chore(release): 3.0.0 - #102
Merged
Merged
Conversation
Version refs (version.py, __init__.py, pyproject.toml, action.yml image tag) and CHANGELOG entry only, per the release process. Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
uv.lock records the project's own version; uv sync --frozen fails on the pyproject mismatch without the regen. Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>
Contributor
Author
|
bugbot run |
Version ref bump folded into the release PR (was briefly #103). Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>
There was a problem hiding this comment.
✅ Bugbot reviewed your changes and found no new issues!
Comment @cursor review or bugbot run to trigger another review on this PR
Reviewed by Cursor Bugbot for commit 633dc93. Configure here.
Constraint + lock only; the core-tool-watch typed-params migration remains in #99, which rebases on this. Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>
Contributor
Author
|
bugbot run |
There was a problem hiding this comment.
✅ Bugbot reviewed your changes and found no new issues!
Comment @cursor review or bugbot run to trigger another review on this PR
Reviewed by Cursor Bugbot for commit d81cbc7. Configure here.
Douglas (dacoburn)
approved these changes
Aug 6, 2026
Adopts the post-outage CLI release bundling the final pending PRs, so 3.0.0 ships a current pin without needing a back-to-back Basics release. Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Self-contained release PR: version refs bumped
2.2.1→3.0.0(socket_basics/version.py,socket_basics/__init__.py,pyproject.toml,action.ymlimage tag,uv.lockself-version), the CHANGELOG entry, and same-day dependency pins that are effectively version refs too:pyproject.tomlconstraint>=3.5.0+uv.lockregen): today'ssocketdevSDK release exposing typed fail-closed batch purl parameters.Dockerfile.heavyimageSOCKET_CLI_VERSION): today'ssocketsecurityCLI release, so the heavy variant ships a current CLI pin.Why major: Trivy-backed scanning — intentionally disabled in the 2.x images after the upstream supply-chain incident — is deliberately re-enabled (via the Socket-built distribution, see #100). Configs with Trivy parameters will produce findings again, so gating pipelines may see new results on first run.
No remaining gates: this PR is complete as-is; merge → tag
v3.0.0.After tag: the publish run is the live validation of the environment-scoped Docker Hub secrets (repo-level ones deleted), the immutable version tags, and the
latest/latest-heavyaliases — verify, then done.Refs CE-361
Note
High Risk
Major release: consumers of the default Action image get re-enabled Trivy scanning and possible new gate failures; socketdev 3.5.0 may change fail-closed batch purl behavior for integrations using it.
Overview
Release 3.0.0 (
2.2.1→3.0.0): version strings inpyproject.toml,socket_basics/version.py,socket_basics/__init__.py, the GitHub Action default image inaction.yml(ghcr.io/socketdev/socket-basics:3.0.0), anduv.lockare aligned, with a full [3.0.0] entry added toCHANGELOG.md.Same-day dependency pins in this PR:
socketdev≥ 3.5.0 (lockfile regen) andsocketsecurity2.6.0 on the heavy image (Dockerfile.heavySOCKET_CLI_VERSION).Why major (per changelog, not new code in this diff): upgrading to the published 3.0.0 image re-enables Trivy-backed container/Dockerfile scanning that was off in 2.x; configs using
--images,--dockerfiles, or related Trivy settings should expect new findings on the first run after upgrade. Pipelines that gate on scan results should plan for that.Reviewed by Cursor Bugbot for commit d81cbc7. Configure here.