What's Changed

📦 Dependencies

• chore(deps): bump socketdev from 3.5.0 to 3.6.0 in the python-minor-patch group by Dependabot (@dependabot)[bot] in #117

🔧 Other Changes

• fix(sast): mask credential values in finding snippets by lelia in #119
• chore(release): 3.4.0 by lelia in #120

Full Changelog: v3.3.0...v3.4.0

What's Changed

🔧 Other Changes

• fix(notifications): read gh token param in PR notifier by lelia in #114
• feat(config): add --scan-all and --no-scan-all CLI flags by lelia in #115
• chore(release): 3.3.0 by lelia in #116

Full Changelog: v3.2.0...v3.3.0

What's Changed

🔧 Fixes + Improvements

• feat: align install guides with the CLI and declare the documented action inputs by lelia in #111
• fix: stop disabling TruffleHog verification for verified-only scans by lelia in #110
• fix(rules): improve precision and recall of java opengrep rules by David Larsen (@dc-larsen) in #112
• chore(release): 3.2.0 by lelia in #113

⚠️ Noteworthy Changes

Nothing here requires a configuration change, but you may experience different results on the first run after upgrading:

• TruffleHog secrets can now block a run. With trufflehog_show_unverified off (the default), the connector passed --no-verification, which disabled verification outright instead of filtering to verified results. Severity is derived from each finding's Verified flag, so every result came back unverified, low severity and non-blocking: on the default path no secret could ever block a run, the exact inverse of intent. Verification now always runs and the setting only selects result types, so a real leaked credential is reported as critical and blocking. (#110)
• TruffleHog verification reaches third-party endpoints. Verification is a live check: candidate credentials are sent to the issuing provider's validation endpoint on every scan. This is TruffleHog's own default behavior, but it is new for runs with trufflehog_show_unverified off. Egress restricted runners should account for it. (#110)
• A TruffleHog scan that cannot run now fails the run. A non-zero exit, a missing binary or a source error was logged and converted into an empty clean result, so a broken install or a malformed exclude pattern was indistinguishable from a repository with no secrets. These now fail with TruffleHog's exit code and stderr — the same fail-closed idiom as an unresolvable changed_files scope in 3.1.0. (#110)
• Java SAST findings shift substantially, in both directions. Twelve rules were rewritten (see Fixed). Existing Java baselines will lose most of their current findings and gain new ones at call sites the old patterns could never match, so re-baseline instead of diffing against a previous run. (#112)

Full Changelog: v3.1.0...v3.2.0

What's Changed

📦 Dependencies

• ci(deps): bump docker/setup-buildx-action from 4.2.0 to 4.3.0 in the github-actions-minor-patch group across 1 directory by Dependabot (@dependabot)[bot] in #108
• chore(deps): bump pyyaml from 6.0.2 to 6.0.3 in the python-minor-patch group by Dependabot (@dependabot)[bot] in #107

🔧 Other Changes

• fix(ci): harden core tool watch issue reconciliation by lelia in #104
• fix(release): keep documentation versions in sync by lelia in #106
• feat: add pr_comment_enabled and pr_comment_collapse_all PR comment controls by John-David Dalton (@jdalton) in #97
• fix: changed_files resolved to zero files in the Docker container action (git dubious ownership) by David Larsen (@dc-larsen) in #105
• fix: honor changed_files from every config source and stop failing silently by John-David Dalton (@jdalton) in #98
• chore(release): 3.1.0 by lelia in #109

Full Changelog: v3.0.0...v3.1.0

Summary

Major release: Trivy-backed scanning returns, now built and published through Socket's own supply chain ⚡️

🐳 Added

• Container image and Dockerfile scanning (Trivy) restored in the pre-built GitHub Action and Docker images. Trivy now comes from a Socket-built distribution — rebuilt from unmodified upstream source (v0.73.0) by Socket's own release pipeline and pinned by digest in the Dockerfiles (TRIVY_IMAGE build arg; overridable for builds without registry access).
• End-to-end integration test for the Trivy connector (fixture Dockerfile scan through --dockerfiles), plus smoke-test assertions that the bundled trivy matches the pinned version and can execute the connector's scan path.
• Reintroduced latest and latest-heavy floating Docker tag aliases for customers who prefer always receiving the latest Socket Basics releases.
  • We still recommend pinning an exact version or digest for secure, reproducible pipelines.
  • Exact version tags remain immutable registry-side.

🔄 Changed

• Behavioral (the reason this is a major): Trivy-backed scanning was intentionally disabled in the 2.x.x pre-built images following repeated Trivy supply-chain compromises, and documented as such throughout the project. With this 3.0.0 release, Trivy is deliberately re-enabled: configurations that set Trivy parameters (--images, --dockerfiles, trivy_vuln_enabled, …) will begin producing container / Dockerfile findings again.
  • 🚨 TL;DR: pipelines that gate on findings should expect new results on the first run after upgrading.
• OSS toolchain refresh: TruffleHog v3.96.0, OpenGrep v1.26.0 (SAST rule updates may shift findings), uv v0.12.1, gosec v2.28.0, Go v1.26.5 (app_tests), Socket CLI v2.6.3 (Dockerfile.heavy), and the socketdev Python SDK to v3.5.0 (typed fail-closed batch purl parameters).
  • Runtime bases (python:3.12, node:22) remain unchanged.
• Dependabot no longer tracks the aquasecurity/trivy base image; Trivy updates flow through Socket's release process, never independent bumps.

🔧 Fixed

• The app_tests image had been unbuildable since the repository layout migration (stale source references, wrong build context, dereferenced npm symlinks, corrupt uv.lock) — repaired and building in CI again.
• Documentation: removed the now-outdated "temporarily ships without Trivy" notices repo-wide (they described the intentional 2.x posture); APT install instructions now use upstream's generic distribution (required since Trivy v0.72.0).
  • Warnings against using Trivy v0.69.4–v0.69.6 (the compromised version range) retained for native installs.

Full Changelog: v2.2.1...v3.0.0

What's Changed

🐛 Bug Fixes

• fix: support TruffleHog exclude patterns by lelia in #94

Full Changelog: v2.2.0...v2.2.1

What's Changed

🚀 New Features

• ci: publish multi-arch Docker image variants by lelia in #85

📦 Dependencies

• chore(deps): bump the python-minor-patch group with 4 updates by Dependabot (@dependabot)[bot] in #90
• ci(deps): bump the github-actions-minor-patch group across 2 directories with 5 updates by Dependabot (@dependabot)[bot] in #89
• ci(deps): bump the github-actions-major group across 1 directory with 2 updates by Dependabot (@dependabot)[bot] in #91
• chore(deps): bump black from 25.1.0 to 26.5.1 in the python-major group across 1 directory by Dependabot (@dependabot)[bot] in #92

Full Changelog: v2.1.0...v2.2.0

What's Changed

🚀 New Features

• feat: add diff-only scan scoping by lelia in #77

📦 Dependencies

• chore(deps): bundle Dependabot updates + harden dependency review workflows by lelia in #78

📚 Documentation

• chore(license): add nonempty license (LICENSE.md) by Chris Bailey (@ammkrn) in #79

🔧 Other Changes

• fix: warn users when socket_org is missing by David Larsen (@dc-larsen) in #23
• feat: add local ignore overrides for rule IDs + filepaths by lelia in #59
• fix: honor action 'ignore' when generating notifications by David Larsen (@dc-larsen) in #83
• fix: improve custom SAST rule activation, filtering semantics + config observability by lelia in #61
• docs: document required API token scopes for Socket Basics by David Larsen (@dc-larsen) in #68
• feat: add log statement indicating config source by David Larsen (@dc-larsen) in #18
• fix: restore standard LICENSE filename (revert .md rename from #79) by lelia in #88

New Contributors

• Chris Bailey (@ammkrn) made their first contribution in #79

Full Changelog: v2.0.3...v2.1.0

What's Changed

🔧 Other Changes

• fix: Harden GHA workflows by Ryan Eberhardt (@reberhardt7) in #58
• docs: cleanup docs guidance, additional workflow hardening by lelia in #60
• fix(rules): improve precision of 4 high-FP dotnet opengrep rules by David Larsen (@dc-larsen) in #63
• chore(release): prepare v2.0.3, simplify release process by lelia in #66

New Contributors

• Ryan Eberhardt (@reberhardt7) made their first contribution in #58

Full Changelog: v2.0.2...v2.0.3

What's Changed

📦 Dependencies

• Bump urllib3 from 2.5.0 to 2.6.3 by Dependabot (@dependabot)[bot] in #21

🔧 Other Changes

• Removed qualifiers by Douglas (@dacoburn) in #1
• Doug/fix trivy socket results by Douglas (@dacoburn) in #2
• Fix action.yml configuration and add GitHub token by Douglas (@dacoburn) in #3
• Update action.yml description for clarity by Douglas (@dacoburn) in #4
• docs: fix link by Ahmad Nassri (@ahmadnassri) in #5
• Added back in transitive logic and fixed format of integration messages by Douglas (@dacoburn) in #6
• Fixed documentation and version checks by Douglas (@dacoburn) in #7
• Added action inputs by Douglas (@dacoburn) in #8
• Updated examples with PR check and pinning to commit hashes by Douglas (@dacoburn) in #9
• Fixing issue of the git detection logic not using the workspace or GI… by Douglas (@dacoburn) in #10
• Doug/add node and socket back into container by Douglas (@dacoburn) in #11
• Fix for caching result by Douglas (@dacoburn) in #12
• Doug/improve default sast ruleset by Douglas (@dacoburn) in #13
• Fixed hard coded detection for golang by Douglas (@dacoburn) in #14
• Fixing regression in rule name by Douglas (@dacoburn) in #15
• Remove non-existent install options from local-installation.md by Graydon Hope (@graydonhope) in #16
• Fix: Empty CLI string defaults no longer override env/API config by David Larsen (@dc-larsen) in #17
• Bump version to 1.0.26 by David Larsen (@dc-larsen) in #20
• docs: add Dockerfile auto-discovery workflow pattern by David Larsen (@dc-larsen) in #25
• Add scan_type parameter to full scan API calls by Martin Torp (@mtorp) in #24
• Upgrade 1.0.28 by Martin Torp (@mtorp) in #27
• feat: add SKIP_SOCKET_REACH and SKIP_SOCKET_SUBMISSION env vars for Node.js Socket CLI integration by John-David Dalton (@jdalton) in #29
• Remove CODEOWNERS entry for @SocketDev/eng by Jake Verbaten (@Raynos) in #31
• Improve usefulness of generic output by Trevor Norris (@trevnorris) in #28
• Pin trufflehog to known-good version tag by lelia in #32
• Fix notifiers reading repo/branch from wrong source by David Larsen (@dc-larsen) in #30
• Fix: Jira dashboard config params not reaching notifier by David Larsen (@dc-larsen) in #22
• Update CODEOWNERS to reference GitHub Enterprise team name by lelia in #33
• Enhance GitHub PR comment experience by lelia in #26
• Fix CODEOWNERS syntax by lelia in #35
• Fix webhook notifier not reading URL from dashboard config by David Larsen (@dc-larsen) in #34
• Final CODEOWNERS update with new team name by lelia in #36
• Bump Trivy from v0.67.2 to v0.69.2 by David Larsen (@dc-larsen) in #39
• Bump version to prep for release by lelia in #40
• Pin opengrep version, add Docker smoketest by lelia in #41
• Add GitHub workflow for pytest by lelia in #42
• Fix Slack and MS Teams notifiers not reading URL from dashboard config by David Larsen (@dc-larsen) in #37
• Add structured findings to webhook payload by David Larsen (@dc-larsen) in #38
• feat: 🐳 multi-stage Docker builds, immutable release pipeline, CHANGELOG automation by lelia in #46
• fix(ci): add conventional commit prefixes to Dependabot config by lelia in #53
• fix(ci): support breaking change indicator (!) in commit-lint pattern by lelia in #54
• fix(ci): accept full tag name in workflow_dispatch, drop auto-v-prefix by lelia in #55
• feat!: switch to pre-built GHCR images by lelia in #48
• fix: remove trivy from Docker build while assessing compromise impact by Douglas (@dacoburn) in #56
• chore: fix release and updater script by lelia in #57

New Contributors

• Douglas (@dacoburn) made their first contribution in #1
• Ahmad Nassri (@ahmadnassri) made their first contribution in #5
• Graydon Hope (@graydonhope) made their first contribution in #16
• David Larsen (@dc-larsen) made their first contribution in #17
• Martin Torp (@mtorp) made their first contribution in #24
• John-David Dalton (@jdalton) made their first contribution in #29
• Jake Verbaten (@Raynos) made their first contribution in #31
• Dependabot (@dependabot)[bot] made their first contribution in #21
• Trevor Norris (@trevnorris) made their first contribution in #28
• lelia made their first contribution in #32

Full Changelog: https://github.com/SocketDev/socket-basics/commits/v2.0.2