From 23808be600d8000893c93aa69cbab4dcd392c56c Mon Sep 17 00:00:00 2001
From: lelia <2418071+lelia@users.noreply.github.com>
Date: Tue, 20 Oct 2026 22:23:21 -0400
Subject: [PATCH 01/10] chore(release): 3.4.1

Stamps [Unreleased] as [3.4.1], bumps the version files and uv.lock, and
synchronizes the current-release references across README.md and docs/**.

Also bumps the Socket Python CLI in the heavy and app-tests images from 2.9.0
to 2.11.2, which carries the eMudhra CA fix for the CLI's own image.
---
 CHANGELOG.md                    |  6 +++
 Dockerfile.heavy                |  2 +-
 README.md                       |  6 +--
 action.yml                      |  2 +-
 app_tests/Dockerfile            |  2 +-
 docs/github-action.md           | 64 ++++++++++++------------
 docs/github-pr-comment-guide.md |  2 +-
 docs/local-install-docker.md    | 88 ++++++++++++++++-----------------
 docs/parameters.md              |  2 +-
 docs/pre-commit-hook.md         | 10 ++--
 pyproject.toml                  |  2 +-
 socket_basics/__init__.py       |  2 +-
 socket_basics/version.py        |  2 +-
 uv.lock                         |  4 +-
 14 files changed, 100 insertions(+), 94 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index a671653..fd1ad8d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,12 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [3.4.1] - 2026-10-20
+
+### Changed
+- Socket Python CLI 2.9.0 -> 2.11.2 in the heavy and app-tests images. 2.11.2
+  carries the same eMudhra CA fix for its own image (SocketDev/socket-python-cli#415).
+
 ### Fixed
 
 - **The images no longer trust certificates from the compromised eMudhra
diff --git a/Dockerfile.heavy b/Dockerfile.heavy
index 64a839c..b18040e 100644
--- a/Dockerfile.heavy
+++ b/Dockerfile.heavy
@@ -4,7 +4,7 @@ ARG TRUFFLEHOG_VERSION=3.96.0
 ARG UV_VERSION=0.12.1
 ARG OPENGREP_VERSION=v1.26.0
 ARG SOCKET_NPM_CLI_VERSION=1.1.165
-ARG SOCKET_PYTHON_CLI_VERSION=2.9.0
+ARG SOCKET_PYTHON_CLI_VERSION=2.11.2
 # Socket-built Trivy, pinned by digest — see the note in ./Dockerfile.
 ARG TRIVY_IMAGE=ghcr.io/socketdev/trivy:0.73.0@sha256:e3d9d5f10250cb73b0ea9446ae1191c0f2da2f5e6173eac08a840b1812f02e0b
 
diff --git a/README.md b/README.md
index b87bc58..a182bd8 100644
--- a/README.md
+++ b/README.md
@@ -35,7 +35,7 @@ jobs:
       - name: Run Socket Basics
         # Pin to a commit SHA for supply-chain safety.
         # Dependabot will keep this up to date automatically — see docs/github-action.md.
-        uses: SocketDev/socket-basics@<sha>  # v3.4.0
+        uses: SocketDev/socket-basics@<sha>  # v3.4.1
         env:
           GITHUB_PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
         with:
@@ -179,10 +179,10 @@ For GitHub Actions, see the [Quick Start](#-quick-start---github-actions) above
 
 ```bash
 # Pull the pre-built image (recommended — no build step required)
-docker pull ghcr.io/socketdev/socket-basics:3.4.0
+docker pull ghcr.io/socketdev/socket-basics:3.4.1
 
 # Run scan
-docker run --rm -v "$PWD:/workspace" ghcr.io/socketdev/socket-basics:3.4.0 \
+docker run --rm -v "$PWD:/workspace" ghcr.io/socketdev/socket-basics:3.4.1 \
   --workspace /workspace \
   --python \
   --secrets \
diff --git a/action.yml b/action.yml
index 0c69b8b..e9e8319 100644
--- a/action.yml
+++ b/action.yml
@@ -4,7 +4,7 @@ author: "Socket"
 
 runs:
   using: "docker"
-  image: "docker://ghcr.io/socketdev/socket-basics:3.4.0"
+  image: "docker://ghcr.io/socketdev/socket-basics:3.4.1"
   env:
     # Core GitHub variables (these are automatically available, but we explicitly pass GITHUB_TOKEN)
     GITHUB_TOKEN: ${{ inputs.github_token }}
diff --git a/app_tests/Dockerfile b/app_tests/Dockerfile
index 46d1104..32ec0f2 100644
--- a/app_tests/Dockerfile
+++ b/app_tests/Dockerfile
@@ -13,7 +13,7 @@ ARG UV_VERSION=0.12.1
 ARG GOSEC_VERSION=v2.28.0
 ARG OPENGREP_VERSION=v1.26.0
 ARG SOCKET_NPM_CLI_VERSION=1.1.165
-ARG SOCKET_PYTHON_CLI_VERSION=2.9.0
+ARG SOCKET_PYTHON_CLI_VERSION=2.11.2
 #
 # NOT Dependabot-trackable — Socket-built Trivy, pinned by digest; updated by
 # Socket's trivy-dist release process. See the note in the root ./Dockerfile.
diff --git a/docs/github-action.md b/docs/github-action.md
index b8513a9..cfedadd 100644
--- a/docs/github-action.md
+++ b/docs/github-action.md
@@ -43,7 +43,7 @@ jobs:
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Run Socket Basics
-        uses: SocketDev/socket-basics@v3.4.0
+        uses: SocketDev/socket-basics@v3.4.1
         env:
           GITHUB_PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
         with:
@@ -59,7 +59,7 @@ Without dashboard configuration, every scanner input defaults to off, so turn on
 
 ### How the action is currently built
 
-When you reference `uses: SocketDev/socket-basics@v3.4.0`, GitHub Actions pulls the
+When you reference `uses: SocketDev/socket-basics@v3.4.1`, GitHub Actions pulls the
 pre-built image referenced by [`action.yml`](../action.yml). The historical multi-stage
 Docker build still matters for maintainers because it determines what lands in the
 published image:
@@ -77,7 +77,7 @@ Socket Basics from source in every workflow run.
 ### Pre-built image
 
 Starting with v2, the action pulls a pre-built image from GHCR rather than
-building from source on every run. Pinning to a specific version tag (e.g. `@v3.4.0`)
+building from source on every run. Pinning to a specific version tag (e.g. `@v3.4.1`)
 means the action starts in seconds — the image is built, integration-tested, and
 published before the release tag is ever created.
 
@@ -87,7 +87,7 @@ If you run socket-basics in other CI systems (Jenkins, GitLab, CircleCI, etc.) o
 as a standalone `docker run`, pull the pre-built image directly:
 
 ```bash
-docker pull ghcr.io/socketdev/socket-basics:3.4.0
+docker pull ghcr.io/socketdev/socket-basics:3.4.1
 ```
 
 See [Local Docker Installation](local-install-docker.md) for usage examples.
@@ -103,7 +103,7 @@ is immediately affected. We've seen this happen across the ecosystem:
   publish `:latest`/`:latest-heavy` Docker aliases as an onboarding
   convenience, but treat them as exactly that — production pipelines should
   pin an exact version or digest.)
-- **Version tags** (`@v3.4.0`) are better, but tags are mutable by default.
+- **Version tags** (`@v3.4.1`) are better, but tags are mutable by default.
   A tag can be deleted and recreated pointing at a different commit. There are
   documented cases of this happening — maliciously and accidentally.
 - **Commit SHAs** are the only truly immutable reference. A SHA cannot be
@@ -128,14 +128,14 @@ The only truly immutable reference. Dependabot keeps it current automatically.
 ```yaml
 - name: Run Socket Basics
   # Dependabot keeps this SHA up to date — see .github/dependabot.yml setup below.
-  uses: SocketDev/socket-basics@<sha>  # v3.4.0
+  uses: SocketDev/socket-basics@<sha>  # v3.4.1
   with:
     socket_security_api_key: ${{ secrets.SOCKET_SECURITY_API_KEY }}
 ```
 
 Get the SHA for any release:
 ```bash
-git ls-remote https://github.com/SocketDev/socket-basics refs/tags/v3.4.0
+git ls-remote https://github.com/SocketDev/socket-basics refs/tags/v3.4.1
 ```
 
 ---
@@ -147,7 +147,7 @@ enforces tag protection rules). SHA pinning is still preferable for defence
 in depth.
 
 ```yaml
-- uses: SocketDev/socket-basics@v3.4.0
+- uses: SocketDev/socket-basics@v3.4.1
   with:
     socket_security_api_key: ${{ secrets.SOCKET_SECURITY_API_KEY }}
 ```
@@ -168,7 +168,7 @@ updates:
 ```
 
 Dependabot opens a PR for each new release, updating the SHA or version tag
-and keeping the `# v3.4.0` comment in sync. You review, approve, and merge
+and keeping the `# v3.4.1` comment in sync. You review, approve, and merge
 on your own schedule — automated upgrades with a human gate.
 
 ---
@@ -178,7 +178,7 @@ on your own schedule — automated upgrades with a human gate.
 | Strategy | Immutable? | Auto-updates | Review gate |
 |---|---|---|---|
 | `@v2` floating tag | ❌ (not published) | — | — |
-| `@v3.4.0` + Dependabot | ✅ (tag protection enforced) | Yes (weekly PR) | Yes |
+| `@v3.4.1` + Dependabot | ✅ (tag protection enforced) | Yes (weekly PR) | Yes |
 | `@<sha>` + Dependabot | ✅ always | Yes (weekly PR) | Yes |
 
 ## Basic Configuration
@@ -219,7 +219,7 @@ Include these in your workflow's `jobs.<job_id>.permissions` section.
 
 **SAST (Static Analysis):**
 ```yaml
-- uses: SocketDev/socket-basics@v3.4.0
+- uses: SocketDev/socket-basics@v3.4.1
   with:
     github_token: ${{ secrets.GITHUB_TOKEN }}
     # Enable SAST for specific languages
@@ -233,7 +233,7 @@ Include these in your workflow's `jobs.<job_id>.permissions` section.
 
 **Secret Scanning:**
 ```yaml
-- uses: SocketDev/socket-basics@v3.4.0
+- uses: SocketDev/socket-basics@v3.4.1
   with:
     github_token: ${{ secrets.GITHUB_TOKEN }}
     secret_scanning_enabled: 'true'
@@ -253,7 +253,7 @@ Include these in your workflow's `jobs.<job_id>.permissions` section.
 
 **Container Scanning:**
 ```yaml
-- uses: SocketDev/socket-basics@v3.4.0
+- uses: SocketDev/socket-basics@v3.4.1
   with:
     github_token: ${{ secrets.GITHUB_TOKEN }}
     # Listing images or Dockerfiles auto-enables the matching Trivy scan.
@@ -280,7 +280,7 @@ path that does not exist is skipped with a `Dockerfile not found` warning.
 
 **Socket Tier 1 Reachability:**
 ```yaml
-- uses: SocketDev/socket-basics@v3.4.0
+- uses: SocketDev/socket-basics@v3.4.1
   with:
     github_token: ${{ secrets.GITHUB_TOKEN }}
     socket_tier_1_enabled: 'true'
@@ -289,7 +289,7 @@ path that does not exist is skipped with a `Dockerfile not found` warning.
 ### Output Configuration
 
 ```yaml
-- uses: SocketDev/socket-basics@v3.4.0
+- uses: SocketDev/socket-basics@v3.4.1
   with:
     github_token: ${{ secrets.GITHUB_TOKEN }}
     python_sast_enabled: 'true'
@@ -327,7 +327,7 @@ jobs:
           fetch-depth: 0
 
       - name: Run Socket Basics (changed files only)
-        uses: SocketDev/socket-basics@v3.4.0
+        uses: SocketDev/socket-basics@v3.4.1
         env:
           GITHUB_PR_NUMBER: ${{ github.event.pull_request.number }}
         with:
@@ -456,7 +456,7 @@ Configure Socket Basics centrally from the [Socket Dashboard](https://socket.dev
 
 **Enable in workflow:**
 ```yaml
-- uses: SocketDev/socket-basics@v3.4.0
+- uses: SocketDev/socket-basics@v3.4.1
   env:
     GITHUB_PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
   with:
@@ -469,7 +469,7 @@ Configure Socket Basics centrally from the [Socket Dashboard](https://socket.dev
 > [!NOTE]
 > You can also pass credentials using environment variables instead of the `with:` section:
 > ```yaml
-> - uses: SocketDev/socket-basics@v3.4.0
+> - uses: SocketDev/socket-basics@v3.4.1
 >   env:
 >     SOCKET_SECURITY_API_KEY: ${{ secrets.SOCKET_SECURITY_API_KEY }}
 >   with:
@@ -540,7 +540,7 @@ directly as a step:
   run: docker build -t myapp:${{ github.sha }} .
 
 - name: Run Socket Basics
-  uses: docker://ghcr.io/socketdev/socket-basics:3.4.0
+  uses: docker://ghcr.io/socketdev/socket-basics:3.4.1
   env:
     SOCKET_SECURITY_API_KEY: ${{ secrets.SOCKET_SECURITY_API_KEY }}
     GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -559,7 +559,7 @@ the dashboard. Running the image directly differs from the action in two ways:
   for some languages.
 - The step isn't tied to an action version, so update the image tag yourself
   when you upgrade. To pin by digest, append `@sha256:<digest>` to the image.
-  `docker buildx imagetools inspect ghcr.io/socketdev/socket-basics:3.4.0`
+  `docker buildx imagetools inspect ghcr.io/socketdev/socket-basics:3.4.1`
   prints the digest.
 
 See the [Parameters Reference](parameters.md) for every CLI flag.
@@ -570,7 +570,7 @@ All notification integrations require Socket Enterprise.
 
 **Slack Notifications:**
 ```yaml
-- uses: SocketDev/socket-basics@v3.4.0
+- uses: SocketDev/socket-basics@v3.4.1
   with:
     github_token: ${{ secrets.GITHUB_TOKEN }}
     socket_org: ${{ secrets.SOCKET_ORG }}
@@ -582,7 +582,7 @@ All notification integrations require Socket Enterprise.
 
 **Jira Issue Creation:**
 ```yaml
-- uses: SocketDev/socket-basics@v3.4.0
+- uses: SocketDev/socket-basics@v3.4.1
   with:
     github_token: ${{ secrets.GITHUB_TOKEN }}
     socket_org: ${{ secrets.SOCKET_ORG }}
@@ -597,7 +597,7 @@ All notification integrations require Socket Enterprise.
 
 **Microsoft Teams:**
 ```yaml
-- uses: SocketDev/socket-basics@v3.4.0
+- uses: SocketDev/socket-basics@v3.4.1
   with:
     github_token: ${{ secrets.GITHUB_TOKEN }}
     socket_org: ${{ secrets.SOCKET_ORG }}
@@ -609,7 +609,7 @@ All notification integrations require Socket Enterprise.
 
 **Generic Webhook:**
 ```yaml
-- uses: SocketDev/socket-basics@v3.4.0
+- uses: SocketDev/socket-basics@v3.4.1
   with:
     github_token: ${{ secrets.GITHUB_TOKEN }}
     socket_org: ${{ secrets.SOCKET_ORG }}
@@ -621,7 +621,7 @@ All notification integrations require Socket Enterprise.
 
 **SIEM Integration:**
 ```yaml
-- uses: SocketDev/socket-basics@v3.4.0
+- uses: SocketDev/socket-basics@v3.4.1
   with:
     github_token: ${{ secrets.GITHUB_TOKEN }}
     socket_org: ${{ secrets.SOCKET_ORG }}
@@ -657,7 +657,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       
       - name: Run Socket Basics
-        uses: SocketDev/socket-basics@v3.4.0
+        uses: SocketDev/socket-basics@v3.4.1
         env:
           GITHUB_PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
         with:
@@ -699,7 +699,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       
       - name: Run Full Security Scan
-        uses: SocketDev/socket-basics@v3.4.0
+        uses: SocketDev/socket-basics@v3.4.1
         env:
           GITHUB_PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
         with:
@@ -765,7 +765,7 @@ jobs:
         run: docker build -t myapp:${{ github.sha }} .
 
       - name: Run Socket Basics (image + Dockerfile scan)
-        uses: SocketDev/socket-basics@v3.4.0
+        uses: SocketDev/socket-basics@v3.4.1
         env:
           GITHUB_PR_NUMBER: ${{ github.event.pull_request.number }}
         with:
@@ -790,7 +790,7 @@ For repositories with multiple Dockerfiles across different directories, you can
 >
 > ```yaml
 > - name: Run Socket Basics
->   uses: docker://ghcr.io/socketdev/socket-basics:3.4.0
+>   uses: docker://ghcr.io/socketdev/socket-basics:3.4.1
 >   env:
 >     SOCKET_SECURITY_API_KEY: ${{ secrets.SOCKET_SECURITY_API_KEY }}
 >     GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -847,7 +847,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Run Socket Basics
-        uses: SocketDev/socket-basics@v3.4.0
+        uses: SocketDev/socket-basics@v3.4.1
         env:
           GITHUB_PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
         with:
@@ -905,7 +905,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       
       - name: Run Socket Basics
-        uses: SocketDev/socket-basics@v3.4.0
+        uses: SocketDev/socket-basics@v3.4.1
         env:
           GITHUB_PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
         with:
@@ -1070,7 +1070,7 @@ in the [name mapping](parameters.md#name-mapping).
 ```yaml
 steps:
   - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - Must be first
-  - uses: SocketDev/socket-basics@v3.4.0
+  - uses: SocketDev/socket-basics@v3.4.1
 ```
 
 ### PR Comments Not Appearing
diff --git a/docs/github-pr-comment-guide.md b/docs/github-pr-comment-guide.md
index 914bb7b..ca8d21b 100644
--- a/docs/github-pr-comment-guide.md
+++ b/docs/github-pr-comment-guide.md
@@ -315,7 +315,7 @@ PR. This is for teams who want to review finding quality in the Socket dashboard
 first, without every PR growing a comment that developers have to scroll past.
 
 ```yaml
-- uses: SocketDev/socket-basics@v3.4.0
+- uses: SocketDev/socket-basics@v3.4.1
   with:
     socket_security_api_key: ${{ secrets.SOCKET_SECURITY_API_KEY }}
     github_token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/docs/local-install-docker.md b/docs/local-install-docker.md
index 570aa1f..8fca8f5 100644
--- a/docs/local-install-docker.md
+++ b/docs/local-install-docker.md
@@ -16,7 +16,7 @@ Run Socket Basics locally using Docker without installing security tools on your
 
 ```bash
 # 1. Pull a pinned release from GHCR (no build step required)
-docker pull ghcr.io/socketdev/socket-basics:3.4.0
+docker pull ghcr.io/socketdev/socket-basics:3.4.1
 
 # 2. Create .env file with your credentials (the API key is environment-only;
 #    the organization can also be passed per run with --socket-org)
@@ -29,14 +29,14 @@ EOF
 docker run --rm \
   -v "$PWD:/workspace" \
   --env-file .env \
-  ghcr.io/socketdev/socket-basics:3.4.0 \
+  ghcr.io/socketdev/socket-basics:3.4.1 \
   --workspace /workspace \
   --python \
   --secrets \
   --console-tabular-enabled
 ```
 
-The Docker image should always be pinned to an exact version such as `3.4.0`. Avoid
+The Docker image should always be pinned to an exact version such as `3.4.1`. Avoid
 floating tags like `:latest` in CI/CD.
 
 ## Using Pre-built Images
@@ -46,13 +46,13 @@ The baked-in security tool versions are recorded in the image labels so you can
 inspect exactly what's inside:
 
 ```bash
-docker inspect ghcr.io/socketdev/socket-basics:3.4.0 \
+docker inspect ghcr.io/socketdev/socket-basics:3.4.1 \
   | jq '.[0].Config.Labels'
 # {
 #   "com.socket.trivy-version": "0.73.0",
 #   "com.socket.trufflehog-version": "3.96.0",
 #   "com.socket.opengrep-version": "v1.26.0",
-#   "org.opencontainers.image.version": "3.4.0",
+#   "org.opencontainers.image.version": "3.4.1",
 #   ...
 # }
 ```
@@ -90,8 +90,8 @@ tool: `socketcli` runs the Python CLI; `socket-basics`, or any other argument,
 runs Socket Basics:
 
 ```bash
-docker run --rm -v "$PWD:/workspace" ghcr.io/socketdev/socket-basics:3.4.0-heavy socketcli --help
-docker run --rm -v "$PWD:/workspace" ghcr.io/socketdev/socket-basics:3.4.0-heavy --workspace /workspace --python
+docker run --rm -v "$PWD:/workspace" ghcr.io/socketdev/socket-basics:3.4.1-heavy socketcli --help
+docker run --rm -v "$PWD:/workspace" ghcr.io/socketdev/socket-basics:3.4.1-heavy --workspace /workspace --python
 ```
 
 `latest` and `latest-heavy` are floating aliases published for onboarding
@@ -109,7 +109,7 @@ comments and labels. If you must run the image directly, pin the exact version:
       -v "$GITHUB_WORKSPACE:/workspace" \
       -e SOCKET_SECURITY_API_KEY=${{ secrets.SOCKET_SECURITY_API_KEY }} \
       -e SOCKET_ORG=${{ secrets.SOCKET_ORG }} \
-      ghcr.io/socketdev/socket-basics:3.4.0 \
+      ghcr.io/socketdev/socket-basics:3.4.1 \
       --workspace /workspace \
       --python \
       --javascript \
@@ -122,7 +122,7 @@ comments and labels. If you must run the image directly, pin the exact version:
 ```yaml
 security-scan:
   image:
-    name: ghcr.io/socketdev/socket-basics:3.4.0
+    name: ghcr.io/socketdev/socket-basics:3.4.1
     entrypoint: [""]   # GitLab needs a shell; the image's entrypoint is socket-basics
   stage: test
   script:
@@ -141,7 +141,7 @@ security-scan:
 
 ```dockerfile
 # Pin socket-basics and let Dependabot send upgrade PRs automatically
-FROM ghcr.io/socketdev/socket-basics:3.4.0
+FROM ghcr.io/socketdev/socket-basics:3.4.1
 ```
 
 ### Staying Up to Date with Dependabot
@@ -159,7 +159,7 @@ updates:
       interval: "weekly"
 ```
 
-Dependabot will detect the `FROM ghcr.io/socketdev/socket-basics:3.4.0` reference
+Dependabot will detect the `FROM ghcr.io/socketdev/socket-basics:3.4.1` reference
 and open a PR with the version bump when a new release is available.
 
 ## Building the Docker Image
@@ -170,10 +170,10 @@ Pull a specific release without building locally:
 
 ```bash
 # GHCR (preferred)
-docker pull ghcr.io/socketdev/socket-basics:3.4.0
+docker pull ghcr.io/socketdev/socket-basics:3.4.1
 
 # Docker Hub
-docker pull socketdev/socket-basics:3.4.0
+docker pull socketdev/socket-basics:3.4.1
 ```
 
 ### Build from Source
@@ -186,7 +186,7 @@ git clone https://github.com/SocketDev/socket-basics.git
 cd socket-basics
 
 # Build with version tag (multi-stage; first build is slower, subsequent ones are fast)
-docker build -t socket-basics:3.4.0 .
+docker build -t socket-basics:3.4.1 .
 
 # Verify the build
 docker images | grep socket-basics
@@ -195,7 +195,7 @@ docker images | grep socket-basics
 ### Build for a Specific Platform (M1/M2 Macs)
 
 ```bash
-docker build --platform linux/amd64 -t socket-basics:3.4.0 .
+docker build --platform linux/amd64 -t socket-basics:3.4.1 .
 ```
 
 ### Build with Custom Tool Versions
@@ -206,7 +206,7 @@ The image pins the bundled tools to specific versions. You can override them at
 docker build \
   --build-arg TRUFFLEHOG_VERSION=3.96.0 \
   --build-arg OPENGREP_VERSION=v1.26.0 \
-  -t socket-basics:3.4.0 .
+  -t socket-basics:3.4.1 .
 ```
 
 Trivy comes from a Socket-built image pinned by digest via the `TRIVY_IMAGE`
@@ -219,13 +219,13 @@ tests image, build from the `app_tests` directory and use the same build args.
 
 ```bash
 # The image's entrypoint is `socket-basics`, so its own flags need no prefix
-docker run --rm socket-basics:3.4.0 --version
+docker run --rm socket-basics:3.4.1 --version
 
 # Other bundled tools need --entrypoint
-docker run --rm --entrypoint socket     socket-basics:3.4.0 --version
-docker run --rm --entrypoint opengrep   socket-basics:3.4.0 --version
-docker run --rm --entrypoint trufflehog socket-basics:3.4.0 --version
-docker run --rm --entrypoint trivy      socket-basics:3.4.0 --version
+docker run --rm --entrypoint socket     socket-basics:3.4.1 --version
+docker run --rm --entrypoint opengrep   socket-basics:3.4.1 --version
+docker run --rm --entrypoint trufflehog socket-basics:3.4.1 --version
+docker run --rm --entrypoint trivy      socket-basics:3.4.1 --version
 ```
 
 ### Smoke Test
@@ -260,7 +260,7 @@ Mount your project directory into the container:
 # Scan current directory
 docker run --rm \
   -v "$PWD:/workspace" \
-  socket-basics:3.4.0 \
+  socket-basics:3.4.1 \
   --workspace /workspace \
   --python \
   --secrets \
@@ -277,7 +277,7 @@ docker run --rm \
 # Scan a specific project directory
 docker run --rm \
   -v "/path/to/your/project:/workspace" \
-  socket-basics:3.4.0 \
+  socket-basics:3.4.1 \
   --workspace /workspace \
   --javascript \
   --secrets
@@ -288,7 +288,7 @@ docker run --rm \
 ```bash
 docker run --rm \
   -v "$PWD:/workspace" \
-  socket-basics:3.4.0 \
+  socket-basics:3.4.1 \
   --workspace /workspace \
   --all-languages \
   --secrets \
@@ -341,7 +341,7 @@ INPUT_VERBOSE=false
 docker run --rm \
   -v "$PWD:/workspace" \
   --env-file .env \
-  socket-basics:3.4.0 \
+  socket-basics:3.4.1 \
   --workspace /workspace \
   --python \
   --secrets
@@ -356,7 +356,7 @@ docker run --rm \
   -v "$PWD:/workspace" \
   -e "SOCKET_SECURITY_API_KEY=scrt_your_api_key" \
   -e "SOCKET_ORG=your-org-slug" \
-  socket-basics:3.4.0 \
+  socket-basics:3.4.1 \
   --workspace /workspace \
   --python \
   --secrets \
@@ -378,7 +378,7 @@ docker run --rm \
   --env-file .env.socket \
   --env-file .env.notifiers \
   --env-file .env.scanning \
-  socket-basics:3.4.0 \
+  socket-basics:3.4.1 \
   --workspace /workspace \
   --all-languages
 ```
@@ -397,7 +397,7 @@ docker run --rm \
   -v "$PWD:/workspace" \
   -e "SOCKET_SECURITY_API_KEY=$SOCKET_SECURITY_API_KEY" \
   -e "SOCKET_ORG=$SOCKET_ORG" \
-  socket-basics:3.4.0 \
+  socket-basics:3.4.1 \
   --workspace /workspace \
   --python
 ```
@@ -424,7 +424,7 @@ docker run --rm \
   -e GITHUB_TOKEN \
   -e GITHUB_REPOSITORY=owner/repo \
   -e GITHUB_PR_NUMBER=123 \
-  ghcr.io/socketdev/socket-basics:3.4.0 \
+  ghcr.io/socketdev/socket-basics:3.4.1 \
   --workspace /workspace \
   --python --javascript --secrets
 ```
@@ -463,7 +463,7 @@ mkdir -p ./scan-results
 docker run --rm \
   -v "$PWD:/workspace" \
   --env-file .env \
-  socket-basics:3.4.0 \
+  socket-basics:3.4.1 \
   --workspace /workspace \
   --python \
   --secrets \
@@ -488,7 +488,7 @@ docker run --rm -it \
   -v "$PWD:/workspace" \
   --env-file .env \
   --entrypoint /bin/bash \
-  socket-basics:3.4.0
+  socket-basics:3.4.1
 
 # Inside container, run commands manually:
 # cd /workspace
@@ -517,7 +517,7 @@ docker run --rm \
   -v "$PWD:/workspace" \
   -v "$PWD/socket-config.json:/config.json" \
   --env-file .env \
-  socket-basics:3.4.0 \
+  socket-basics:3.4.1 \
   --workspace /workspace \
   --config /config.json
 ```
@@ -541,7 +541,7 @@ for PROJECT in "${PROJECTS[@]}"; do
   docker run --rm \
     -v "$PROJECT:/workspace" \
     --env-file .env \
-    socket-basics:3.4.0 \
+    socket-basics:3.4.1 \
     --workspace /workspace \
     --all-languages \
     --secrets \
@@ -584,7 +584,7 @@ pipeline {
                 script {
                     // --entrypoint='' is required: Jenkins runs `cat` to keep the
                     // container alive, and the image's entrypoint is socket-basics.
-                    docker.image('ghcr.io/socketdev/socket-basics:3.4.0').inside(
+                    docker.image('ghcr.io/socketdev/socket-basics:3.4.1').inside(
                         "--entrypoint='' -v ${WORKSPACE}:/workspace --env-file .env"
                     ) {
                         sh '''
@@ -607,7 +607,7 @@ pipeline {
 ```yaml
 security-scan:
   image:
-    name: ghcr.io/socketdev/socket-basics:3.4.0
+    name: ghcr.io/socketdev/socket-basics:3.4.1
     entrypoint: [""]   # GitLab needs a shell; the image's entrypoint is socket-basics
   stage: test
   script:
@@ -650,7 +650,7 @@ security-scan:
    ```bash
    docker run --rm \
      -v "$(pwd):/workspace" \  # Use $(pwd) instead of $PWD
-     socket-basics:3.4.0
+     socket-basics:3.4.1
    ```
 
 2. Verify mount (the entrypoint is `socket-basics`, so override it to run `ls`):
@@ -658,7 +658,7 @@ security-scan:
    docker run --rm \
      -v "$PWD:/workspace" \
      --entrypoint ls \
-     socket-basics:3.4.0 \
+     socket-basics:3.4.1 \
      -la /workspace
    ```
 
@@ -688,7 +688,7 @@ security-scan:
    docker run --rm \
      -v "$PWD:/workspace" \
      --env-file "$(pwd)/.env" \
-     socket-basics:3.4.0
+     socket-basics:3.4.1
    ```
 
 ### Container Image Too Large
@@ -719,7 +719,7 @@ security-scan:
    ```bash
    docker run --rm \
      -v "$PWD:/workspace" \
-     socket-basics:3.4.0 \
+     socket-basics:3.4.1 \
      --workspace /workspace \
      --python \
      --secrets \
@@ -740,7 +740,7 @@ security-scan:
    ```bash
    docker run --rm \
      -v "$PWD:/workspace" \
-     socket-basics:3.4.0 \
+     socket-basics:3.4.1 \
      --workspace /workspace \
      --output /workspace/results.json  # Save to mounted directory
    ```
@@ -751,7 +751,7 @@ security-scan:
    mkdir -p ./scan-results
    docker run --rm \
      -v "$PWD:/workspace" \
-     socket-basics:3.4.0 \
+     socket-basics:3.4.1 \
      --workspace /workspace \
      --output /workspace/scan-results/scan.json
    ```
@@ -784,7 +784,7 @@ Add these to your `~/.bashrc` or `~/.zshrc` for quick access:
 
 ```bash
 # Socket Basics Docker aliases
-alias sb-docker='docker run --rm -v "$PWD:/workspace" --env-file .env ghcr.io/socketdev/socket-basics:3.4.0 --workspace /workspace'
+alias sb-docker='docker run --rm -v "$PWD:/workspace" --env-file .env ghcr.io/socketdev/socket-basics:3.4.1 --workspace /workspace'
 alias sb-quick='sb-docker --secrets --console-tabular-enabled'
 alias sb-python='sb-docker --python --secrets --console-tabular-enabled'
 alias sb-js='sb-docker --javascript --secrets --console-tabular-enabled'
@@ -810,7 +810,7 @@ sb-all
 
 1. **Use pre-built images** — Pull `ghcr.io/socketdev/socket-basics:<version>` instead of building locally
 2. **Use the standard image** — `-heavy` exists for one deployment constraint (see [Image Variants](#image-variants)); it adds nothing to Socket Basics
-3. **Pin to a specific version** — Avoid `:latest` in production CI; pin to `3.4.0` and upgrade deliberately
+3. **Pin to a specific version** — Avoid `:latest` in production CI; pin to `3.4.1` and upgrade deliberately
 4. **Use Dependabot** — Reference the image in your Dockerfile/Compose to get automatic upgrade PRs
 5. **Inspect baked-in labels** — Run `docker inspect <image> | jq '.[0].Config.Labels'` to verify tool versions
 6. **Use .env files** — Keep credentials out of command history
@@ -830,7 +830,7 @@ set -e
 # Configuration
 PROJECT_DIR="$(pwd)"
 RESULTS_DIR="scan-results"   # relative to the project: it must stay inside the workspace
-IMAGE_NAME="ghcr.io/socketdev/socket-basics:3.4.0"
+IMAGE_NAME="ghcr.io/socketdev/socket-basics:3.4.1"
 ENV_FILE=".env"
 
 # Create results directory (add it to .gitignore)
diff --git a/docs/parameters.md b/docs/parameters.md
index 01106ed..eb6bade 100644
--- a/docs/parameters.md
+++ b/docs/parameters.md
@@ -310,7 +310,7 @@ workflow and pass it in yourself:
   run: echo "ref=$(gh pr view ${{ github.event.issue.number }} --json baseRefName -q .baseRefName)" >> "$GITHUB_OUTPUT"
   env:
     GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-- uses: SocketDev/socket-basics@v3.4.0
+- uses: SocketDev/socket-basics@v3.4.1
   env:
     GITHUB_BASE_REF: ${{ steps.prbase.outputs.ref }}
   with:
diff --git a/docs/pre-commit-hook.md b/docs/pre-commit-hook.md
index 496ffbe..c160969 100644
--- a/docs/pre-commit-hook.md
+++ b/docs/pre-commit-hook.md
@@ -41,7 +41,7 @@ Best for: Teams wanting consistent environments without installing security tool
 
 ```bash
 # Pull the pre-built image (no build step required)
-docker pull ghcr.io/socketdev/socket-basics:3.4.0
+docker pull ghcr.io/socketdev/socket-basics:3.4.1
 ```
 
 **2. Create pre-commit hook:**
@@ -64,7 +64,7 @@ fi
 # Run Socket Basics in Docker
 docker run --rm \
   -v "$PWD:/workspace" \
-  ghcr.io/socketdev/socket-basics:3.4.0 \
+  ghcr.io/socketdev/socket-basics:3.4.1 \
   --workspace /workspace \
   --python \
   --javascript \
@@ -118,7 +118,7 @@ fi
 # Scope the scan to the staged changes
 docker run --rm \
   -v "$PWD:/workspace" \
-  ghcr.io/socketdev/socket-basics:3.4.0 \
+  ghcr.io/socketdev/socket-basics:3.4.1 \
   --workspace /workspace \
   --changed-files auto \
   --python \
@@ -153,7 +153,7 @@ docker run --rm \
   -e SOCKET_ORG="$SOCKET_ORG" \
   -e SOCKET_SECURITY_API_KEY="$SOCKET_SECURITY_API_KEY" \
   -e SLACK_WEBHOOK_URL="$SLACK_WEBHOOK_URL" \
-  ghcr.io/socketdev/socket-basics:3.4.0 \
+  ghcr.io/socketdev/socket-basics:3.4.1 \
   --workspace /workspace \
   --python \
   --javascript \
@@ -504,7 +504,7 @@ repos:
     hooks:
       - id: socket-basics
         name: Socket Basics Security Scan
-        entry: docker run --rm -v "$PWD:/workspace" ghcr.io/socketdev/socket-basics:3.4.0 --workspace /workspace --changed-files auto --python --secrets
+        entry: docker run --rm -v "$PWD:/workspace" ghcr.io/socketdev/socket-basics:3.4.1 --workspace /workspace --changed-files auto --python --secrets
         language: system
         pass_filenames: false
 ```
diff --git a/pyproject.toml b/pyproject.toml
index 45e63a0..b763318 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "socket_basics"
-version = "3.4.0"
+version = "3.4.1"
 description = "Socket Basics with integrated SAST, secret scanning, and container analysis"
 readme = "README.md"
 requires-python = ">=3.10"
diff --git a/socket_basics/__init__.py b/socket_basics/__init__.py
index aa00ec2..397e0bf 100644
--- a/socket_basics/__init__.py
+++ b/socket_basics/__init__.py
@@ -12,7 +12,7 @@
 from .socket_basics import SecurityScanner, main
 from .core.config import load_config_from_env, Config
 
-__version__ = "3.4.0"
+__version__ = "3.4.1"
 __author__ = "Socket.dev"
 __email__ = "support@socket.dev"
 
diff --git a/socket_basics/version.py b/socket_basics/version.py
index 903a158..a5cfdf5 100644
--- a/socket_basics/version.py
+++ b/socket_basics/version.py
@@ -1 +1 @@
-__version__ = "3.4.0"
+__version__ = "3.4.1"
diff --git a/uv.lock b/uv.lock
index a9b5905..98f1b5b 100644
--- a/uv.lock
+++ b/uv.lock
@@ -1,5 +1,5 @@
 version = 1
-revision = 3
+revision = 5
 requires-python = ">=3.10"
 
 [[package]]
@@ -692,7 +692,7 @@ wheels = [
 
 [[package]]
 name = "socket-basics"
-version = "3.4.0"
+version = "3.4.1"
 source = { editable = "." }
 dependencies = [
     { name = "certifi" },

From 0c791145ab9ba8e37355937ecef12ed78c7ece95 Mon Sep 17 00:00:00 2001
From: lelia <2418071+lelia@users.noreply.github.com>
Date: Tue, 20 Oct 2026 23:13:47 -0400
Subject: [PATCH 02/10] chore(release): pin Trivy 0.73.0-socket.1 (placeholder
 digest)

Points all three images at the trivy-dist toolchain rebuild of v0.73.0 on Go
1.26.10 (SocketDev/trivy-dist#24). The digest is a placeholder until that
image is published.

check_core_tools now ranks -socket.N GHCR tags above their base version and
drops the suffix from the upstream Go module purl.
---
 CHANGELOG.md                   |  3 +++
 Dockerfile                     |  7 +++++--
 Dockerfile.heavy               |  3 ++-
 app_tests/Dockerfile           |  3 ++-
 scripts/check_core_tools.py    | 12 +++++++++---
 tests/test_check_core_tools.py | 25 ++++++++++++++++++++++++-
 6 files changed, 45 insertions(+), 8 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index fd1ad8d..6312540 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -13,6 +13,9 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 ### Changed
 - Socket Python CLI 2.9.0 -> 2.11.2 in the heavy and app-tests images. 2.11.2
   carries the same eMudhra CA fix for its own image (SocketDev/socket-python-cli#415).
+- Trivy 0.73.0 -> 0.73.0-socket.1: the same upstream source, rebuilt on Go
+  1.26.10, which blocks the compromised eMudhra intermediates in Go itself and
+  clears container scanner findings against Trivy's Go version.
 
 ### Fixed
 
diff --git a/Dockerfile b/Dockerfile
index 19d2eb6..4e67736 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -17,8 +17,11 @@ ARG SOCKET_NPM_CLI_VERSION=1.1.165
 # Building requires pull access to the registry; contributors without it can
 # override, e.g.: docker build --build-arg TRIVY_IMAGE=aquasec/trivy:0.73.0 .
 # TRIVY_VERSION feeds the image label — keep it in sync with the TRIVY_IMAGE tag.
-ARG TRIVY_VERSION=0.73.0
-ARG TRIVY_IMAGE=ghcr.io/socketdev/trivy:0.73.0@sha256:e3d9d5f10250cb73b0ea9446ae1191c0f2da2f5e6173eac08a840b1812f02e0b
+# -socket.N is a trivy-dist toolchain rebuild: same upstream source, newer Go.
+# TODO(release 3.4.1): replace the placeholder digest once trivy-dist publishes
+# 0.73.0-socket.1 (SocketDev/trivy-dist#24), here and in the other two Dockerfiles.
+ARG TRIVY_VERSION=0.73.0-socket.1
+ARG TRIVY_IMAGE=ghcr.io/socketdev/trivy:0.73.0-socket.1@sha256:0000000000000000000000000000000000000000000000000000000000000000
 
 # ─── Stage: trivy (Socket-built redistribution) ───────────────────────────────
 FROM ${TRIVY_IMAGE} AS trivy
diff --git a/Dockerfile.heavy b/Dockerfile.heavy
index b18040e..309dec8 100644
--- a/Dockerfile.heavy
+++ b/Dockerfile.heavy
@@ -6,7 +6,8 @@ ARG OPENGREP_VERSION=v1.26.0
 ARG SOCKET_NPM_CLI_VERSION=1.1.165
 ARG SOCKET_PYTHON_CLI_VERSION=2.11.2
 # Socket-built Trivy, pinned by digest — see the note in ./Dockerfile.
-ARG TRIVY_IMAGE=ghcr.io/socketdev/trivy:0.73.0@sha256:e3d9d5f10250cb73b0ea9446ae1191c0f2da2f5e6173eac08a840b1812f02e0b
+# TODO(release 3.4.1): placeholder digest until trivy-dist publishes 0.73.0-socket.1.
+ARG TRIVY_IMAGE=ghcr.io/socketdev/trivy:0.73.0-socket.1@sha256:0000000000000000000000000000000000000000000000000000000000000000
 
 FROM ${TRIVY_IMAGE} AS trivy
 FROM trufflesecurity/trufflehog:${TRUFFLEHOG_VERSION} AS trufflehog
diff --git a/app_tests/Dockerfile b/app_tests/Dockerfile
index 32ec0f2..f241110 100644
--- a/app_tests/Dockerfile
+++ b/app_tests/Dockerfile
@@ -17,7 +17,8 @@ ARG SOCKET_PYTHON_CLI_VERSION=2.11.2
 #
 # NOT Dependabot-trackable — Socket-built Trivy, pinned by digest; updated by
 # Socket's trivy-dist release process. See the note in the root ./Dockerfile.
-ARG TRIVY_IMAGE=ghcr.io/socketdev/trivy:0.73.0@sha256:e3d9d5f10250cb73b0ea9446ae1191c0f2da2f5e6173eac08a840b1812f02e0b
+# TODO(release 3.4.1): placeholder digest until trivy-dist publishes 0.73.0-socket.1.
+ARG TRIVY_IMAGE=ghcr.io/socketdev/trivy:0.73.0-socket.1@sha256:0000000000000000000000000000000000000000000000000000000000000000
 
 # ─── Stage: trivy (Socket-built redistribution) ───────────────────────────────
 FROM ${TRIVY_IMAGE} AS trivy
diff --git a/scripts/check_core_tools.py b/scripts/check_core_tools.py
index 23e7aeb..74ccf5e 100644
--- a/scripts/check_core_tools.py
+++ b/scripts/check_core_tools.py
@@ -205,9 +205,10 @@ def _ghcr_latest(org: str, package: str) -> Optional[str]:
         ]
         stable_versions = []
         for tag in tags:
-            match = re.fullmatch(r"v?(\d+)\.(\d+)\.(\d+)", tag)
+            # X.Y.Z-socket.N is a trivy-dist toolchain rebuild of X.Y.Z and ranks above it.
+            match = re.fullmatch(r"v?(\d+)\.(\d+)\.(\d+)(?:-socket\.(\d+))?", tag)
             if match:
-                stable_versions.append((tuple(map(int, match.groups())), tag))
+                stable_versions.append((tuple(int(g or 0) for g in match.groups()), tag))
         return max(stable_versions)[1] if stable_versions else None
     except Exception as exc:  # noqa: BLE001
         print(f"  ! GHCR latest-version lookup failed for {org}/{package}: {exc}", file=sys.stderr)
@@ -287,6 +288,11 @@ def _ensure_v(v: str) -> str:
     return v if v.startswith("v") else f"v{v}"
 
 
+def _strip_socket_rebuild(v: str) -> str:
+    """Drop a trivy-dist -socket.N suffix; the upstream module has no such version."""
+    return re.sub(r"-socket\.\d+$", "", v)
+
+
 # ── tool registry ─────────────────────────────────────────────────────────────
 
 
@@ -327,7 +333,7 @@ def build_tools() -> list[Tool]:
             # The Socket distribution is rebuilt from unmodified upstream
             # source. Score that Go module while release discovery follows the
             # Socket-controlled artifact that Basics actually consumes.
-            purl=lambda v: f"pkg:golang/github.com/aquasecurity/trivy@{_ensure_v(v)}",
+            purl=lambda v: f"pkg:golang/github.com/aquasecurity/trivy@{_ensure_v(_strip_socket_rebuild(v))}",
             note="Release drift follows the Socket-built ghcr.io/socketdev/trivy package "
             "(produced by SocketDev/trivy-dist and mirrored privately to Docker Hub), not "
             "Aqua's release feed. Socket scoring uses the corresponding upstream Go module "
diff --git a/tests/test_check_core_tools.py b/tests/test_check_core_tools.py
index 1cfada5..af38660 100644
--- a/tests/test_check_core_tools.py
+++ b/tests/test_check_core_tools.py
@@ -33,6 +33,29 @@ def test_ghcr_latest_ignores_floating_and_prerelease_tags(monkeypatch):
     assert check_core_tools._ghcr_latest("SocketDev", "trivy") == "0.73.0"
 
 
+def test_ghcr_latest_ranks_socket_rebuilds_above_their_base(monkeypatch):
+    monkeypatch.setenv("GITHUB_TOKEN", "test-token")
+    monkeypatch.setattr(
+        check_core_tools,
+        "_get_json",
+        lambda *_args: [
+            {"metadata": {"container": {"tags": ["0.73.0-socket.2"]}}},
+            {"metadata": {"container": {"tags": ["latest", "0.73.0-socket.10"]}}},
+            {"metadata": {"container": {"tags": ["0.73.0"]}}},
+            {"metadata": {"container": {"tags": ["v0.74.0-rc.1"]}}},
+        ],
+    )
+
+    assert check_core_tools._ghcr_latest("SocketDev", "trivy") == "0.73.0-socket.10"
+
+
+def test_trivy_purl_uses_the_upstream_version_for_socket_rebuilds():
+    trivy = next(tool for tool in check_core_tools.build_tools() if tool.key == "trivy")
+
+    assert trivy.purl("0.73.0-socket.1") == "pkg:golang/github.com/aquasecurity/trivy@v0.73.0"
+    assert trivy.purl("0.73.0") == "pkg:golang/github.com/aquasecurity/trivy@v0.73.0"
+
+
 def test_every_socket_tool_is_named_and_pinned_unambiguously():
     tools = {tool.key: tool for tool in check_core_tools.build_tools()}
 
@@ -67,7 +90,7 @@ def test_socket_cli_installs_are_version_pinned():
 def test_trivy_pin_comes_from_socket_image_tag():
     tools = {tool.key: tool for tool in check_core_tools.build_tools()}
 
-    assert tools["trivy"].read_pinned() == ["0.73.0"]
+    assert tools["trivy"].read_pinned() == ["0.73.0-socket.1"]
     assert all(
         "ARG TRIVY_IMAGE=ghcr.io/socketdev/trivy:" in dockerfile.read_text()
         for dockerfile in check_core_tools.DOCKERFILES

From 0d19f7f9fbb913aea5ada21ab12c1946b5410306 Mon Sep 17 00:00:00 2001
From: lelia <2418071+lelia@users.noreply.github.com>
Date: Wed, 21 Oct 2026 16:39:47 -0400
Subject: [PATCH 03/10] chore(release): pin Trivy 0.76.1 (placeholder digest)

Upstream's v0.76.1 is built on Go 1.27.3, so Basics takes Socket's build of
it instead of a 0.73.0 toolchain rebuild (SocketDev/trivy-dist#25). The
digest stays a placeholder until that build publishes.
---
 CHANGELOG.md                   | 8 ++++----
 Dockerfile                     | 6 +++---
 Dockerfile.heavy               | 4 ++--
 app_tests/Dockerfile           | 4 ++--
 docs/local-install-docker.md   | 2 +-
 docs/local-installation.md     | 2 +-
 tests/test_check_core_tools.py | 2 +-
 7 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6312540..0444a74 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -13,9 +13,9 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 ### Changed
 - Socket Python CLI 2.9.0 -> 2.11.2 in the heavy and app-tests images. 2.11.2
   carries the same eMudhra CA fix for its own image (SocketDev/socket-python-cli#415).
-- Trivy 0.73.0 -> 0.73.0-socket.1: the same upstream source, rebuilt on Go
-  1.26.10, which blocks the compromised eMudhra intermediates in Go itself and
-  clears container scanner findings against Trivy's Go version.
+- Trivy 0.73.0 -> 0.76.1, upstream's release for the eMudhra compromise. It is
+  built on Go 1.27.3, which blocks the compromised intermediates in Go itself
+  and clears container scanner findings against Trivy's Go version.
 
 ### Fixed
 
@@ -25,7 +25,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
   2026.10.19 or newer, and source installs (`pip install -e .`) require the same
   `certifi`. curl, git, Python `requests`, pip, Node, and the bundled Trivy and
   TruffleHog now reject those chains. Container scanners may still report
-  CVE-2026-111943 against the Trivy and TruffleHog binaries until they are
+  CVE-2026-111943 against the TruffleHog binary until it is
   rebuilt on Go 1.26.10 or 1.27.3.
 
 ## [3.4.0] - 2026-09-18
diff --git a/Dockerfile b/Dockerfile
index 4e67736..a60ee13 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -19,9 +19,9 @@ ARG SOCKET_NPM_CLI_VERSION=1.1.165
 # TRIVY_VERSION feeds the image label — keep it in sync with the TRIVY_IMAGE tag.
 # -socket.N is a trivy-dist toolchain rebuild: same upstream source, newer Go.
 # TODO(release 3.4.1): replace the placeholder digest once trivy-dist publishes
-# 0.73.0-socket.1 (SocketDev/trivy-dist#24), here and in the other two Dockerfiles.
-ARG TRIVY_VERSION=0.73.0-socket.1
-ARG TRIVY_IMAGE=ghcr.io/socketdev/trivy:0.73.0-socket.1@sha256:0000000000000000000000000000000000000000000000000000000000000000
+# 0.76.1 (SocketDev/trivy-dist#25), here and in the other two Dockerfiles.
+ARG TRIVY_VERSION=0.76.1
+ARG TRIVY_IMAGE=ghcr.io/socketdev/trivy:0.76.1@sha256:0000000000000000000000000000000000000000000000000000000000000000
 
 # ─── Stage: trivy (Socket-built redistribution) ───────────────────────────────
 FROM ${TRIVY_IMAGE} AS trivy
diff --git a/Dockerfile.heavy b/Dockerfile.heavy
index 309dec8..30da489 100644
--- a/Dockerfile.heavy
+++ b/Dockerfile.heavy
@@ -6,8 +6,8 @@ ARG OPENGREP_VERSION=v1.26.0
 ARG SOCKET_NPM_CLI_VERSION=1.1.165
 ARG SOCKET_PYTHON_CLI_VERSION=2.11.2
 # Socket-built Trivy, pinned by digest — see the note in ./Dockerfile.
-# TODO(release 3.4.1): placeholder digest until trivy-dist publishes 0.73.0-socket.1.
-ARG TRIVY_IMAGE=ghcr.io/socketdev/trivy:0.73.0-socket.1@sha256:0000000000000000000000000000000000000000000000000000000000000000
+# TODO(release 3.4.1): placeholder digest until trivy-dist publishes 0.76.1.
+ARG TRIVY_IMAGE=ghcr.io/socketdev/trivy:0.76.1@sha256:0000000000000000000000000000000000000000000000000000000000000000
 
 FROM ${TRIVY_IMAGE} AS trivy
 FROM trufflesecurity/trufflehog:${TRUFFLEHOG_VERSION} AS trufflehog
diff --git a/app_tests/Dockerfile b/app_tests/Dockerfile
index f241110..34863af 100644
--- a/app_tests/Dockerfile
+++ b/app_tests/Dockerfile
@@ -17,8 +17,8 @@ ARG SOCKET_PYTHON_CLI_VERSION=2.11.2
 #
 # NOT Dependabot-trackable — Socket-built Trivy, pinned by digest; updated by
 # Socket's trivy-dist release process. See the note in the root ./Dockerfile.
-# TODO(release 3.4.1): placeholder digest until trivy-dist publishes 0.73.0-socket.1.
-ARG TRIVY_IMAGE=ghcr.io/socketdev/trivy:0.73.0-socket.1@sha256:0000000000000000000000000000000000000000000000000000000000000000
+# TODO(release 3.4.1): placeholder digest until trivy-dist publishes 0.76.1.
+ARG TRIVY_IMAGE=ghcr.io/socketdev/trivy:0.76.1@sha256:0000000000000000000000000000000000000000000000000000000000000000
 
 # ─── Stage: trivy (Socket-built redistribution) ───────────────────────────────
 FROM ${TRIVY_IMAGE} AS trivy
diff --git a/docs/local-install-docker.md b/docs/local-install-docker.md
index 8fca8f5..c928b5f 100644
--- a/docs/local-install-docker.md
+++ b/docs/local-install-docker.md
@@ -49,7 +49,7 @@ inspect exactly what's inside:
 docker inspect ghcr.io/socketdev/socket-basics:3.4.1 \
   | jq '.[0].Config.Labels'
 # {
-#   "com.socket.trivy-version": "0.73.0",
+#   "com.socket.trivy-version": "0.76.1",
 #   "com.socket.trufflehog-version": "3.96.0",
 #   "com.socket.opengrep-version": "v1.26.0",
 #   "org.opencontainers.image.version": "3.4.1",
diff --git a/docs/local-installation.md b/docs/local-installation.md
index 7534d4e..03f2bb6 100644
--- a/docs/local-installation.md
+++ b/docs/local-installation.md
@@ -232,7 +232,7 @@ EOF
 sudo yum -y install trivy
 
 # Using Docker (alternative; always pin an explicit version, ideally by digest):
-docker pull aquasec/trivy:0.73.0
+docker pull aquasec/trivy:0.76.1
 
 # Verify installation
 trivy --version
diff --git a/tests/test_check_core_tools.py b/tests/test_check_core_tools.py
index af38660..51c4edf 100644
--- a/tests/test_check_core_tools.py
+++ b/tests/test_check_core_tools.py
@@ -90,7 +90,7 @@ def test_socket_cli_installs_are_version_pinned():
 def test_trivy_pin_comes_from_socket_image_tag():
     tools = {tool.key: tool for tool in check_core_tools.build_tools()}
 
-    assert tools["trivy"].read_pinned() == ["0.73.0-socket.1"]
+    assert tools["trivy"].read_pinned() == ["0.76.1"]
     assert all(
         "ARG TRIVY_IMAGE=ghcr.io/socketdev/trivy:" in dockerfile.read_text()
         for dockerfile in check_core_tools.DOCKERFILES

From 5c8bb486e720b405cdff7814b41869813526e532 Mon Sep 17 00:00:00 2001
From: lelia <2418071+lelia@users.noreply.github.com>
Date: Wed, 21 Oct 2026 16:42:18 -0400
Subject: [PATCH 04/10] docs(changelog): stage the Socket Python SDK 3.6.1 bump
 for 3.4.1

uv.lock moves once socketdev 3.6.1 is on PyPI.
---
 CHANGELOG.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0444a74..0e99d1b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -13,6 +13,8 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 ### Changed
 - Socket Python CLI 2.9.0 -> 2.11.2 in the heavy and app-tests images. 2.11.2
   carries the same eMudhra CA fix for its own image (SocketDev/socket-python-cli#415).
+- Socket Python SDK 3.6.0 -> 3.6.1, which builds and tests against certifi
+  2026.10.19.
 - Trivy 0.73.0 -> 0.76.1, upstream's release for the eMudhra compromise. It is
   built on Go 1.27.3, which blocks the compromised intermediates in Go itself
   and clears container scanner findings against Trivy's Go version.

From c77391ac699f1cc49974d53394906999c4f09a71 Mon Sep 17 00:00:00 2001
From: lelia <2418071+lelia@users.noreply.github.com>
Date: Wed, 21 Oct 2026 17:46:53 -0400
Subject: [PATCH 05/10] docs(changelog): rewrap the 3.4.1 entry and describe
 SDK 3.6.1 as released

---
 CHANGELOG.md | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0e99d1b..08e2506 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -13,8 +13,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 ### Changed
 - Socket Python CLI 2.9.0 -> 2.11.2 in the heavy and app-tests images. 2.11.2
   carries the same eMudhra CA fix for its own image (SocketDev/socket-python-cli#415).
-- Socket Python SDK 3.6.0 -> 3.6.1, which builds and tests against certifi
-  2026.10.19.
+- Socket Python SDK 3.6.0 -> 3.6.1, which requires `certifi>=2026.10.19`.
 - Trivy 0.73.0 -> 0.76.1, upstream's release for the eMudhra compromise. It is
   built on Go 1.27.3, which blocks the compromised intermediates in Go itself
   and clears container scanner findings against Trivy's Go version.
@@ -27,8 +26,8 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
   2026.10.19 or newer, and source installs (`pip install -e .`) require the same
   `certifi`. curl, git, Python `requests`, pip, Node, and the bundled Trivy and
   TruffleHog now reject those chains. Container scanners may still report
-  CVE-2026-111943 against the TruffleHog binary until it is
-  rebuilt on Go 1.26.10 or 1.27.3.
+  CVE-2026-111943 against the TruffleHog binary until it is rebuilt on Go
+  1.26.10 or 1.27.3.
 
 ## [3.4.0] - 2026-09-18
 

From c70dc7313ebd44de2a07037b4067fd1ff24492ad Mon Sep 17 00:00:00 2001
From: lelia <2418071+lelia@users.noreply.github.com>
Date: Wed, 21 Oct 2026 17:48:56 -0400
Subject: [PATCH 06/10] chore(release): Socket Python CLI 2.11.3 and SDK 3.6.1

2.11.3 requires certifi>=2026.10.19 and SDK 3.6.1, which requires it too.
Relocked with uv 0.12.1, the version the images use, which also restores
lock format revision 3.
---
 CHANGELOG.md         | 5 +++--
 Dockerfile.heavy     | 2 +-
 app_tests/Dockerfile | 2 +-
 uv.lock              | 9 +++++----
 4 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 08e2506..d9f6eae 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -11,8 +11,9 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 ## [3.4.1] - 2026-10-20
 
 ### Changed
-- Socket Python CLI 2.9.0 -> 2.11.2 in the heavy and app-tests images. 2.11.2
-  carries the same eMudhra CA fix for its own image (SocketDev/socket-python-cli#415).
+- Socket Python CLI 2.9.0 -> 2.11.3 in the heavy and app-tests images. 2.11.3
+  carries the same eMudhra CA fix for its own image and requires
+  `certifi>=2026.10.19` (SocketDev/socket-python-cli#415, #418).
 - Socket Python SDK 3.6.0 -> 3.6.1, which requires `certifi>=2026.10.19`.
 - Trivy 0.73.0 -> 0.76.1, upstream's release for the eMudhra compromise. It is
   built on Go 1.27.3, which blocks the compromised intermediates in Go itself
diff --git a/Dockerfile.heavy b/Dockerfile.heavy
index 30da489..ba6c882 100644
--- a/Dockerfile.heavy
+++ b/Dockerfile.heavy
@@ -4,7 +4,7 @@ ARG TRUFFLEHOG_VERSION=3.96.0
 ARG UV_VERSION=0.12.1
 ARG OPENGREP_VERSION=v1.26.0
 ARG SOCKET_NPM_CLI_VERSION=1.1.165
-ARG SOCKET_PYTHON_CLI_VERSION=2.11.2
+ARG SOCKET_PYTHON_CLI_VERSION=2.11.3
 # Socket-built Trivy, pinned by digest — see the note in ./Dockerfile.
 # TODO(release 3.4.1): placeholder digest until trivy-dist publishes 0.76.1.
 ARG TRIVY_IMAGE=ghcr.io/socketdev/trivy:0.76.1@sha256:0000000000000000000000000000000000000000000000000000000000000000
diff --git a/app_tests/Dockerfile b/app_tests/Dockerfile
index 34863af..7c71952 100644
--- a/app_tests/Dockerfile
+++ b/app_tests/Dockerfile
@@ -13,7 +13,7 @@ ARG UV_VERSION=0.12.1
 ARG GOSEC_VERSION=v2.28.0
 ARG OPENGREP_VERSION=v1.26.0
 ARG SOCKET_NPM_CLI_VERSION=1.1.165
-ARG SOCKET_PYTHON_CLI_VERSION=2.11.2
+ARG SOCKET_PYTHON_CLI_VERSION=2.11.3
 #
 # NOT Dependabot-trackable — Socket-built Trivy, pinned by digest; updated by
 # Socket's trivy-dist release process. See the note in the root ./Dockerfile.
diff --git a/uv.lock b/uv.lock
index 98f1b5b..234c0ad 100644
--- a/uv.lock
+++ b/uv.lock
@@ -1,5 +1,5 @@
 version = 1
-revision = 5
+revision = 3
 requires-python = ">=3.10"
 
 [[package]]
@@ -735,15 +735,16 @@ dev = []
 
 [[package]]
 name = "socketdev"
-version = "3.6.0"
+version = "3.6.1"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
+    { name = "certifi" },
     { name = "requests" },
     { name = "typing-extensions" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/4f/64/7c44c1b1f739db9c40ea0a3d429d27b1810f43153b0680ec4bfc3aada644/socketdev-3.6.0.tar.gz", hash = "sha256:8453da37520db79735479e0892b74cef8ce5bcba52c99f15ffacc6a70f9ea355", size = 201023, upload-time = "2026-09-09T22:44:01.761Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/c2/de/c62e2e76ae5f7f55901d1d1cefc5b141309342fd1ae19d44f350fd264efc/socketdev-3.6.1.tar.gz", hash = "sha256:4086d6842a51dd4fd91ecf6aa3f1e24e7c7200f110e50c866784bc09e1fc9986", size = 176415, upload-time = "2026-10-21T21:30:12.548Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/fb/c3/e4ac2746b803109eab1fa7b44b02697f365fb418340411df5091e50d4a07/socketdev-3.6.0-py3-none-any.whl", hash = "sha256:fe017aefa72638375bb0fb1697bf5704f64143a5fab634534dfc3e77c851b374", size = 73352, upload-time = "2026-09-09T22:44:00.167Z" },
+    { url = "https://files.pythonhosted.org/packages/27/70/fe1e09c59dd566391aaf7bd0fb89ed9d1011e13f8fc4f4e8cc9376243888/socketdev-3.6.1-py3-none-any.whl", hash = "sha256:2297c7442c5debfa14ac464fd08b2755edbd71063b4cee3844bff173167f30e4", size = 73395, upload-time = "2026-10-21T21:30:10.718Z" },
 ]
 
 [[package]]

From a3bd7c084900018b09f7787a7cf9752c64b8c2f8 Mon Sep 17 00:00:00 2001
From: lelia <2418071+lelia@users.noreply.github.com>
Date: Wed, 21 Oct 2026 22:34:07 -0400
Subject: [PATCH 07/10] chore(release): pin Socket-built Trivy 0.76.1 by digest

---
 Dockerfile           | 4 +---
 Dockerfile.heavy     | 3 +--
 app_tests/Dockerfile | 3 +--
 3 files changed, 3 insertions(+), 7 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index a60ee13..7599b26 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -18,10 +18,8 @@ ARG SOCKET_NPM_CLI_VERSION=1.1.165
 # override, e.g.: docker build --build-arg TRIVY_IMAGE=aquasec/trivy:0.73.0 .
 # TRIVY_VERSION feeds the image label — keep it in sync with the TRIVY_IMAGE tag.
 # -socket.N is a trivy-dist toolchain rebuild: same upstream source, newer Go.
-# TODO(release 3.4.1): replace the placeholder digest once trivy-dist publishes
-# 0.76.1 (SocketDev/trivy-dist#25), here and in the other two Dockerfiles.
 ARG TRIVY_VERSION=0.76.1
-ARG TRIVY_IMAGE=ghcr.io/socketdev/trivy:0.76.1@sha256:0000000000000000000000000000000000000000000000000000000000000000
+ARG TRIVY_IMAGE=ghcr.io/socketdev/trivy:0.76.1@sha256:883da3593a60e311b2ed87c3a55241051b27bba15ffc3ce041ae570cd0f00915
 
 # ─── Stage: trivy (Socket-built redistribution) ───────────────────────────────
 FROM ${TRIVY_IMAGE} AS trivy
diff --git a/Dockerfile.heavy b/Dockerfile.heavy
index ba6c882..e09b868 100644
--- a/Dockerfile.heavy
+++ b/Dockerfile.heavy
@@ -6,8 +6,7 @@ ARG OPENGREP_VERSION=v1.26.0
 ARG SOCKET_NPM_CLI_VERSION=1.1.165
 ARG SOCKET_PYTHON_CLI_VERSION=2.11.3
 # Socket-built Trivy, pinned by digest — see the note in ./Dockerfile.
-# TODO(release 3.4.1): placeholder digest until trivy-dist publishes 0.76.1.
-ARG TRIVY_IMAGE=ghcr.io/socketdev/trivy:0.76.1@sha256:0000000000000000000000000000000000000000000000000000000000000000
+ARG TRIVY_IMAGE=ghcr.io/socketdev/trivy:0.76.1@sha256:883da3593a60e311b2ed87c3a55241051b27bba15ffc3ce041ae570cd0f00915
 
 FROM ${TRIVY_IMAGE} AS trivy
 FROM trufflesecurity/trufflehog:${TRUFFLEHOG_VERSION} AS trufflehog
diff --git a/app_tests/Dockerfile b/app_tests/Dockerfile
index 7c71952..9fa7256 100644
--- a/app_tests/Dockerfile
+++ b/app_tests/Dockerfile
@@ -17,8 +17,7 @@ ARG SOCKET_PYTHON_CLI_VERSION=2.11.3
 #
 # NOT Dependabot-trackable — Socket-built Trivy, pinned by digest; updated by
 # Socket's trivy-dist release process. See the note in the root ./Dockerfile.
-# TODO(release 3.4.1): placeholder digest until trivy-dist publishes 0.76.1.
-ARG TRIVY_IMAGE=ghcr.io/socketdev/trivy:0.76.1@sha256:0000000000000000000000000000000000000000000000000000000000000000
+ARG TRIVY_IMAGE=ghcr.io/socketdev/trivy:0.76.1@sha256:883da3593a60e311b2ed87c3a55241051b27bba15ffc3ce041ae570cd0f00915
 
 # ─── Stage: trivy (Socket-built redistribution) ───────────────────────────────
 FROM ${TRIVY_IMAGE} AS trivy

From 369064841b69a357ca1123bf964cc42fbc602e42 Mon Sep 17 00:00:00 2001
From: lelia <2418071+lelia@users.noreply.github.com>
Date: Wed, 21 Oct 2026 22:57:59 -0400
Subject: [PATCH 08/10] fix(app-tests): match the shipped images'
 ca-certificates floor and pip upgrade

---
 app_tests/Dockerfile | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/app_tests/Dockerfile b/app_tests/Dockerfile
index 9fa7256..1584c19 100644
--- a/app_tests/Dockerfile
+++ b/app_tests/Dockerfile
@@ -89,7 +89,13 @@ ARG SOCKET_NPM_CLI_VERSION
 RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
     --mount=type=cache,target=/var/lib/apt,sharing=locked \
     apt-get update && apt-get install -y --no-install-recommends \
-      curl git wget ca-certificates libatomic1
+      curl git wget ca-certificates libatomic1 \
+    && dpkg --compare-versions "$(dpkg-query -W -f='${Version}' ca-certificates)" ge 20250419+deb13u1
+# pip checks certificates against its own vendored CA bundle, not the system
+# store, and the base image's pip trusts the compromised intermediates. 26.2.2
+# vendors certifi 2026.10.19. Upgrade it against the system store fixed above.
+RUN python -m pip install --no-cache-dir --cert /etc/ssl/certs/ca-certificates.crt --upgrade "pip>=26.2.2" \
+    && python -c 'import sys, pip; sys.exit(tuple(map(int, pip.__version__.split(".")[:3])) < (26, 2, 2))'
 RUN --mount=type=cache,target=/root/.npm \
     npm install -g eslint eslint-plugin-security \
       @typescript-eslint/parser @typescript-eslint/eslint-plugin \

From 2a8e43b7aeb9840089115006581516cd49d2bfc7 Mon Sep 17 00:00:00 2001
From: lelia <2418071+lelia@users.noreply.github.com>
Date: Wed, 21 Oct 2026 22:58:41 -0400
Subject: [PATCH 09/10] chore(release): stamp 3.4.1 for 2026-10-21

---
 CHANGELOG.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index d9f6eae..1820ee0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,7 +8,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
-## [3.4.1] - 2026-10-20
+## [3.4.1] - 2026-10-21
 
 ### Changed
 - Socket Python CLI 2.9.0 -> 2.11.3 in the heavy and app-tests images. 2.11.3

From 0e8c9423355fe11e453ce8af6b61750c846ee9ee Mon Sep 17 00:00:00 2001
From: lelia <2418071+lelia@users.noreply.github.com>
Date: Wed, 21 Oct 2026 23:02:18 -0400
Subject: [PATCH 10/10] docs(docker): point the Trivy override example at
 0.76.1

---
 Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index 7599b26..1ea1a4d 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -15,7 +15,7 @@ ARG SOCKET_NPM_CLI_VERSION=1.1.165
 # source and published by Socket's own release pipeline. Pinned by digest; both
 # ARGs are updated together by that release process, never bumped independently.
 # Building requires pull access to the registry; contributors without it can
-# override, e.g.: docker build --build-arg TRIVY_IMAGE=aquasec/trivy:0.73.0 .
+# override, e.g.: docker build --build-arg TRIVY_IMAGE=aquasec/trivy:0.76.1 .
 # TRIVY_VERSION feeds the image label — keep it in sync with the TRIVY_IMAGE tag.
 # -socket.N is a trivy-dist toolchain rebuild: same upstream source, newer Go.
 ARG TRIVY_VERSION=0.76.1