behind a proxy in a native install means `NODE_USE_ENV_PROXY=1` is missing next to `HTTPS_PROXY`; the images set it (see [Network access for Tier 1](docs/parameters.md#network-access-for-tier-1))
+- `INSTALL ERROR` on every vulnerability: allow the scanned ecosystem's package registry, or install dependencies in the workspace before scanning
+- A Tier 1 failure does not change the scan's exit code; look for `Error running connector socket_tier1` in the log
+- Remove `--reach-version` from `socket_additional_params` if it pins an engine version older than the Socket CLI supports
+
 **Notifier errors:**
 - Check that notification credentials (Slack webhook, Jira token, etc.) are properly configured
 - Remember: Notifiers require Socket Enterprise