chore(deps): refresh bundled tool pins and make them Dependabot-readable

[lelia]

Two related changes: a routine refresh of the pinned tools in the standard, heavy and app-tests images, and a fix for the reason those pins had gone stale in the first place.

Pins

Tool	Before	After	Images
OpenGrep	v1.26.0	v1.30.0	all three
TruffleHog	3.96.0	3.97.5	all three
Socket npm CLI	1.1.165	1.1.176	all three
Socket Python CLI	2.9.0	2.9.4	heavy, app-tests
uv	0.12.1	0.12.17	all three
Gosec	v2.28.0	v2.29.0	app-tests
Go	1.26.5	1.26.8	app-tests
Trivy	0.73.0	held	—

Socket SDK (socketdev) is already at 3.6.0 on main via #117 — no change needed here. Python 3.12 and Node 22 are intentional major-line pins.

Trivy is still at 0.73.0

ghcr.io/socketdev/trivy:0.74.0 is not published yet. The pin carries a digest that three consumers parse (scripts/smoke-test-docker.sh, tests/test_check_core_tools.py, scripts/check_release_docs.py), so a tag-only bump would fail CI. This PR stays draft until the image lands; the flip is a three-file sed plus check_release_docs.py --write.

Dependabot has never updated a Docker pin in this repo

The Dockerfiles claimed "Dependabot tracks all ARGs below via the FROM lines that reference them." It does not, and never has.

Its parser (shared_file_parser.rb, file_parser.rb) is a regex over FROM lines:

NAME_COMPONENT = /(?:[a-z\d]+(?:(?:[._]|__|[-]*)[a-z\d]+)*)/
IMAGE          = %r{(?<image>#{NAME_COMPONENT}(?:/#{NAME_COMPONENT})*)}
TAG            = /:(?<tag>[\w][\w.-]{0,127})/

Both groups require literal characters, and parse does no ARG substitution — it just runs next unless version per line. So FROM trufflesecurity/trufflehog:${TRUFFLEHOG_VERSION} matches with a nil tag and is dropped, and FROM ${TRIVY_IMAGE} fails IMAGE outright. No warning, no error; the pin simply never moves.

Two independent confirmations:

• Zero Docker-ecosystem PRs have ever been opened here. All 33 Dependabot PRs carry python:uv or github-actions (the docker/* actions are GitHub Actions, not images).
• git log -L '/^ARG UV_VERSION/,+1:Dockerfile' shows the pin has only ever moved in hand-written PRs (feat: 🐳 multi-stage Docker builds, immutable release pipeline, CHANGELOG automation #46, feat: restore Trivy scanning via Socket-built distribution #100).

That is why uv sat 16 patch releases behind.

Correction to this PR's original description

It first proposed fixing this with ARG UV_IMAGE=ghcr.io/astral-sh/uv:0.12.17 + FROM ${UV_IMAGE}. That does not work either — ${UV_IMAGE} fails the IMAGE regex just as ${VERSION} fails TAG. A literal FROM image:tag is the only form the parser reads, which is what this PR now does.

What changed

• Base and tool images are pinned as literal tags on their FROM lines; the PYTHON_VERSION, UV_VERSION, GOLANG_VERSION and NODE_VERSION ARGs are gone (nothing else consumed them).
• node and ghcr.io/astral-sh/uv added to the app-tests allow: list — an allow list silently drops images it does not name, so node:22-slim would have stayed invisible even once literal. securego/gosec removed: gosec is installed by a shell script and has no FROM line to match.
• scripts/check_core_tools.py and scripts/check_release_docs.py now read the TruffleHog pin from the FROM line rather than the ARG — the same reasoning the code already applies to TRIVY_IMAGE (score the real build input, not a label that mirrors it).
• tests/test_dockerfile_pins.py transcribes the upstream regexes and asserts: every trackable FROM line parses to a version, the allow lists cover every image pinned, and the trufflehog label ARG equals its FROM tag. Each assertion was verified to fail on a deliberately reintroduced regression.

Deliberate trade-offs

• --build-arg TRUFFLEHOG_VERSION= no longer does anything — the FROM tag is literal. Edit the line instead. Docs updated; smoke-test-docker.sh no longer passes it. OpenGrep, the Socket CLIs and gosec keep working build args, since they are installed by script/npm/pip and never had FROM lines.
• com.socket.trufflehog-version needs a version string and a LABEL cannot read a FROM tag back, so ARG TRUFFLEHOG_VERSION remains as the one pin stated twice, with a test keeping the two equal.
• FROM ${TRIVY_IMAGE} stays interpolated on purpose. Socket's Trivy build is digest-pinned and must not move independently of the trivy-dist release process; being unreadable to Dependabot is the intent there.

Behavior changes users will see

• TruffleHog 3.97.0 retires the AppOptics and Bing Subscription Key detectors. Credentials of those two kinds stop being reported. No other detector changed, and nothing about how Socket Basics invokes TruffleHog changed.
• OpenGrep 1.27–1.30 are engine-only for the languages we scan: PCRE1 → PCRE2, constant propagation extended to assignment RHS and array indices, JS/TS destructuring taint-tracked.

Java rule set re-measured

docs/java-sast-benchmark.md says to re-measure when the engine pin moves, so it was, on the pinned BenchmarkJava commit 51f0a7c:

	1.26.0 baseline	1.30.0
Precision	76.7%	76.7%
Recall	71.3%	71.3%
False positive rate	22.5%	22.5%
Benchmark score	48.9	48.9
True positives	950	950

Per-category and per-rule breakdowns are identical too, so the doc records 1.30.0 without new numbers.

Verification

• pytest: 405 passed, 1 skipped, with SOCKET_BASICS_REQUIRE_OPENGREP=1 against opengrep 1.30.0 so the Java rule regression tests ran rather than skipped.
• docker build --check clean on all three Dockerfiles.
• Root image built end-to-end with the documented --build-arg TRIVY_IMAGE=aquasec/trivy:0.73.0 override. Inside it: opengrep 1.30.0, trufflehog 3.97.5, socket 1.1.176, uv 0.12.17, python 3.12.14, and the OCI labels carry the same versions.

🤖 Generated with Claude Code