Tags: SocketDev/socket-python-cli
Tags
Bump pinned @coana-tech/cli to 15.10.13 (#300) * Bump pinned @coana-tech/cli to 15.10.13 * Bump pinned GitPython to 3.1.59 GitPython 3.1.57 is affected by six advisories fixed in 3.1.58 (published 2026-08-07) and five more fixed in 3.1.59 (published 2026-08-10). Pin the latest so the pip-audit gate stays green once the newer advisories propagate to the audit databases. None of the affected GitPython APIs are used by this CLI. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: lelia <2418071+lelia@users.noreply.github.com> --------- Signed-off-by: lelia <2418071+lelia@users.noreply.github.com> Co-authored-by: socket-pr-bot[bot] <294242679+socket-pr-bot[bot]@users.noreply.github.com> Co-authored-by: lelia <2418071+lelia@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Bump pinned @coana-tech/cli to 15.10.4 (#291) * Bump pinned @coana-tech/cli to 15.10.4 * Rev version to 2.6.3, consolidating the unpublished 2.6.2 notes 2.6.1 shipped while this PR was in flight, and the 2.6.2 version bump on main was never published. Fold the 2.6.2 changelog entry, the Dependabot updates, and the dev/test dependency pinning into the 2.6.3 entry. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Trim dependency-update specifics in the 2.6.3 changelog entry Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: socket-pr-bot[bot] <294242679+socket-pr-bot[bot]@users.noreply.github.com> Co-authored-by: lelia <2418071+lelia@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Fix intermittent connection resets on scan comparison by polling the … …diff-scans endpoints (#284) * Poll diff-scans endpoints for scan comparison instead of streaming The scan comparison (fullscans.stream_diff) held a single HTTP connection open, fully idle, while the API computed the diff. Network middleboxes with TCP idle timeouts - notably Azure NAT gateways, which default to 4 minutes - kill that connection with a RST, surfacing as intermittent "Connection reset by peer" / blank "API Error:" failures on the final comparison step of long scans (CE-354). The comparison now creates a diff-scan resource (POST /orgs/{org}/diff-scans/from-ids) and polls GET /orgs/{org}/diff-scans/{id}?cached=true with short bounded requests: 202 while the diff is computing, 200 with the result once ready. No request is ever idle long enough to be reaped, and the poll interval backs off 5s -> 30s to stay quota-friendly (each poll costs 1 quota unit). Transient poll failures retry; a 30-minute backstop guards against a diff scan that never completes. Any failure of the new flow (e.g. org tokens missing the diff-scans:create / diff-scans:list / full-scans:list scopes) logs a warning and falls back to the legacy streaming comparison, so the change is transparent to existing users. Requires socketdev>=3.4.0 for diffscans.get query-param/202 support. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Drop ignored omit_license_details param from cached diff-scan polls The API ignores omit_license_details when cached=true - cached diff-scan results always embed license details - so sending the param suggested a lean-response guarantee the polling path doesn't have. Document the caveat instead: if the heavier payload ever gets truncated on a huge dependency tree, JSON parsing fails and the caller already falls back to the legacy streaming comparison, which still requests the lean payload. include_license_details now only governs that fallback call. Flagged by Cursor Bugbot on #284. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Keep duplicate diff scans on cached polling * Require bundled socketdev 3.4.2 release * Stage CLI 2.6.1 * Require socketdev 3.5.0 * Drop ticket references from code comments, workflows, and changelog Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: lelia <2418071+lelia@users.noreply.github.com> * Align changelog with pinned SDK dependency --------- Signed-off-by: lelia <2418071+lelia@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Pin all Python dependencies (#289) * Pin all Python dependencies Pin every runtime dependency in pyproject.toml to an exact version, replace the bs4 shim with a direct beautifulsoup4 dependency, pin the socketdev SDK to 3.4.2, and install Docker image dependencies from the committed uv.lock with pip hash verification so image builds no longer resolve loose versions from PyPI at build time. Also pins the hatchling build backend and the uv binary used in the Dockerfile. Refs CE-359. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: lelia <2418071+lelia@users.noreply.github.com> * Keep locked dep install on prod PyPI; run pip check before SDK override Pass explicit production index flags on the hash-locked dependency install so the PIP_INDEX_URL/PIP_EXTRA_INDEX_URL build args (pointed at TestPyPI by the preview build scripts) don't leak in via pip's env vars, and move pip check ahead of the SDK_VERSION override so a preview SDK that deviates from the exact socketdev pin doesn't abort the build. Addresses PR#289 review findings. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: lelia <2418071+lelia@users.noreply.github.com> * Fail the Docker build when pip check fails Docker's shell-form RUN only propagates the last command's exit status, so once pip check moved ahead of the SDK_VERSION block its failure was silently discarded whenever SDK_VERSION was empty or the override install succeeded. Gate it explicitly with || exit 1. Addresses PR#289 review finding. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: lelia <2418071+lelia@users.noreply.github.com> * Drop ticket reference from changelog entry Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: lelia <2418071+lelia@users.noreply.github.com> * Bump version to 2.6.0 Switching to fully pinned dependencies warrants a minor bump rather than a patch. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: lelia <2418071+lelia@users.noreply.github.com> * Pin socketdev to 3.5.0 Ingest the SDK release that bounds its own runtime dependency ranges, so the pinned closure is hygienic end to end. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: lelia <2418071+lelia@users.noreply.github.com> * ci(e2e): retry reachability on empty results, upload diagnostics on failure The e2e-reachability job intermittently fails with 'no components with alerts in .socket.facts.json': the tier-1 reachability backend can return empty results while the CLI reports success (ENG-5093), and the same flake has hit unrelated PRs. - Add a retry-probe hook to the e2e matrix: entries that define it get up to 3 scan attempts, retrying only when the probe says the output looks incomplete. Persistent failures still fail via the validate step. Each retry emits a warning annotation and a step-summary line so flake frequency stays visible. - Add tests/e2e/reach-facts-probe.sh: exits 0 when the facts file has alerted components, non-zero (retry) when empty or missing. - Upload /tmp/e2e-output.log, SARIF/GitLab outputs, and facts files as artifacts when any e2e job fails, so flakes are diagnosable without a re-run. Also bump version to 2.6.2 (2.6.0 and 2.6.1 are being released ahead of this PR). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * ci(e2e): classify known empty reachability backend result * Drop ticket references from e2e hardening and note it in the changelog Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: lelia <2418071+lelia@users.noreply.github.com> --------- Signed-off-by: lelia <2418071+lelia@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Bump pinned @coana-tech/cli to 15.10.2 (#279) Co-authored-by: socket-pr-bot[bot] <294242679+socket-pr-bot[bot]@users.noreply.github.com> Co-authored-by: lelia <2418071+lelia@users.noreply.github.com>
PreviousNext