From 4367ed9375788c738996abed32851dfeb63bfaf6 Mon Sep 17 00:00:00 2001
From: lelia <2418071+lelia@users.noreply.github.com>
Date: Fri, 6 Nov 2026 17:38:43 -0600
Subject: [PATCH 1/4] chore(deps): bump Socket Python CLI to 2.11.13

2.11.12 bumps the pinned Coana CLI to 15.14.2. 2.11.13 rejects an
owner/repo value for --repo up front (the API already rejected it) and
deprecates --pending-head. It still pins socketdev==3.6.2.
---
 CHANGELOG.md         | 4 ++--
 Dockerfile.heavy     | 2 +-
 app_tests/Dockerfile | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index b2dde4e..1bac31e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -31,11 +31,11 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
   list-valued flags, such as
   `--exclude-paths=tests --exclude-paths=fixtures`.
 - Bundled tools: OpenGrep v1.26.0 -> v1.33.1, TruffleHog 3.96.0 -> 3.99.8,
-  Socket npm CLI 1.1.165 -> 1.14.0, Socket Python CLI 2.11.3 -> 2.11.11, uv
+  Socket npm CLI 1.1.165 -> 1.14.0, Socket Python CLI 2.11.3 -> 2.11.13, uv
   0.12.1 -> 0.13.7; in the app-tests image, gosec v2.28.0 -> v2.30.0 and Go
   1.26.5 -> 1.27.3. Java SAST benchmark results are unchanged on OpenGrep 1.33.1.
 - Socket Python SDK (`socketdev`) 3.6.1 -> 3.6.2, which Socket Python CLI
-  2.11.11 pins exactly. Source installs now require `socketdev>=3.6.2`.
+  2.11.13 pins exactly. Source installs now require `socketdev>=3.6.2`.
 - TruffleHog no longer reports AppOptics or Bing Subscription Key credentials;
   upstream retired both detectors in 3.97.0.
 - Base and tool images are pinned as literal `FROM` tags so Dependabot can
diff --git a/Dockerfile.heavy b/Dockerfile.heavy
index 558dca6..dbda546 100644
--- a/Dockerfile.heavy
+++ b/Dockerfile.heavy
@@ -5,7 +5,7 @@
 # hand. See the note at the top of ./Dockerfile for why.
 ARG OPENGREP_VERSION=v1.33.1
 ARG SOCKET_NPM_CLI_VERSION=1.14.0
-ARG SOCKET_PYTHON_CLI_VERSION=2.11.11
+ARG SOCKET_PYTHON_CLI_VERSION=2.11.13
 # Socket-built Trivy, pinned by digest — see the note in ./Dockerfile.
 ARG TRIVY_IMAGE=ghcr.io/socketdev/trivy:0.76.1@sha256:883da3593a60e311b2ed87c3a55241051b27bba15ffc3ce041ae570cd0f00915
 
diff --git a/app_tests/Dockerfile b/app_tests/Dockerfile
index 5b437e9..862c841 100644
--- a/app_tests/Dockerfile
+++ b/app_tests/Dockerfile
@@ -10,7 +10,7 @@
 ARG GOSEC_VERSION=v2.30.0
 ARG OPENGREP_VERSION=v1.33.1
 ARG SOCKET_NPM_CLI_VERSION=1.14.0
-ARG SOCKET_PYTHON_CLI_VERSION=2.11.11
+ARG SOCKET_PYTHON_CLI_VERSION=2.11.13
 #
 # Socket-built Trivy, pinned by digest and deliberately kept out of Dependabot's
 # reach; updated by Socket's trivy-dist release process. See the root

From b2d335a59b4b555aec2210078cfd887656314eaf Mon Sep 17 00:00:00 2001
From: lelia <2418071+lelia@users.noreply.github.com>
Date: Fri, 6 Nov 2026 17:40:03 -0600
Subject: [PATCH 2/4] chore(release): prepare 3.5.0

Bump the release to 3.5.0 with scripts/prep_release.py and stamp
[Unreleased] as the 3.5.0 changelog. The section opens with why this is
a minor release and condenses the #125 entry into upgrade notes and a
fix.
---
 CHANGELOG.md                    | 21 +++++---
 README.md                       |  6 +--
 action.yml                      |  2 +-
 docs/github-action.md           | 64 +++++++++++------------
 docs/github-pr-comment-guide.md |  2 +-
 docs/local-install-docker.md    | 90 ++++++++++++++++-----------------
 docs/parameters.md              |  2 +-
 docs/pre-commit-hook.md         | 10 ++--
 pyproject.toml                  |  2 +-
 socket_basics/__init__.py       |  2 +-
 socket_basics/version.py        |  2 +-
 uv.lock                         |  2 +-
 12 files changed, 106 insertions(+), 99 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1bac31e..90db2e8 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,12 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [3.5.0] - 2026-11-06
+
+Minor rather than patch: Socket Tier 1 parses `socket_additional_params`
+differently (#125) and needs new network access (#118), and either can break an
+existing setup.
+
 ### Upgrade notes
 - **Socket Tier 1 needs outbound access to `api.socket.dev` and
   `storage.googleapis.com`.** Socket npm CLI 1.9.0 and later download the
@@ -16,6 +22,10 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
   effect, and a `--reach-version` older than the move fails. The heavy image's
   Python CLI made the same change in 2.11.1, which shipped in 3.4.1. See
   [Network access for Tier 1](docs/parameters.md#network-access-for-tier-1).
+- A comma between a Tier 1 option and its value is no longer a separator:
+  change `--reach-analysis-timeout,90s` to `--reach-analysis-timeout=90s`.
+  Comma-joined options such as `--view=full,--all` still split. (#125)
+- Pass multiple exclusions as repeated `--exclude-paths` flags. (#125)
 
 ### Changed
 - The images set `NODE_USE_ENV_PROXY=1`, so Socket Tier 1 honors `HTTPS_PROXY`
@@ -23,13 +33,6 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
   requests, and Tier 1 behind a proxy failed with `getaddrinfo EAI_AGAIN
   api.socket.dev`. Node only acts on it when a proxy variable is set. Native
   installs need it set by hand.
-- **Behavior change:** `socket_additional_params` now uses shell-style,
-  space-separated arguments and preserves commas within argument values. A
-  comma acts as a legacy separator only when it is unquoted and followed by a
-  hyphen (normally another option). Configurations that used commas as general
-  separators (for example, `--view,full`) must use a space or `=` instead. Repeat
-  list-valued flags, such as
-  `--exclude-paths=tests --exclude-paths=fixtures`.
 - Bundled tools: OpenGrep v1.26.0 -> v1.33.1, TruffleHog 3.96.0 -> 3.99.8,
   Socket npm CLI 1.1.165 -> 1.14.0, Socket Python CLI 2.11.3 -> 2.11.13, uv
   0.12.1 -> 0.13.7; in the app-tests image, gosec v2.28.0 -> v2.30.0 and Go
@@ -42,6 +45,10 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
   update them. `--build-arg TRUFFLEHOG_VERSION` no longer has any effect.
 
 ### Fixed
+- Socket Tier 1 keeps commas and quoted spaces inside `socket_additional_params`
+  values, so `--reach-ecosystems=npm,pypi` reaches the Socket CLI as one
+  argument. Malformed quoting fails with an `Invalid socket_additional_params`
+  error. (#125)
 - TruffleHog 3.99.8 is built on Go 1.27.3, clearing the CVE-2026-111943
   finding noted in 3.4.1.
 
diff --git a/README.md b/README.md
index 8a3cffa..d406c41 100644
--- a/README.md
+++ b/README.md
@@ -35,7 +35,7 @@ jobs:
       - name: Run Socket Basics
         # Pin to a commit SHA for supply-chain safety.
         # Dependabot will keep this up to date automatically — see docs/github-action.md.
-        uses: SocketDev/socket-basics@<sha>  # v3.4.1
+        uses: SocketDev/socket-basics@<sha>  # v3.5.0
         env:
           GITHUB_PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
         with:
@@ -179,10 +179,10 @@ For GitHub Actions, see the [Quick Start](#-quick-start---github-actions) above
 
 ```bash
 # Pull the pre-built image (recommended — no build step required)
-docker pull ghcr.io/socketdev/socket-basics:3.4.1
+docker pull ghcr.io/socketdev/socket-basics:3.5.0
 
 # Run scan
-docker run --rm -v "$PWD:/workspace" ghcr.io/socketdev/socket-basics:3.4.1 \
+docker run --rm -v "$PWD:/workspace" ghcr.io/socketdev/socket-basics:3.5.0 \
   --workspace /workspace \
   --python \
   --secrets \
diff --git a/action.yml b/action.yml
index b9a38f3..bd3b264 100644
--- a/action.yml
+++ b/action.yml
@@ -4,7 +4,7 @@ author: "Socket"
 
 runs:
   using: "docker"
-  image: "docker://ghcr.io/socketdev/socket-basics:3.4.1"
+  image: "docker://ghcr.io/socketdev/socket-basics:3.5.0"
   env:
     # Core GitHub variables (these are automatically available, but we explicitly pass GITHUB_TOKEN)
     GITHUB_TOKEN: ${{ inputs.github_token }}
diff --git a/docs/github-action.md b/docs/github-action.md
index 64f7bc5..2995534 100644
--- a/docs/github-action.md
+++ b/docs/github-action.md
@@ -43,7 +43,7 @@ jobs:
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Run Socket Basics
-        uses: SocketDev/socket-basics@v3.4.1
+        uses: SocketDev/socket-basics@v3.5.0
         env:
           GITHUB_PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
         with:
@@ -59,7 +59,7 @@ Without dashboard configuration, every scanner input defaults to off, so turn on
 
 ### How the action is currently built
 
-When you reference `uses: SocketDev/socket-basics@v3.4.1`, GitHub Actions pulls the
+When you reference `uses: SocketDev/socket-basics@v3.5.0`, GitHub Actions pulls the
 pre-built image referenced by [`action.yml`](../action.yml). The historical multi-stage
 Docker build still matters for maintainers because it determines what lands in the
 published image:
@@ -77,7 +77,7 @@ Socket Basics from source in every workflow run.
 ### Pre-built image
 
 Starting with v2, the action pulls a pre-built image from GHCR rather than
-building from source on every run. Pinning to a specific version tag (e.g. `@v3.4.1`)
+building from source on every run. Pinning to a specific version tag (e.g. `@v3.5.0`)
 means the action starts in seconds — the image is built, integration-tested, and
 published before the release tag is ever created.
 
@@ -87,7 +87,7 @@ If you run socket-basics in other CI systems (Jenkins, GitLab, CircleCI, etc.) o
 as a standalone `docker run`, pull the pre-built image directly:
 
 ```bash
-docker pull ghcr.io/socketdev/socket-basics:3.4.1
+docker pull ghcr.io/socketdev/socket-basics:3.5.0
 ```
 
 See [Local Docker Installation](local-install-docker.md) for usage examples.
@@ -103,7 +103,7 @@ is immediately affected. We've seen this happen across the ecosystem:
   publish `:latest`/`:latest-heavy` Docker aliases as an onboarding
   convenience, but treat them as exactly that — production pipelines should
   pin an exact version or digest.)
-- **Version tags** (`@v3.4.1`) are better, but tags are mutable by default.
+- **Version tags** (`@v3.5.0`) are better, but tags are mutable by default.
   A tag can be deleted and recreated pointing at a different commit. There are
   documented cases of this happening — maliciously and accidentally.
 - **Commit SHAs** are the only truly immutable reference. A SHA cannot be
@@ -128,14 +128,14 @@ The only truly immutable reference. Dependabot keeps it current automatically.
 ```yaml
 - name: Run Socket Basics
   # Dependabot keeps this SHA up to date — see .github/dependabot.yml setup below.
-  uses: SocketDev/socket-basics@<sha>  # v3.4.1
+  uses: SocketDev/socket-basics@<sha>  # v3.5.0
   with:
     socket_security_api_key: ${{ secrets.SOCKET_SECURITY_API_KEY }}
 ```
 
 Get the SHA for any release:
 ```bash
-git ls-remote https://github.com/SocketDev/socket-basics refs/tags/v3.4.1
+git ls-remote https://github.com/SocketDev/socket-basics refs/tags/v3.5.0
 ```
 
 ---
@@ -147,7 +147,7 @@ enforces tag protection rules). SHA pinning is still preferable for defence
 in depth.
 
 ```yaml
-- uses: SocketDev/socket-basics@v3.4.1
+- uses: SocketDev/socket-basics@v3.5.0
   with:
     socket_security_api_key: ${{ secrets.SOCKET_SECURITY_API_KEY }}
 ```
@@ -168,7 +168,7 @@ updates:
 ```
 
 Dependabot opens a PR for each new release, updating the SHA or version tag
-and keeping the `# v3.4.1` comment in sync. You review, approve, and merge
+and keeping the `# v3.5.0` comment in sync. You review, approve, and merge
 on your own schedule — automated upgrades with a human gate.
 
 ---
@@ -178,7 +178,7 @@ on your own schedule — automated upgrades with a human gate.
 | Strategy | Immutable? | Auto-updates | Review gate |
 |---|---|---|---|
 | `@v2` floating tag | ❌ (not published) | — | — |
-| `@v3.4.1` + Dependabot | ✅ (tag protection enforced) | Yes (weekly PR) | Yes |
+| `@v3.5.0` + Dependabot | ✅ (tag protection enforced) | Yes (weekly PR) | Yes |
 | `@<sha>` + Dependabot | ✅ always | Yes (weekly PR) | Yes |
 
 ## Basic Configuration
@@ -219,7 +219,7 @@ Include these in your workflow's `jobs.<job_id>.permissions` section.
 
 **SAST (Static Analysis):**
 ```yaml
-- uses: SocketDev/socket-basics@v3.4.1
+- uses: SocketDev/socket-basics@v3.5.0
   with:
     github_token: ${{ secrets.GITHUB_TOKEN }}
     # Enable SAST for specific languages
@@ -233,7 +233,7 @@ Include these in your workflow's `jobs.<job_id>.permissions` section.
 
 **Secret Scanning:**
 ```yaml
-- uses: SocketDev/socket-basics@v3.4.1
+- uses: SocketDev/socket-basics@v3.5.0
   with:
     github_token: ${{ secrets.GITHUB_TOKEN }}
     secret_scanning_enabled: 'true'
@@ -253,7 +253,7 @@ Include these in your workflow's `jobs.<job_id>.permissions` section.
 
 **Container Scanning:**
 ```yaml
-- uses: SocketDev/socket-basics@v3.4.1
+- uses: SocketDev/socket-basics@v3.5.0
   with:
     github_token: ${{ secrets.GITHUB_TOKEN }}
     # Listing images or Dockerfiles auto-enables the matching Trivy scan.
@@ -280,7 +280,7 @@ path that does not exist is skipped with a `Dockerfile not found` warning.
 
 **Socket Tier 1 Reachability:**
 ```yaml
-- uses: SocketDev/socket-basics@v3.4.1
+- uses: SocketDev/socket-basics@v3.5.0
   with:
     github_token: ${{ secrets.GITHUB_TOKEN }}
     socket_tier_1_enabled: 'true'
@@ -295,7 +295,7 @@ path that does not exist is skipped with a `Dockerfile not found` warning.
 ### Output Configuration
 
 ```yaml
-- uses: SocketDev/socket-basics@v3.4.1
+- uses: SocketDev/socket-basics@v3.5.0
   with:
     github_token: ${{ secrets.GITHUB_TOKEN }}
     python_sast_enabled: 'true'
@@ -333,7 +333,7 @@ jobs:
           fetch-depth: 0
 
       - name: Run Socket Basics (changed files only)
-        uses: SocketDev/socket-basics@v3.4.1
+        uses: SocketDev/socket-basics@v3.5.0
         env:
           GITHUB_PR_NUMBER: ${{ github.event.pull_request.number }}
         with:
@@ -462,7 +462,7 @@ Configure Socket Basics centrally from the [Socket Dashboard](https://socket.dev
 
 **Enable in workflow:**
 ```yaml
-- uses: SocketDev/socket-basics@v3.4.1
+- uses: SocketDev/socket-basics@v3.5.0
   env:
     GITHUB_PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
   with:
@@ -475,7 +475,7 @@ Configure Socket Basics centrally from the [Socket Dashboard](https://socket.dev
 > [!NOTE]
 > You can also pass credentials using environment variables instead of the `with:` section:
 > ```yaml
-> - uses: SocketDev/socket-basics@v3.4.1
+> - uses: SocketDev/socket-basics@v3.5.0
 >   env:
 >     SOCKET_SECURITY_API_KEY: ${{ secrets.SOCKET_SECURITY_API_KEY }}
 >   with:
@@ -546,7 +546,7 @@ directly as a step:
   run: docker build -t myapp:${{ github.sha }} .
 
 - name: Run Socket Basics
-  uses: docker://ghcr.io/socketdev/socket-basics:3.4.1
+  uses: docker://ghcr.io/socketdev/socket-basics:3.5.0
   env:
     SOCKET_SECURITY_API_KEY: ${{ secrets.SOCKET_SECURITY_API_KEY }}
     GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -565,7 +565,7 @@ the dashboard. Running the image directly differs from the action in two ways:
   for some languages.
 - The step isn't tied to an action version, so update the image tag yourself
   when you upgrade. To pin by digest, append `@sha256:<digest>` to the image.
-  `docker buildx imagetools inspect ghcr.io/socketdev/socket-basics:3.4.1`
+  `docker buildx imagetools inspect ghcr.io/socketdev/socket-basics:3.5.0`
   prints the digest.
 
 See the [Parameters Reference](parameters.md) for every CLI flag.
@@ -576,7 +576,7 @@ All notification integrations require Socket Enterprise.
 
 **Slack Notifications:**
 ```yaml
-- uses: SocketDev/socket-basics@v3.4.1
+- uses: SocketDev/socket-basics@v3.5.0
   with:
     github_token: ${{ secrets.GITHUB_TOKEN }}
     socket_org: ${{ secrets.SOCKET_ORG }}
@@ -588,7 +588,7 @@ All notification integrations require Socket Enterprise.
 
 **Jira Issue Creation:**
 ```yaml
-- uses: SocketDev/socket-basics@v3.4.1
+- uses: SocketDev/socket-basics@v3.5.0
   with:
     github_token: ${{ secrets.GITHUB_TOKEN }}
     socket_org: ${{ secrets.SOCKET_ORG }}
@@ -603,7 +603,7 @@ All notification integrations require Socket Enterprise.
 
 **Microsoft Teams:**
 ```yaml
-- uses: SocketDev/socket-basics@v3.4.1
+- uses: SocketDev/socket-basics@v3.5.0
   with:
     github_token: ${{ secrets.GITHUB_TOKEN }}
     socket_org: ${{ secrets.SOCKET_ORG }}
@@ -615,7 +615,7 @@ All notification integrations require Socket Enterprise.
 
 **Generic Webhook:**
 ```yaml
-- uses: SocketDev/socket-basics@v3.4.1
+- uses: SocketDev/socket-basics@v3.5.0
   with:
     github_token: ${{ secrets.GITHUB_TOKEN }}
     socket_org: ${{ secrets.SOCKET_ORG }}
@@ -627,7 +627,7 @@ All notification integrations require Socket Enterprise.
 
 **SIEM Integration:**
 ```yaml
-- uses: SocketDev/socket-basics@v3.4.1
+- uses: SocketDev/socket-basics@v3.5.0
   with:
     github_token: ${{ secrets.GITHUB_TOKEN }}
     socket_org: ${{ secrets.SOCKET_ORG }}
@@ -663,7 +663,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       
       - name: Run Socket Basics
-        uses: SocketDev/socket-basics@v3.4.1
+        uses: SocketDev/socket-basics@v3.5.0
         env:
           GITHUB_PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
         with:
@@ -705,7 +705,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       
       - name: Run Full Security Scan
-        uses: SocketDev/socket-basics@v3.4.1
+        uses: SocketDev/socket-basics@v3.5.0
         env:
           GITHUB_PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
         with:
@@ -771,7 +771,7 @@ jobs:
         run: docker build -t myapp:${{ github.sha }} .
 
       - name: Run Socket Basics (image + Dockerfile scan)
-        uses: SocketDev/socket-basics@v3.4.1
+        uses: SocketDev/socket-basics@v3.5.0
         env:
           GITHUB_PR_NUMBER: ${{ github.event.pull_request.number }}
         with:
@@ -796,7 +796,7 @@ For repositories with multiple Dockerfiles across different directories, you can
 >
 > ```yaml
 > - name: Run Socket Basics
->   uses: docker://ghcr.io/socketdev/socket-basics:3.4.1
+>   uses: docker://ghcr.io/socketdev/socket-basics:3.5.0
 >   env:
 >     SOCKET_SECURITY_API_KEY: ${{ secrets.SOCKET_SECURITY_API_KEY }}
 >     GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -853,7 +853,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Run Socket Basics
-        uses: SocketDev/socket-basics@v3.4.1
+        uses: SocketDev/socket-basics@v3.5.0
         env:
           GITHUB_PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
         with:
@@ -911,7 +911,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       
       - name: Run Socket Basics
-        uses: SocketDev/socket-basics@v3.4.1
+        uses: SocketDev/socket-basics@v3.5.0
         env:
           GITHUB_PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
         with:
@@ -1076,7 +1076,7 @@ in the [name mapping](parameters.md#name-mapping).
 ```yaml
 steps:
   - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - Must be first
-  - uses: SocketDev/socket-basics@v3.4.1
+  - uses: SocketDev/socket-basics@v3.5.0
 ```
 
 ### PR Comments Not Appearing
diff --git a/docs/github-pr-comment-guide.md b/docs/github-pr-comment-guide.md
index ca8d21b..f34579c 100644
--- a/docs/github-pr-comment-guide.md
+++ b/docs/github-pr-comment-guide.md
@@ -315,7 +315,7 @@ PR. This is for teams who want to review finding quality in the Socket dashboard
 first, without every PR growing a comment that developers have to scroll past.
 
 ```yaml
-- uses: SocketDev/socket-basics@v3.4.1
+- uses: SocketDev/socket-basics@v3.5.0
   with:
     socket_security_api_key: ${{ secrets.SOCKET_SECURITY_API_KEY }}
     github_token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/docs/local-install-docker.md b/docs/local-install-docker.md
index 8ffc93c..73aca03 100644
--- a/docs/local-install-docker.md
+++ b/docs/local-install-docker.md
@@ -16,7 +16,7 @@ Run Socket Basics locally using Docker without installing security tools on your
 
 ```bash
 # 1. Pull a pinned release from GHCR (no build step required)
-docker pull ghcr.io/socketdev/socket-basics:3.4.1
+docker pull ghcr.io/socketdev/socket-basics:3.5.0
 
 # 2. Create .env file with your credentials (the API key is environment-only;
 #    the organization can also be passed per run with --socket-org)
@@ -29,14 +29,14 @@ EOF
 docker run --rm \
   -v "$PWD:/workspace" \
   --env-file .env \
-  ghcr.io/socketdev/socket-basics:3.4.1 \
+  ghcr.io/socketdev/socket-basics:3.5.0 \
   --workspace /workspace \
   --python \
   --secrets \
   --console-tabular-enabled
 ```
 
-The Docker image should always be pinned to an exact version such as `3.4.1`. Avoid
+The Docker image should always be pinned to an exact version such as `3.5.0`. Avoid
 floating tags like `:latest` in CI/CD.
 
 ## Using Pre-built Images
@@ -46,13 +46,13 @@ The baked-in security tool versions are recorded in the image labels so you can
 inspect exactly what's inside:
 
 ```bash
-docker inspect ghcr.io/socketdev/socket-basics:3.4.1 \
+docker inspect ghcr.io/socketdev/socket-basics:3.5.0 \
   | jq '.[0].Config.Labels'
 # {
 #   "com.socket.trivy-version": "0.76.1",
 #   "com.socket.trufflehog-version": "3.99.8",
 #   "com.socket.opengrep-version": "v1.33.1",
-#   "org.opencontainers.image.version": "3.4.1",
+#   "org.opencontainers.image.version": "3.5.0",
 #   ...
 # }
 ```
@@ -90,8 +90,8 @@ tool: `socketcli` runs the Python CLI; `socket-basics`, or any other argument,
 runs Socket Basics:
 
 ```bash
-docker run --rm -v "$PWD:/workspace" ghcr.io/socketdev/socket-basics:3.4.1-heavy socketcli --help
-docker run --rm -v "$PWD:/workspace" ghcr.io/socketdev/socket-basics:3.4.1-heavy --workspace /workspace --python
+docker run --rm -v "$PWD:/workspace" ghcr.io/socketdev/socket-basics:3.5.0-heavy socketcli --help
+docker run --rm -v "$PWD:/workspace" ghcr.io/socketdev/socket-basics:3.5.0-heavy --workspace /workspace --python
 ```
 
 `latest` and `latest-heavy` are floating aliases published for onboarding
@@ -106,7 +106,7 @@ convenience. Pin an exact version (or digest) in anything automated.
 >
 > ```bash
 > docker run --rm -v "$PWD:/workspace" -v socket-coana-cache:/root/.cache/socket/coana \
->   ghcr.io/socketdev/socket-basics:3.4.1 --workspace /workspace --socket-tier1
+>   ghcr.io/socketdev/socket-basics:3.5.0 --workspace /workspace --socket-tier1
 > ```
 >
 > See [Network access for Tier 1](parameters.md#network-access-for-tier-1).
@@ -123,7 +123,7 @@ comments and labels. If you must run the image directly, pin the exact version:
       -v "$GITHUB_WORKSPACE:/workspace" \
       -e SOCKET_SECURITY_API_KEY=${{ secrets.SOCKET_SECURITY_API_KEY }} \
       -e SOCKET_ORG=${{ secrets.SOCKET_ORG }} \
-      ghcr.io/socketdev/socket-basics:3.4.1 \
+      ghcr.io/socketdev/socket-basics:3.5.0 \
       --workspace /workspace \
       --python \
       --javascript \
@@ -136,7 +136,7 @@ comments and labels. If you must run the image directly, pin the exact version:
 ```yaml
 security-scan:
   image:
-    name: ghcr.io/socketdev/socket-basics:3.4.1
+    name: ghcr.io/socketdev/socket-basics:3.5.0
     entrypoint: [""]   # GitLab needs a shell; the image's entrypoint is socket-basics
   stage: test
   script:
@@ -155,7 +155,7 @@ security-scan:
 
 ```dockerfile
 # Pin socket-basics and let Dependabot send upgrade PRs automatically
-FROM ghcr.io/socketdev/socket-basics:3.4.1
+FROM ghcr.io/socketdev/socket-basics:3.5.0
 ```
 
 ### Staying Up to Date with Dependabot
@@ -173,7 +173,7 @@ updates:
       interval: "weekly"
 ```
 
-Dependabot will detect the `FROM ghcr.io/socketdev/socket-basics:3.4.1` reference
+Dependabot will detect the `FROM ghcr.io/socketdev/socket-basics:3.5.0` reference
 and open a PR with the version bump when a new release is available.
 
 ## Building the Docker Image
@@ -184,10 +184,10 @@ Pull a specific release without building locally:
 
 ```bash
 # GHCR (preferred)
-docker pull ghcr.io/socketdev/socket-basics:3.4.1
+docker pull ghcr.io/socketdev/socket-basics:3.5.0
 
 # Docker Hub
-docker pull socketdev/socket-basics:3.4.1
+docker pull socketdev/socket-basics:3.5.0
 ```
 
 ### Build from Source
@@ -200,7 +200,7 @@ git clone https://github.com/SocketDev/socket-basics.git
 cd socket-basics
 
 # Build with version tag (multi-stage; first build is slower, subsequent ones are fast)
-docker build -t socket-basics:3.4.1 .
+docker build -t socket-basics:3.5.0 .
 
 # Verify the build
 docker images | grep socket-basics
@@ -209,7 +209,7 @@ docker images | grep socket-basics
 ### Build for a Specific Platform (M1/M2 Macs)
 
 ```bash
-docker build --platform linux/amd64 -t socket-basics:3.4.1 .
+docker build --platform linux/amd64 -t socket-basics:3.5.0 .
 ```
 
 ### Build with Custom Tool Versions
@@ -221,7 +221,7 @@ script or package manager are build args and can be overridden:
 docker build \
   --build-arg OPENGREP_VERSION=v1.33.1 \
   --build-arg SOCKET_NPM_CLI_VERSION=1.14.0 \
-  -t socket-basics:3.4.1 .
+  -t socket-basics:3.5.0 .
 ```
 
 Base and tool *images* — python, trufflehog, uv — are pinned as literal tags on
@@ -239,13 +239,13 @@ tests image, build from the `app_tests` directory and use the same build args.
 
 ```bash
 # The image's entrypoint is `socket-basics`, so its own flags need no prefix
-docker run --rm socket-basics:3.4.1 --version
+docker run --rm socket-basics:3.5.0 --version
 
 # Other bundled tools need --entrypoint
-docker run --rm --entrypoint socket     socket-basics:3.4.1 --version
-docker run --rm --entrypoint opengrep   socket-basics:3.4.1 --version
-docker run --rm --entrypoint trufflehog socket-basics:3.4.1 --version
-docker run --rm --entrypoint trivy      socket-basics:3.4.1 --version
+docker run --rm --entrypoint socket     socket-basics:3.5.0 --version
+docker run --rm --entrypoint opengrep   socket-basics:3.5.0 --version
+docker run --rm --entrypoint trufflehog socket-basics:3.5.0 --version
+docker run --rm --entrypoint trivy      socket-basics:3.5.0 --version
 ```
 
 ### Smoke Test
@@ -280,7 +280,7 @@ Mount your project directory into the container:
 # Scan current directory
 docker run --rm \
   -v "$PWD:/workspace" \
-  socket-basics:3.4.1 \
+  socket-basics:3.5.0 \
   --workspace /workspace \
   --python \
   --secrets \
@@ -297,7 +297,7 @@ docker run --rm \
 # Scan a specific project directory
 docker run --rm \
   -v "/path/to/your/project:/workspace" \
-  socket-basics:3.4.1 \
+  socket-basics:3.5.0 \
   --workspace /workspace \
   --javascript \
   --secrets
@@ -308,7 +308,7 @@ docker run --rm \
 ```bash
 docker run --rm \
   -v "$PWD:/workspace" \
-  socket-basics:3.4.1 \
+  socket-basics:3.5.0 \
   --workspace /workspace \
   --all-languages \
   --secrets \
@@ -361,7 +361,7 @@ INPUT_VERBOSE=false
 docker run --rm \
   -v "$PWD:/workspace" \
   --env-file .env \
-  socket-basics:3.4.1 \
+  socket-basics:3.5.0 \
   --workspace /workspace \
   --python \
   --secrets
@@ -376,7 +376,7 @@ docker run --rm \
   -v "$PWD:/workspace" \
   -e "SOCKET_SECURITY_API_KEY=scrt_your_api_key" \
   -e "SOCKET_ORG=your-org-slug" \
-  socket-basics:3.4.1 \
+  socket-basics:3.5.0 \
   --workspace /workspace \
   --python \
   --secrets \
@@ -398,7 +398,7 @@ docker run --rm \
   --env-file .env.socket \
   --env-file .env.notifiers \
   --env-file .env.scanning \
-  socket-basics:3.4.1 \
+  socket-basics:3.5.0 \
   --workspace /workspace \
   --all-languages
 ```
@@ -417,7 +417,7 @@ docker run --rm \
   -v "$PWD:/workspace" \
   -e "SOCKET_SECURITY_API_KEY=$SOCKET_SECURITY_API_KEY" \
   -e "SOCKET_ORG=$SOCKET_ORG" \
-  socket-basics:3.4.1 \
+  socket-basics:3.5.0 \
   --workspace /workspace \
   --python
 ```
@@ -444,7 +444,7 @@ docker run --rm \
   -e GITHUB_TOKEN \
   -e GITHUB_REPOSITORY=owner/repo \
   -e GITHUB_PR_NUMBER=123 \
-  ghcr.io/socketdev/socket-basics:3.4.1 \
+  ghcr.io/socketdev/socket-basics:3.5.0 \
   --workspace /workspace \
   --python --javascript --secrets
 ```
@@ -483,7 +483,7 @@ mkdir -p ./scan-results
 docker run --rm \
   -v "$PWD:/workspace" \
   --env-file .env \
-  socket-basics:3.4.1 \
+  socket-basics:3.5.0 \
   --workspace /workspace \
   --python \
   --secrets \
@@ -508,7 +508,7 @@ docker run --rm -it \
   -v "$PWD:/workspace" \
   --env-file .env \
   --entrypoint /bin/bash \
-  socket-basics:3.4.1
+  socket-basics:3.5.0
 
 # Inside container, run commands manually:
 # cd /workspace
@@ -537,7 +537,7 @@ docker run --rm \
   -v "$PWD:/workspace" \
   -v "$PWD/socket-config.json:/config.json" \
   --env-file .env \
-  socket-basics:3.4.1 \
+  socket-basics:3.5.0 \
   --workspace /workspace \
   --config /config.json
 ```
@@ -561,7 +561,7 @@ for PROJECT in "${PROJECTS[@]}"; do
   docker run --rm \
     -v "$PROJECT:/workspace" \
     --env-file .env \
-    socket-basics:3.4.1 \
+    socket-basics:3.5.0 \
     --workspace /workspace \
     --all-languages \
     --secrets \
@@ -604,7 +604,7 @@ pipeline {
                 script {
                     // --entrypoint='' is required: Jenkins runs `cat` to keep the
                     // container alive, and the image's entrypoint is socket-basics.
-                    docker.image('ghcr.io/socketdev/socket-basics:3.4.1').inside(
+                    docker.image('ghcr.io/socketdev/socket-basics:3.5.0').inside(
                         "--entrypoint='' -v ${WORKSPACE}:/workspace --env-file .env"
                     ) {
                         sh '''
@@ -627,7 +627,7 @@ pipeline {
 ```yaml
 security-scan:
   image:
-    name: ghcr.io/socketdev/socket-basics:3.4.1
+    name: ghcr.io/socketdev/socket-basics:3.5.0
     entrypoint: [""]   # GitLab needs a shell; the image's entrypoint is socket-basics
   stage: test
   script:
@@ -670,7 +670,7 @@ security-scan:
    ```bash
    docker run --rm \
      -v "$(pwd):/workspace" \  # Use $(pwd) instead of $PWD
-     socket-basics:3.4.1
+     socket-basics:3.5.0
    ```
 
 2. Verify mount (the entrypoint is `socket-basics`, so override it to run `ls`):
@@ -678,7 +678,7 @@ security-scan:
    docker run --rm \
      -v "$PWD:/workspace" \
      --entrypoint ls \
-     socket-basics:3.4.1 \
+     socket-basics:3.5.0 \
      -la /workspace
    ```
 
@@ -708,7 +708,7 @@ security-scan:
    docker run --rm \
      -v "$PWD:/workspace" \
      --env-file "$(pwd)/.env" \
-     socket-basics:3.4.1
+     socket-basics:3.5.0
    ```
 
 ### Container Image Too Large
@@ -739,7 +739,7 @@ security-scan:
    ```bash
    docker run --rm \
      -v "$PWD:/workspace" \
-     socket-basics:3.4.1 \
+     socket-basics:3.5.0 \
      --workspace /workspace \
      --python \
      --secrets \
@@ -760,7 +760,7 @@ security-scan:
    ```bash
    docker run --rm \
      -v "$PWD:/workspace" \
-     socket-basics:3.4.1 \
+     socket-basics:3.5.0 \
      --workspace /workspace \
      --output /workspace/results.json  # Save to mounted directory
    ```
@@ -771,7 +771,7 @@ security-scan:
    mkdir -p ./scan-results
    docker run --rm \
      -v "$PWD:/workspace" \
-     socket-basics:3.4.1 \
+     socket-basics:3.5.0 \
      --workspace /workspace \
      --output /workspace/scan-results/scan.json
    ```
@@ -804,7 +804,7 @@ Add these to your `~/.bashrc` or `~/.zshrc` for quick access:
 
 ```bash
 # Socket Basics Docker aliases
-alias sb-docker='docker run --rm -v "$PWD:/workspace" --env-file .env ghcr.io/socketdev/socket-basics:3.4.1 --workspace /workspace'
+alias sb-docker='docker run --rm -v "$PWD:/workspace" --env-file .env ghcr.io/socketdev/socket-basics:3.5.0 --workspace /workspace'
 alias sb-quick='sb-docker --secrets --console-tabular-enabled'
 alias sb-python='sb-docker --python --secrets --console-tabular-enabled'
 alias sb-js='sb-docker --javascript --secrets --console-tabular-enabled'
@@ -830,7 +830,7 @@ sb-all
 
 1. **Use pre-built images** — Pull `ghcr.io/socketdev/socket-basics:<version>` instead of building locally
 2. **Use the standard image** — `-heavy` exists for one deployment constraint (see [Image Variants](#image-variants)); it adds nothing to Socket Basics
-3. **Pin to a specific version** — Avoid `:latest` in production CI; pin to `3.4.1` and upgrade deliberately
+3. **Pin to a specific version** — Avoid `:latest` in production CI; pin to `3.5.0` and upgrade deliberately
 4. **Use Dependabot** — Reference the image in your Dockerfile/Compose to get automatic upgrade PRs
 5. **Inspect baked-in labels** — Run `docker inspect <image> | jq '.[0].Config.Labels'` to verify tool versions
 6. **Use .env files** — Keep credentials out of command history
@@ -850,7 +850,7 @@ set -e
 # Configuration
 PROJECT_DIR="$(pwd)"
 RESULTS_DIR="scan-results"   # relative to the project: it must stay inside the workspace
-IMAGE_NAME="ghcr.io/socketdev/socket-basics:3.4.1"
+IMAGE_NAME="ghcr.io/socketdev/socket-basics:3.5.0"
 ENV_FILE=".env"
 
 # Create results directory (add it to .gitignore)
diff --git a/docs/parameters.md b/docs/parameters.md
index 86b4794..24de39b 100644
--- a/docs/parameters.md
+++ b/docs/parameters.md
@@ -310,7 +310,7 @@ workflow and pass it in yourself:
   run: echo "ref=$(gh pr view ${{ github.event.issue.number }} --json baseRefName -q .baseRefName)" >> "$GITHUB_OUTPUT"
   env:
     GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-- uses: SocketDev/socket-basics@v3.4.1
+- uses: SocketDev/socket-basics@v3.5.0
   env:
     GITHUB_BASE_REF: ${{ steps.prbase.outputs.ref }}
   with:
diff --git a/docs/pre-commit-hook.md b/docs/pre-commit-hook.md
index c160969..c15de4d 100644
--- a/docs/pre-commit-hook.md
+++ b/docs/pre-commit-hook.md
@@ -41,7 +41,7 @@ Best for: Teams wanting consistent environments without installing security tool
 
 ```bash
 # Pull the pre-built image (no build step required)
-docker pull ghcr.io/socketdev/socket-basics:3.4.1
+docker pull ghcr.io/socketdev/socket-basics:3.5.0
 ```
 
 **2. Create pre-commit hook:**
@@ -64,7 +64,7 @@ fi
 # Run Socket Basics in Docker
 docker run --rm \
   -v "$PWD:/workspace" \
-  ghcr.io/socketdev/socket-basics:3.4.1 \
+  ghcr.io/socketdev/socket-basics:3.5.0 \
   --workspace /workspace \
   --python \
   --javascript \
@@ -118,7 +118,7 @@ fi
 # Scope the scan to the staged changes
 docker run --rm \
   -v "$PWD:/workspace" \
-  ghcr.io/socketdev/socket-basics:3.4.1 \
+  ghcr.io/socketdev/socket-basics:3.5.0 \
   --workspace /workspace \
   --changed-files auto \
   --python \
@@ -153,7 +153,7 @@ docker run --rm \
   -e SOCKET_ORG="$SOCKET_ORG" \
   -e SOCKET_SECURITY_API_KEY="$SOCKET_SECURITY_API_KEY" \
   -e SLACK_WEBHOOK_URL="$SLACK_WEBHOOK_URL" \
-  ghcr.io/socketdev/socket-basics:3.4.1 \
+  ghcr.io/socketdev/socket-basics:3.5.0 \
   --workspace /workspace \
   --python \
   --javascript \
@@ -504,7 +504,7 @@ repos:
     hooks:
       - id: socket-basics
         name: Socket Basics Security Scan
-        entry: docker run --rm -v "$PWD:/workspace" ghcr.io/socketdev/socket-basics:3.4.1 --workspace /workspace --changed-files auto --python --secrets
+        entry: docker run --rm -v "$PWD:/workspace" ghcr.io/socketdev/socket-basics:3.5.0 --workspace /workspace --changed-files auto --python --secrets
         language: system
         pass_filenames: false
 ```
diff --git a/pyproject.toml b/pyproject.toml
index f0f5575..0ca80f9 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "socket_basics"
-version = "3.4.1"
+version = "3.5.0"
 description = "Socket Basics with integrated SAST, secret scanning, and container analysis"
 readme = "README.md"
 requires-python = ">=3.10"
diff --git a/socket_basics/__init__.py b/socket_basics/__init__.py
index 397e0bf..b57c1e6 100644
--- a/socket_basics/__init__.py
+++ b/socket_basics/__init__.py
@@ -12,7 +12,7 @@
 from .socket_basics import SecurityScanner, main
 from .core.config import load_config_from_env, Config
 
-__version__ = "3.4.1"
+__version__ = "3.5.0"
 __author__ = "Socket.dev"
 __email__ = "support@socket.dev"
 
diff --git a/socket_basics/version.py b/socket_basics/version.py
index a5cfdf5..dcbfb52 100644
--- a/socket_basics/version.py
+++ b/socket_basics/version.py
@@ -1 +1 @@
-__version__ = "3.4.1"
+__version__ = "3.5.0"
diff --git a/uv.lock b/uv.lock
index 519e7f8..6009341 100644
--- a/uv.lock
+++ b/uv.lock
@@ -692,7 +692,7 @@ wheels = [
 
 [[package]]
 name = "socket-basics"
-version = "3.4.1"
+version = "3.5.0"
 source = { editable = "." }
 dependencies = [
     { name = "certifi" },

From 94dbc23ea28472b14bde0c80b263a6b2393c5cb2 Mon Sep 17 00:00:00 2001
From: lelia <2418071+lelia@users.noreply.github.com>
Date: Fri, 13 Nov 2026 16:11:08 -0500
Subject: [PATCH 3/4] chore(deps): bump Socket CLIs to 2.12.0 (Python) and
 1.15.0 (npm)

Python CLI 2.11.14 bumps the pinned Coana CLI to 15.15.0. 2.12.0 changes
only the CLI's own Docker image, and still pins socketdev==3.6.2.

npm CLI 1.14.1 and 1.15.0 bump Coana to 15.15.0, grade scan reports from
alert actions, record every resolved Maven dependency edge, and document
the network access reachability needs.
---
 CHANGELOG.md                 | 4 ++--
 Dockerfile                   | 2 +-
 Dockerfile.heavy             | 4 ++--
 app_tests/Dockerfile         | 4 ++--
 docs/local-install-docker.md | 2 +-
 docs/parameters.md           | 2 +-
 6 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 90db2e8..06e5346 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -34,11 +34,11 @@ existing setup.
   api.socket.dev`. Node only acts on it when a proxy variable is set. Native
   installs need it set by hand.
 - Bundled tools: OpenGrep v1.26.0 -> v1.33.1, TruffleHog 3.96.0 -> 3.99.8,
-  Socket npm CLI 1.1.165 -> 1.14.0, Socket Python CLI 2.11.3 -> 2.11.13, uv
+  Socket npm CLI 1.1.165 -> 1.15.0, Socket Python CLI 2.11.3 -> 2.12.0, uv
   0.12.1 -> 0.13.7; in the app-tests image, gosec v2.28.0 -> v2.30.0 and Go
   1.26.5 -> 1.27.3. Java SAST benchmark results are unchanged on OpenGrep 1.33.1.
 - Socket Python SDK (`socketdev`) 3.6.1 -> 3.6.2, which Socket Python CLI
-  2.11.13 pins exactly. Source installs now require `socketdev>=3.6.2`.
+  2.12.0 pins exactly. Source installs now require `socketdev>=3.6.2`.
 - TruffleHog no longer reports AppOptics or Bing Subscription Key credentials;
   upstream retired both detectors in 3.97.0.
 - Base and tool images are pinned as literal `FROM` tags so Dependabot can
diff --git a/Dockerfile b/Dockerfile
index 99dd236..9b7bfde 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -13,7 +13,7 @@
 #    Dependabot to read, so they keep an ARG pin and are bumped by hand. These
 #    stay overridable: docker build --build-arg OPENGREP_VERSION=v1.33.1 .
 ARG OPENGREP_VERSION=v1.33.1
-ARG SOCKET_NPM_CLI_VERSION=1.14.0
+ARG SOCKET_NPM_CLI_VERSION=1.15.0
 #
 # 3. Socket-built Trivy, rebuilt from unmodified upstream source and published
 #    by Socket's own release pipeline. Deliberately kept out of Dependabot's
diff --git a/Dockerfile.heavy b/Dockerfile.heavy
index dbda546..4a544cd 100644
--- a/Dockerfile.heavy
+++ b/Dockerfile.heavy
@@ -4,8 +4,8 @@
 # installed by a script or package manager keep an ARG pin and are bumped by
 # hand. See the note at the top of ./Dockerfile for why.
 ARG OPENGREP_VERSION=v1.33.1
-ARG SOCKET_NPM_CLI_VERSION=1.14.0
-ARG SOCKET_PYTHON_CLI_VERSION=2.11.13
+ARG SOCKET_NPM_CLI_VERSION=1.15.0
+ARG SOCKET_PYTHON_CLI_VERSION=2.12.0
 # Socket-built Trivy, pinned by digest — see the note in ./Dockerfile.
 ARG TRIVY_IMAGE=ghcr.io/socketdev/trivy:0.76.1@sha256:883da3593a60e311b2ed87c3a55241051b27bba15ffc3ce041ae570cd0f00915
 
diff --git a/app_tests/Dockerfile b/app_tests/Dockerfile
index 862c841..6e5cac4 100644
--- a/app_tests/Dockerfile
+++ b/app_tests/Dockerfile
@@ -9,8 +9,8 @@
 #   docker build --build-arg OPENGREP_VERSION=v1.33.1 -f app_tests/Dockerfile app_tests
 ARG GOSEC_VERSION=v2.30.0
 ARG OPENGREP_VERSION=v1.33.1
-ARG SOCKET_NPM_CLI_VERSION=1.14.0
-ARG SOCKET_PYTHON_CLI_VERSION=2.11.13
+ARG SOCKET_NPM_CLI_VERSION=1.15.0
+ARG SOCKET_PYTHON_CLI_VERSION=2.12.0
 #
 # Socket-built Trivy, pinned by digest and deliberately kept out of Dependabot's
 # reach; updated by Socket's trivy-dist release process. See the root
diff --git a/docs/local-install-docker.md b/docs/local-install-docker.md
index 73aca03..5e930c1 100644
--- a/docs/local-install-docker.md
+++ b/docs/local-install-docker.md
@@ -220,7 +220,7 @@ script or package manager are build args and can be overridden:
 ```bash
 docker build \
   --build-arg OPENGREP_VERSION=v1.33.1 \
-  --build-arg SOCKET_NPM_CLI_VERSION=1.14.0 \
+  --build-arg SOCKET_NPM_CLI_VERSION=1.15.0 \
   -t socket-basics:3.5.0 .
 ```
 
diff --git a/docs/parameters.md b/docs/parameters.md
index 24de39b..09e7f4e 100644
--- a/docs/parameters.md
+++ b/docs/parameters.md
@@ -726,7 +726,7 @@ host:
 | `storage.googleapis.com` | Downloading the Coana reachability engine and its analyzers (about 120 MB) | Tier 1 fails: `Failed to get the Coana CLI <version>: getaddrinfo ENOTFOUND storage.googleapis.com` |
 | The package registry of each scanned ecosystem, for example `registry.npmjs.org` | Installing the project's dependencies so the engine can analyze them | Tier 1 still reports success, but the affected vulnerabilities come back as `INSTALL ERROR` with no reachability verdict |
 
-Socket CLI 1.9.0 and later (Socket Basics 3.5.0 bundles 1.14.0) download the
+Socket CLI 1.9.0 and later (Socket Basics 3.5.0 bundles 1.15.0) download the
 engine from Socket rather than npm, with no npm fallback, so an npm mirror does
 not cover the second row. The registry row does not apply when the workspace
 already has its dependencies installed (for example a `node_modules` directory

From 4e7c84e4bb6dfe1963bb23e74a4ca7daf330fe5f Mon Sep 17 00:00:00 2001
From: lelia <2418071+lelia@users.noreply.github.com>
Date: Fri, 13 Nov 2026 16:12:25 -0500
Subject: [PATCH 4/4] chore(release): date 3.5.0 for 2026-11-13 and note Coana
 15.15.0

Restamp the 3.5.0 changelog section with the new release date, and note
that Tier 1 now runs Coana 15.15.0, which both bundled Socket CLIs pin.
---
 CHANGELOG.md | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 06e5346..10a5abc 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,7 +8,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
-## [3.5.0] - 2026-11-06
+## [3.5.0] - 2026-11-13
 
 Minor rather than patch: Socket Tier 1 parses `socket_additional_params`
 differently (#125) and needs new network access (#118), and either can break an
@@ -37,6 +37,8 @@ existing setup.
   Socket npm CLI 1.1.165 -> 1.15.0, Socket Python CLI 2.11.3 -> 2.12.0, uv
   0.12.1 -> 0.13.7; in the app-tests image, gosec v2.28.0 -> v2.30.0 and Go
   1.26.5 -> 1.27.3. Java SAST benchmark results are unchanged on OpenGrep 1.33.1.
+- Socket Tier 1 runs the Coana reachability engine 15.15.0, the version both
+  bundled Socket CLIs now pin.
 - Socket Python SDK (`socketdev`) 3.6.1 -> 3.6.2, which Socket Python CLI
   2.12.0 pins exactly. Source installs now require `socketdev>=3.6.2`.
 - TruffleHog no longer reports AppOptics or Bing Subscription Key credentials;