Skip to content

CHANGELOG.md

Latest commit

 

History

History
188 lines (160 loc) · 11.9 KB

CHANGELOG.md

File metadata and controls

188 lines (160 loc) · 11.9 KB
Raw

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog.

[Unreleased]

[3.0.0] - 2026-08-06

Major release: Trivy-backed scanning returns, now built and published through Socket's own supply chain.

Added

  • Container image and Dockerfile scanning (Trivy) restored in the pre-built GitHub Action and Docker images. Trivy now comes from a Socket-built distribution — rebuilt from unmodified upstream source (v0.73.0) by Socket's own release pipeline and pinned by digest in the Dockerfiles (TRIVY_IMAGE build arg; overridable for builds without registry access).
  • latest and latest-heavy floating Docker tag aliases. Exact version tags remain immutable registry-side; pin an exact version or digest for reproducible pipelines.
  • End-to-end integration test for the Trivy connector (fixture Dockerfile scan through --dockerfiles), plus smoke-test assertions that the bundled trivy matches the pinned version and can execute the connector's scan path.

Changed

  • Behavioral (the reason this is a major): Trivy-backed scanning was intentionally disabled in the 2.x pre-built images following the March 2026 upstream Trivy supply-chain incident, and documented as such throughout the project. With this release it is deliberately re-enabled: configurations that set Trivy parameters (--images, --dockerfiles, trivy_vuln_enabled, …) will begin producing container/Dockerfile findings again, so pipelines that gate on findings should expect new results on the first run after upgrading.
  • OSS toolchain refresh: TruffleHog 3.96.0, OpenGrep v1.26.0 (SAST rule updates may shift findings), uv 0.12.1, gosec v2.28.0, Go 1.26.5 (app-tests), Socket CLI 2.6.3 (heavy image), and the socketdev Python SDK to 3.5.0 (typed fail-closed batch purl parameters; adopted by core-tool-watch in a follow-up). Runtime bases (python:3.12, node:22) are unchanged.
  • Docker Hub publish credentials are now scoped to the publish GitHub environment (deployment restricted to main and v* tags) instead of repo-level secrets.
  • Manual re-publish (workflow_dispatch) is recovery-only: re-pushing an already-published version tag is rejected by the registry's immutable-tag rule.
  • Dependabot no longer tracks the trivy base image; Trivy updates flow through Socket's release process, never independent bumps.
  • CI: GitHub Actions dependency updates (#95, #96).

Fixed

  • The app-tests image had been unbuildable since the repository layout migration (stale source references, wrong build context, dereferenced npm symlinks, corrupt uv.lock) — repaired and building in CI again.
  • Documentation: removed the now-outdated "temporarily ships without Trivy" notices repo-wide (they described the intentional 2.x posture); APT install instructions now use upstream's generic distribution (required since Trivy v0.72.0); warnings against Trivy 0.69.4–0.69.6 retained for native installs.

[2.2.1] - 2026-07-30

Fixed

  • Fixed TruffleHog secret scanning when trufflehog_exclude_dir is configured: all entries now pass through one filter file and are honored for changed-file and explicit-file scans. Previously, configured values could be interpreted as filter filenames and fail or alter scans.
  • Added glob-pattern support for exclusions such as **/appsettings.*.json, with matching anchored beneath the workspace and root-relative globs kept distinct from recursive ** globs.
  • Normalized exclusion entries before pattern generation so dot segments and repeated path separators behave consistently.
  • Fixed exclusion matching when the configured workspace is the filesystem root.
  • Normalized in-workspace TruffleHog finding paths relative to the workspace so host paths do not appear in facts and component identifiers remain stable across runs, working directories, and operating systems.

[2.2.0] - 2026-07-29

Added

  • Publish multi-arch Docker images for linux/amd64 and linux/arm64.
  • Add a heavy image variant (socket-basics:<version>-heavy tag suffix) bundling Socket Basics with the pinned Python Socket CLI.

Fixed

  • Normalize manual Docker release tag inputs before checkout.
  • core-tool-watch now opts into fail-closed Socket purl batch semantics (poll + alerts), so fresh-but-unanalyzed pins surface as labeled pending/not-found failures instead of silently dropped rows.

[2.1.0] - 2026-07-22

Added

  • Diff-only scan scoping now applies to SAST/OpenGrep via changed_files and scan_files.
  • Added GitHub Action inputs for changed_files and scan_files.

Fixed

  • Delete-only changed-file scans now skip instead of falling back to a full workspace scan.
  • Updated parameter docs to reflect SAST/OpenGrep diff-only scoping.

[2.0.3] - 2026-04-24

What's Changed

🔧 Other Changes

  • fix: Harden GHA workflows by @reberhardt7 in #58
  • docs: cleanup docs guidance, additional workflow hardening by @lelia in #60
  • fix(rules): improve precision of 4 high-FP dotnet opengrep rules by @dc-larsen in #63

New Contributors

  • @reberhardt7 made their first contribution in #58

Full Changelog: https://github.com/SocketDev/socket-basics/compare/v2.0.2...v2.0.3

[2.0.2] - 2026-03-23

What's Changed

📦 Dependencies

  • Bump urllib3 from 2.5.0 to 2.6.3 by @dependabot[bot] in #21

🔧 Other Changes

  • Removed qualifiers by @dacoburn in #1
  • Doug/fix trivy socket results by @dacoburn in #2
  • Fix action.yml configuration and add GitHub token by @dacoburn in #3
  • Update action.yml description for clarity by @dacoburn in #4
  • docs: fix link by @ahmadnassri in #5
  • Added back in transitive logic and fixed format of integration messages by @dacoburn in #6
  • Fixed documentation and version checks by @dacoburn in #7
  • Added action inputs by @dacoburn in #8
  • Updated examples with PR check and pinning to commit hashes by @dacoburn in #9
  • Fixing issue of the git detection logic not using the workspace or GI… by @dacoburn in #10
  • Doug/add node and socket back into container by @dacoburn in #11
  • Fix for caching result by @dacoburn in #12
  • Doug/improve default sast ruleset by @dacoburn in #13
  • Fixed hard coded detection for golang by @dacoburn in #14
  • Fixing regression in rule name by @dacoburn in #15
  • Remove non-existent install options from local-installation.md by @graydonhope in #16
  • Fix: Empty CLI string defaults no longer override env/API config by @dc-larsen in #17
  • Bump version to 1.0.26 by @dc-larsen in #20
  • docs: add Dockerfile auto-discovery workflow pattern by @dc-larsen in #25
  • Add scan_type parameter to full scan API calls by @mtorp in #24
  • Upgrade 1.0.28 by @mtorp in #27
  • feat: add SKIP_SOCKET_REACH and SKIP_SOCKET_SUBMISSION env vars for Node.js Socket CLI integration by @jdalton in #29
  • Remove CODEOWNERS entry for @SocketDev/eng by @Raynos in #31
  • Improve usefulness of generic output by @trevnorris in #28
  • Pin trufflehog to known-good version tag by @lelia in #32
  • Fix notifiers reading repo/branch from wrong source by @dc-larsen in #30
  • Fix: Jira dashboard config params not reaching notifier by @dc-larsen in #22
  • Update CODEOWNERS to reference GitHub Enterprise team name by @lelia in #33
  • Enhance GitHub PR comment experience by @lelia in #26
  • Fix CODEOWNERS syntax by @lelia in #35
  • Fix webhook notifier not reading URL from dashboard config by @dc-larsen in #34
  • Final CODEOWNERS update with new team name by @lelia in #36
  • Bump Trivy from v0.67.2 to v0.69.2 by @dc-larsen in #39
  • Bump version to prep for release by @lelia in #40
  • Pin opengrep version, add Docker smoketest by @lelia in #41
  • Add GitHub workflow for pytest by @lelia in #42
  • Fix Slack and MS Teams notifiers not reading URL from dashboard config by @dc-larsen in #37
  • Add structured findings to webhook payload by @dc-larsen in #38
  • feat: 🐳 multi-stage Docker builds, immutable release pipeline, CHANGELOG automation by @lelia in #46
  • fix(ci): add conventional commit prefixes to Dependabot config by @lelia in #53
  • fix(ci): support breaking change indicator (!) in commit-lint pattern by @lelia in #54
  • fix(ci): accept full tag name in workflow_dispatch, drop auto-v-prefix by @lelia in #55
  • feat!: switch to pre-built GHCR images by @lelia in #48
  • fix: remove trivy from Docker build while assessing compromise impact by @dacoburn in #56
  • chore: fix release and updater script by @lelia in #57

New Contributors

  • @dacoburn made their first contribution in #1
  • @ahmadnassri made their first contribution in #5
  • @graydonhope made their first contribution in #16
  • @dc-larsen made their first contribution in #17
  • @mtorp made their first contribution in #24
  • @jdalton made their first contribution in #29
  • @Raynos made their first contribution in #31
  • @dependabot[bot] made their first contribution in #21
  • @trevnorris made their first contribution in #28
  • @lelia made their first contribution in #32

Full Changelog: https://github.com/SocketDev/socket-basics/commits/v2.0.2