[lelia]

Prepare Socket Basics 3.5.0 with Socket Python CLI 2.11.11 in the heavy and app-tests images, Socket Python SDK 3.6.2 in the lockfile, and release notes for the Tier 1 argument parsing fix in #125.

Draft: merge #125 into main, update this branch, and rerun the final combined checks before merging this release PR. The release branch targets current main; #125 supplies the parser implementation through its separate merge. The release notes describe the planned combined release.

Version choice

Recommend 3.5.0 rather than a patch: #125 changes how existing additional parameters are interpreted and can change scan scope. This follows the behavior-change precedent in the 3.2.0 and 3.4.0 changelogs. The two Python dependency bumps alone would fit 3.4.2.

Changes

• Pin Socket Python CLI 2.11.3 → 2.11.11 in Dockerfile.heavy and app_tests/Dockerfile.
• Lock Socket Python SDK (socketdev) 3.6.1 → 3.6.2 using published PyPI artifact metadata and hashes. Raise the source-install minimum to socketdev>=3.6.2 so source users also receive at least the SDK version validated for this release.
• Record fix(scanner): preserve option values #125's comma-preserving parser fix, repeated exclusion flags, and migration guidance. For example, --reach-analysis-timeout,90s must become --reach-analysis-timeout=90s or --reach-analysis-timeout 90s.
• Run scripts/prep_release.py --version 3.5.0 --date 2026-11-03 to align package versions, action image tag, lockfile, changelog, and current-release documentation. Confirm the changelog date when the release is ready.

Validation

• 496 Python tests passed against the prospective combined candidate: this release preparation plus fix(scanner): preserve option values #125 at bf093221cd5ae4454c01452c145cc1b4a11be94e, with the published SDK 3.6.2 installed. Temporary Git fixture repositories ran with signing and hooks disabled. The fix(scanner): preserve option values #125 patch was applied only for combined validation; its separate merge remains required.
• Java/OpenGrep regression tests were excluded because the installed local scanner cannot start under the sandbox: it attempts to write ~/.opengrep/semgrep.log. The release does not change those rules or their engine pin.
• Release metadata and documentation checks, uv lock --locked --offline, parser test formatting/lint, and git diff --check passed. Lockfile hashes match PyPI, and the frozen dependency tree remains readable by the image's uv 0.12.1.
• Refreshed CI passes Python tests, standard and heavy image build/smoke/integration checks on amd64 and arm64, app-tests image checks, Socket Firewall dependency checks, the dependency-review gate, and bundled-tool package resolution. The arm64 heavy job passed on retry after its first attempt could not see the newly published CLI in the package index. Local Docker checks encountered a GHCR 401 Unauthorized; CI successfully validated the pinned images.
• The SDK minimum refresh passes all 7 release-documentation tests, metadata/documentation synchronization, and frozen environment synchronization. Installed package metadata requires socketdev>=3.6.2, excludes 3.6.1, and the environment contains 3.6.2.
• Both socketsecurity==2.11.11 and socketdev==3.6.2 have wheel and source distributions on PyPI. A clean Python 3.12 environment installs the released CLI with SDK 3.6.2 and reports socketcli 2.11.11. Basics installs the Python CLI from PyPI, so publication of the standalone CLI Docker image is not a build prerequisite.
• Fourth-wall audit: no added code/config comments or docstrings required edits.

Before release

• Merge fix(scanner): preserve option values #125 into main, update this branch from main, and rerun the combined tests.
• Verify socketsecurity==2.11.11 and socketdev==3.6.2 wheel and source distributions are published on PyPI.
• Pass refreshed standard and heavy image checks on amd64/arm64, app-tests image checks, dependency-review gate, and bundled-tool package resolution after package publication.
• Confirm the changelog date, merge this release PR last, then tag the merge commit v3.5.0 to trigger publishing.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/​socketdev@​3.6.1 ⏵ 3.6.2	+1

View full report