* fix(ci): refresh PyPI install verification

* fix(ci): extend PyPI verify budget to 30 minutes and log index staleness

Match the socket-python-cli release workflow hardening (PR #290 there):
the 2026-08-05 propagation delay exceeded 10 minutes from the release
runner's vantage point, so extend the retry budget to 30 minutes, and
log when the JSON API already has the version but the Simple index does
not, making CDN propagation delay distinguishable from a failed publish
in the logs.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* Trim release-specific details from verify step comment

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

---------

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

* Bound runtime dependency ranges and pin build backend

Add version bounds to the runtime dependencies: requests was fully
unbounded and typing-extensions had no upper bound, so a fresh install
could resolve either to any just-published release. As a library,
socketdev declares bounded ranges rather than exact pins - exact pins
in package metadata would conflict with consumers that pin their own
dependencies, including socket-python-cli, which pins its entire
runtime closure (socketsecurity 2.5.10+) and relies on this package's
ranges staying compatible.

Floors match the versions already resolved and tested in uv.lock;
ceilings exclude the next major. Also pins the hatchling build backend
used for sdist builds. Dependabot (uv ecosystem, 7-day cooldown)
already keeps the lockfile fresh within these bounds.

Companion to the socket-python-cli dependency pinning work (CE-359).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* Add CHANGELOG.md

Seed a changelog in the socket-python-cli format, starting at 3.4.3,
with a pointer to GitHub releases for earlier history.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* Backfill changelog from GitHub release notes

Import all 53 published releases (v1.0.15 through v3.4.2) from the
auto-generated GitHub release notes: one dated entry per version,
pre-releases labeled, body headings demoted one level so version
headings stay the top-level structure.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* Bump version to 3.5.0

The new requests floor is a newly binding constraint for consumers on
older versions, so this warrants a minor bump rather than a patch.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* Fix static project version and use a Python 3.9-compatible hatchling

The [project] version in pyproject.toml is static ([tool.hatch.version]
is only consulted when version is declared dynamic), so bumping
version.py alone left the packaging metadata and uv.lock at 3.4.2.
Set the static version to 3.5.0 to match.

Pin hatchling to 1.27.0 instead of 1.31.0: 1.28+ requires Python 3.10,
while this package's requires-python still includes 3.9, so the newer
pin would break sdist builds on 3.9.

Addresses PR#103 review findings.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* Declare the version dynamic so version.py is the single source of truth

Per review on PR#103: with dynamic = ["version"], hatchling reads
socketdev/version.py (the file version-check.yml already validates),
so packaging metadata can never drift from the checked version again.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

---------

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Bumps [actions/setup-python](https://github.com/actions/setup-python) from 6.2.0 to 7.0.0.
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](actions/setup-python@a309ff8...5fda3b9)

---
updated-dependencies:
- dependency-name: actions/setup-python
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [actions/setup-python](https://github.com/actions/setup-python) from 6.2.0 to 7.0.0.
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](actions/setup-python@a309ff8...5fda3b9)

---
updated-dependencies:
- dependency-name: actions/setup-python
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: lelia <2418071+lelia@users.noreply.github.com>

Bumps the python-minor-patch group with 2 updates: [ruff](https://github.com/astral-sh/ruff) and [hatchling](https://github.com/pypa/hatch).


Updates `ruff` from 0.15.20 to 0.16.1
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.15.20...0.16.1)

Updates `hatchling` from 1.27.0 to 1.31.0
- [Release notes](https://github.com/pypa/hatch/releases)
- [Commits](pypa/hatch@hatchling-v1.27.0...hatchling-v1.31.0)

---
updated-dependencies:
- dependency-name: ruff
  dependency-version: 0.16.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: hatchling
  dependency-version: 1.31.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: lelia <2418071+lelia@users.noreply.github.com>

Bumps the python-minor-patch group with 2 updates: [ruff](https://github.com/astral-sh/ruff) and [hatchling](https://github.com/pypa/hatch).


Updates `ruff` from 0.16.1 to 0.16.5
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.1...0.16.5)

Updates `hatchling` from 1.31.0 to 1.32.0
- [Release notes](https://github.com/pypa/hatch/releases)
- [Commits](pypa/hatch@hatchling-v1.31.0...hatchling-v1.32.0)

---
updated-dependencies:
- dependency-name: ruff
  dependency-version: 0.16.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
- dependency-name: hatchling
  dependency-version: 1.32.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…ctively (#107)

* feat(enums): make every API-sourced enum forward-compatible

Five of the six enums populated from API responses coerced strictly, so a
value the backend added would raise ValueError inside from_dict and empty an
entire response rather than degrade one field. That is the mechanism behind
issue #78 and the unknown `generic` purl type; each was fixed on the single
enum that fired, leaving the rest holding the same landmine.

All five now fall back to a documented member and log the unrecognized value.
The fallbacks are chosen rather than convenient: SocketIssueSeverity and
DiffType gain an explicit UNKNOWN, since guessing an existing level would
either hide a real finding or invent one, and SecurityAction defers.

A generalized test discovers every enum in the package, including ones added
later, and fails if any raises. A drift check compares the enums against the
public OpenAPI spec; it found 10 purl types the SDK was missing, which are
added here.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* docs: drop Linear IDs from test docstrings and comments

Ticket identifiers belong in the pull request description, not in code that
outlives the ticket. The GitHub issue reference in the purl test docstring
stays, since that resolves for anyone reading the repository.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* chore: add .gitattributes and normalize line endings to LF

Eleven Python files were committed with CRLF, socketdev/__init__.py among them.
Any tooling that reads and rewrites one of those files converts it to LF on the
way out, so a two-line edit arrives as a whole-file diff with the real change
buried in it. That happened while writing the enum change in this same branch.

This normalizes all of them once and pins the setting so it cannot recur.
Reviewable with `git diff -w`, which shows only .gitattributes: no file content
changed, and the unit suite is unaffected.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix(enums): keep ScanType strict, it only ever builds requests

ScanType never parses an API response. FullScanParams.to_dict() is urlencoded
onto the create-scan query string, so giving it a _missing_ fallback meant a
caller typo silently shipped scan_type=unknown to the API instead of failing at
construction. The same from_dict already passes integration_type through
uncoerced for that reason.

It is now recorded in REQUEST_ONLY_ENUMS, the opt-out the invariant test always
had and this branch had left empty, and a new test asserts request-only enums
keep raising so the exemption cannot quietly become a skip.

Also bumps actions/setup-python in the new workflow to v7.0.0, matching the pin
already used by .github/actions/setup-sfw.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

Ports the socket-python-cli fix. Three changes to the same job:

Floor on PyPI, not main. The check required the PR version to exceed both
main and PyPI. The main term forbids the legitimate case where several PRs
ship under one unreleased version: the first bumps main and the rest ride it
without bumping again, which is what keeps them under a single changelog
header. Main is still a floor in the direction that matters -- a PR may leave
the version alone or move it forwards, never back. Forgetting to bump,
reusing a published version, and branching from a stale base all still fail.

Stop checking out main to read its version. `git checkout origin/main` left
the working tree detached on main, so the "Require uv.lock update when
pyproject changes" step below it diffed main against itself and never fired.
Reading the version out of the ref with `git show` removes the side effect
and revives that guard.

Only enforce a bump when the PR changes shipped content. This workflow is now
in its own paths filter so an edit to the check is exercised by the PR making
it, but a CI-only change ships nothing and must not be told to cut a release.
The comparison still runs and reports either way.

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>