Dependabot hardening + dependency update bundle by lelia · Pull Request #84 · SocketDev/socket-sdk-python

lelia · 2026-06-01T18:30:22Z

Summary

Mirrors the Dependabot hardening done in socket-python-cli (#207 / #217 / #218), adapted to this SDK (no Dockerfile, no e2e fixtures, hatch/pip build path), and extended so the Socket Firewall guardrail covers maintainer PRs, not just Dependabot. Three threads:

Bundle dependency updates — supersedes the 4 open Dependabot PRs in one verified change.
Dependency review — anonymous Socket Firewall smoke on every dependency PR, with an authenticated (enterprise) upgrade path for trusted SocketDev members.
Workflow plumbing — composite actions + Dependabot-aware skips on the publish/version workflows.

Dependencies (supersedes 4 Dependabot PRs)

PR	Package	Bump	Notes
#80	idna	3.11 → 3.17	CVE-2026-45409 fix (quadratic-time DoS)
#75	cryptography	46.0.5 → 46.0.7
#74	pygments	2.19.2 → 2.20.0
#83	uv	0.9.21 → 0.11.17	latest (Dependabot targeted 0.11.15)

All four are transitive build/dev deps; runtime deps (requests, typing-extensions) are unchanged. Targeted uv lock upgrades only — no unrelated churn. The 4 Dependabot PRs were closed manually (GitHub closing keywords only close issues, not PRs).

Dependency review (`.github/workflows/dependency-review.yml`)

On every PR: inspect changed files, then run a Socket Firewall (sfw uv sync --locked) + import-smoke job when Python deps change. The firewall edition is chosen per-PR in inspect:

Enterprise (firewall-enterprise + socket-token) — for a trusted SocketDev member (author_association ∈ OWNER/MEMBER/COLLABORATOR) on an in-repo (non-fork) PR, when SOCKET_SFW_API_TOKEN is present. Full org-policy enforcement.
Free (firewall-free, anonymous, no token) — Dependabot, forks, external contributors, or whenever the token is absent. Safe in the unprivileged pull_request context (no pull_request_target, no secret-leak surface).

The mode degrades to free whenever the token is missing, so this is safe to ship today and auto-upgrades to enterprise once the secret exists — no follow-up PR needed.

Verified live on this PR: inspect → firewall-free (no token yet) → python-sfw-smoke installs Socket Firewall Free v1.12.0 and runs sfw uv sync + import smoke successfully.

Dependabot config + workflow skips

.github/dependabot.yml (new). Grouped (minor/patch + separate major), 7-day cooldown; uv + github-actions (scanning /.github/workflows and /.github/actions/*). No docker ecosystem — no Dockerfile here.
version-check.yml skips Dependabot PRs (dep bumps carry no package-version bump).
pr-preview.yml skips Dependabot + fork PRs and gains concurrency cancellation.
This PR bumps the package version to 3.1.2 (Version Check requires an increment on maintainer PRs).

Workflow cleanup

.github/actions/setup-sfw (now parameterized with mode + socket-token) and .github/actions/setup-hatch composite actions. pr-preview.yml and release.yml use setup-hatch to de-duplicate the pinned virtualenv/hatchling/hatch install.

Test plan

Automated (local + CI, all green):

uv lock --locked; uv sync --locked --extra test --extra dev
Import smoke; pytest tests/unit — 102 passed, 1 skipped
actionlint on all workflows; YAML parse on all .github files
CI on this PR: inspect, python-sfw-smoke (free mode), workflow-notice, check_version, preview all pass

Pending:

Add environment secret, then confirm a maintainer dep PR runs python-sfw-smoke in firewall-enterprise mode
Next Dependabot PR: runs in firewall-free; Version Check + PR Preview show skipped

Mirrors the Dependabot hardening done in socket-python-cli (#207/#217/#218), adapted to this SDK (no Dockerfile, no e2e fixtures, hatch/pip build path). Bundle dependency updates (supersedes 4 open Dependabot PRs): - idna 3.11 -> 3.17 (security: CVE-2026-45409 quadratic-time DoS fix) - cryptography 46.0.5 -> 46.0.7 - pygments 2.19.2 -> 2.20.0 - uv 0.9.21 -> 0.11.17 Verified via uv sync --locked, import smoke, and pytest tests/unit (102 passed). Adds grouped/cooldowned dependabot.yml (uv + github-actions), a dependabot-review workflow running anonymous Socket Firewall smoke jobs, Version Check / PR Preview skips for Dependabot PRs, and setup-sfw / setup-hatch composite actions. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

github-actions · 2026-06-01T18:31:10Z

🚀 Preview package published!

Install with:

pip install --index-url https://test.pypi.org/simple/ --extra-index-url https://pypi.org/simple socketdev==3.1.2.dev8

Version Check requires a package-version increment on maintainer PRs, and this PR bundles dependency bumps + Dependabot hardening. Bump version.py, pyproject.toml, and the uv.lock project version in sync. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Broaden dependabot-review into dependency-review so the Socket Firewall guardrail covers maintainer PRs too, not just Dependabot: - inspect now runs on every PR and computes the SFW edition per-PR: enterprise for a trusted SocketDev member (author_association OWNER/ MEMBER/COLLABORATOR) on an in-repo (non-fork) PR when SOCKET_API_TOKEN is present; free (anonymous) for Dependabot, forks, external contributors, or when the token is absent. - The mode degrades to free whenever the token is missing, so this is safe to ship before the secret exists and auto-upgrades to enterprise once SOCKET_API_TOKEN is added (repo or org level). The SDK has no Socket token today (cf. socket-python-cli's SOCKET_CLI_API_TOKEN). - setup-sfw composite action gains `mode` + `socket-token` inputs, forwarded to socketdev/action (same action, firewall-free vs firewall-enterprise). - Rename workflow dependabot-review.yml -> dependency-review.yml to match the broadened scope (not a required status check). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

…load .python-version pins 3.12.7; setup-python provides 3.12.13, so `uv sync` tried to download the exact managed CPython from GitHub, which Socket Firewall's TLS interception blocked (UnknownIssuer). Set UV_PYTHON=3.12 + UV_PYTHON_DOWNLOADS=never so uv uses the runner interpreter and only PyPI package fetches route through sfw. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Tighten the enterprise-mode gate to author_association OWNER/MEMBER only. Outside collaborators (COLLABORATOR) now fall through to the free edition, same as Dependabot / forks / external contributors. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

…TOKEN Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Resolve zizmor secrets-outside-env (medium) without suppressing it. Split the single mode-switching smoke job into two: - python-sfw-smoke-free: untrusted PRs (Dependabot, forks, outside collaborators, externals). Anonymous free edition, never references the token. - python-sfw-smoke-enterprise: SocketDev org members (OWNER/MEMBER) on an in-repo PR. Authenticated enterprise edition; SOCKET_SFW_API_TOKEN is scoped to the `socket-firewall` GitHub environment, so only this job can read it. inspect now classifies PR trust (author_association OWNER/MEMBER, non-fork, non-Dependabot) and references no secret. No required-reviewer protection on the environment, so trusted dep PRs still run automatically. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

…ot author_association author_association only reflects PUBLIC org membership, so private members (the common case here) show as CONTRIBUTOR and were misclassified -> the enterprise job always skipped. Switch the trust gate to "non-fork PR and not Dependabot": only accounts with write access can push an in-repo branch, the same boundary GitHub uses for secret exposure. No read:org token needed. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

socket-security · 2026-06-02T23:10:13Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	github/actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a

View full report

Eric Hibbs (flowstate)

LGTM

… scrape Match socket-python-cli: discover the firewall report via the $SFW_JSON_REPORT_PATH env var that socketdev/action exports, instead of parsing the 'sfw report written to:' line out of stdout. The two sync steps return to plain 'set -o pipefail' + tee. A new 'Collect SFW JSON report' step (if: always(), before each upload) copies $SFW_JSON_REPORT_PATH into sfw-artifacts/sfw-report.json -- copy, not move, since socketdev/action's post step reads that temp path for its job summary -- and drops a sfw-report-missing.txt breadcrumb when absent. More robust than scraping an undocumented log string, and keeps the report-capture pattern uniform across both repos. Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

lelia requested a review from a team as a code owner June 1, 2026 18:30

This was referenced Jun 1, 2026

Bump idna from 3.11 to 3.15 #80

Closed

Bump cryptography from 46.0.5 to 46.0.7 #75

Closed

Bump pygments from 2.19.2 to 2.20.0 #74

Closed

Bump uv from 0.9.21 to 0.11.15 #83

Closed

lelia added enhancement New feature or request dependencies Pull requests that update a dependency file labels Jun 1, 2026

lelia and others added 3 commits June 1, 2026 15:15

lelia changed the title ~~Harden Dependabot reviews and bundle dependency updates~~ Harden dependency reviews (free + enterprise SFW) and bundle dependency updates Jun 1, 2026

lelia changed the title ~~Harden dependency reviews (free + enterprise SFW) and bundle dependency updates~~ Harden dependency reviews + bundle dependency updates Jun 1, 2026

lelia changed the title ~~Harden dependency reviews + bundle dependency updates~~ Dependabot hardening + dependency update bundle Jun 1, 2026

lelia mentioned this pull request Jun 1, 2026

Dependabot hardening and workflow pipeline cleanup SocketDev/socket-python-cli#217

Merged

8 tasks

lelia and others added 3 commits June 1, 2026 16:15

chore(dependency-review): rename enterprise secret to SOCKET_SFW_API_…

9f5b0fb

…TOKEN Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

lelia temporarily deployed to socket-firewall June 1, 2026 20:38 — with GitHub Actions Inactive

lelia temporarily deployed to socket-firewall June 1, 2026 20:46 — with GitHub Actions Inactive

lelia assigned Eric Hibbs (flowstate) Jun 2, 2026

ci(dependency-review): upload SFW smoke artifacts

1925b18

lelia temporarily deployed to socket-firewall June 2, 2026 23:10 — with GitHub Actions Inactive

ci(dependency-review): include SFW JSON report artifact

bdaa197

lelia temporarily deployed to socket-firewall June 2, 2026 23:15 — with GitHub Actions Inactive

Eric Hibbs (flowstate) approved these changes Jun 2, 2026

View reviewed changes

lelia temporarily deployed to socket-firewall June 2, 2026 23:28 — with GitHub Actions Inactive

lelia merged commit 8dfb7a1 into main Jun 2, 2026
11 checks passed

This was referenced Jun 2, 2026

Always omit license details from full-scan diff request SocketDev/socket-python-cli#221

Merged

chore(deps): bundle Dependabot updates + harden dependency review workflows SocketDev/socket-basics#78

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Dependabot hardening + dependency update bundle#84

Dependabot hardening + dependency update bundle#84
lelia merged 11 commits into
mainfrom
lelia/dependabot-hardening

lelia commented Jun 1, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jun 1, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Jun 2, 2026 •

edited

Loading

Uh oh!

Eric Hibbs (flowstate) left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

lelia commented Jun 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Dependencies (supersedes 4 Dependabot PRs)

Dependency review (.github/workflows/dependency-review.yml)

Dependabot config + workflow skips

Workflow cleanup

Test plan

Uh oh!

github-actions Bot commented Jun 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Jun 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Eric Hibbs (flowstate) left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

lelia commented Jun 1, 2026 •

edited

Loading

Dependency review (`.github/workflows/dependency-review.yml`)

github-actions Bot commented Jun 1, 2026 •

edited

Loading

socket-security Bot commented Jun 2, 2026 •

edited

Loading