chore(release): prepare 3.5.0

CHANGELOG.md

@@ -8,6 +8,12 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [3.5.0] - 2026-11-06
+
+Minor rather than patch: Socket Tier 1 parses `socket_additional_params`
+differently (#125) and needs new network access (#118), and either can break an
+existing setup.
+
 ### Upgrade notes
 - **Socket Tier 1 needs outbound access to `api.socket.dev` and
   `storage.googleapis.com`.** Socket npm CLI 1.9.0 and later download the
@@ -16,32 +22,33 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
   effect, and a `--reach-version` older than the move fails. The heavy image's
   Python CLI made the same change in 2.11.1, which shipped in 3.4.1. See
   [Network access for Tier 1](docs/parameters.md#network-access-for-tier-1).
+- A comma between a Tier 1 option and its value is no longer a separator:
+  change `--reach-analysis-timeout,90s` to `--reach-analysis-timeout=90s`.
+  Comma-joined options such as `--view=full,--all` still split. (#125)
+- Pass multiple exclusions as repeated `--exclude-paths` flags. (#125)
 
 ### Changed
 - The images set `NODE_USE_ENV_PROXY=1`, so Socket Tier 1 honors `HTTPS_PROXY`
   and `NO_PROXY`. The Socket npm CLI does not apply `HTTPS_PROXY` to its own
   requests, and Tier 1 behind a proxy failed with `getaddrinfo EAI_AGAIN
   api.socket.dev`. Node only acts on it when a proxy variable is set. Native
   installs need it set by hand.
-- **Behavior change:** `socket_additional_params` now uses shell-style,
-  space-separated arguments and preserves commas within argument values. A
-  comma acts as a legacy separator only when it is unquoted and followed by a
-  hyphen (normally another option). Configurations that used commas as general
-  separators (for example, `--view,full`) must use a space or `=` instead. Repeat
-  list-valued flags, such as
-  `--exclude-paths=tests --exclude-paths=fixtures`.
 - Bundled tools: OpenGrep v1.26.0 -> v1.33.1, TruffleHog 3.96.0 -> 3.99.8,
-  Socket npm CLI 1.1.165 -> 1.14.0, Socket Python CLI 2.11.3 -> 2.11.11, uv
+  Socket npm CLI 1.1.165 -> 1.14.0, Socket Python CLI 2.11.3 -> 2.11.13, uv
   0.12.1 -> 0.13.7; in the app-tests image, gosec v2.28.0 -> v2.30.0 and Go
   1.26.5 -> 1.27.3. Java SAST benchmark results are unchanged on OpenGrep 1.33.1.
 - Socket Python SDK (`socketdev`) 3.6.1 -> 3.6.2, which Socket Python CLI
-  2.11.11 pins exactly. Source installs now require `socketdev>=3.6.2`.
+  2.11.13 pins exactly. Source installs now require `socketdev>=3.6.2`.
 - TruffleHog no longer reports AppOptics or Bing Subscription Key credentials;
   upstream retired both detectors in 3.97.0.
 - Base and tool images are pinned as literal `FROM` tags so Dependabot can
   update them. `--build-arg TRUFFLEHOG_VERSION` no longer has any effect.
 
 ### Fixed
+- Socket Tier 1 keeps commas and quoted spaces inside `socket_additional_params`
+  values, so `--reach-ecosystems=npm,pypi` reaches the Socket CLI as one
+  argument. Malformed quoting fails with an `Invalid socket_additional_params`
+  error. (#125)
 - TruffleHog 3.99.8 is built on Go 1.27.3, clearing the CVE-2026-111943
   finding noted in 3.4.1.
 

Dockerfile.heavy

@@ -5,7 +5,7 @@
 # hand. See the note at the top of ./Dockerfile for why.
 ARG OPENGREP_VERSION=v1.33.1
 ARG SOCKET_NPM_CLI_VERSION=1.14.0
-ARG SOCKET_PYTHON_CLI_VERSION=2.11.11
+ARG SOCKET_PYTHON_CLI_VERSION=2.11.13
 # Socket-built Trivy, pinned by digest — see the note in ./Dockerfile.
 ARG TRIVY_IMAGE=ghcr.io/socketdev/trivy:0.76.1@sha256:883da3593a60e311b2ed87c3a55241051b27bba15ffc3ce041ae570cd0f00915
 

README.md

@@ -35,7 +35,7 @@ jobs:
       - name: Run Socket Basics
         # Pin to a commit SHA for supply-chain safety.
         # Dependabot will keep this up to date automatically — see docs/github-action.md.
-        uses: SocketDev/socket-basics@<sha>  # v3.4.1
+        uses: SocketDev/socket-basics@<sha>  # v3.5.0
         env:
           GITHUB_PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
         with:
@@ -179,10 +179,10 @@ For GitHub Actions, see the [Quick Start](#-quick-start---github-actions) above
 
 ```bash
 # Pull the pre-built image (recommended — no build step required)
-docker pull ghcr.io/socketdev/socket-basics:3.4.1
+docker pull ghcr.io/socketdev/socket-basics:3.5.0
 
 # Run scan
-docker run --rm -v "$PWD:/workspace" ghcr.io/socketdev/socket-basics:3.4.1 \
+docker run --rm -v "$PWD:/workspace" ghcr.io/socketdev/socket-basics:3.5.0 \
   --workspace /workspace \
   --python \
   --secrets \

action.yml

@@ -4,7 +4,7 @@ author: "Socket"
 
 runs:
   using: "docker"
-  image: "docker://ghcr.io/socketdev/socket-basics:3.4.1"
+  image: "docker://ghcr.io/socketdev/socket-basics:3.5.0"
   env:
     # Core GitHub variables (these are automatically available, but we explicitly pass GITHUB_TOKEN)
     GITHUB_TOKEN: ${{ inputs.github_token }}

app_tests/Dockerfile

@@ -10,7 +10,7 @@
 ARG GOSEC_VERSION=v2.30.0
 ARG OPENGREP_VERSION=v1.33.1
 ARG SOCKET_NPM_CLI_VERSION=1.14.0
-ARG SOCKET_PYTHON_CLI_VERSION=2.11.11
+ARG SOCKET_PYTHON_CLI_VERSION=2.11.13
 #
 # Socket-built Trivy, pinned by digest and deliberately kept out of Dependabot's
 # reach; updated by Socket's trivy-dist release process. See the root

docs/github-action.md

@@ -43,7 +43,7 @@ jobs:
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Run Socket Basics
-        uses: SocketDev/socket-basics@v3.4.1
+        uses: SocketDev/socket-basics@v3.5.0
         env:
           GITHUB_PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
         with:
@@ -59,7 +59,7 @@ Without dashboard configuration, every scanner input defaults to off, so turn on
 
 ### How the action is currently built
 
-When you reference `uses: SocketDev/socket-basics@v3.4.1`, GitHub Actions pulls the
+When you reference `uses: SocketDev/socket-basics@v3.5.0`, GitHub Actions pulls the
 pre-built image referenced by [`action.yml`](../action.yml). The historical multi-stage
 Docker build still matters for maintainers because it determines what lands in the
 published image:
@@ -77,7 +77,7 @@ Socket Basics from source in every workflow run.
 ### Pre-built image
 
 Starting with v2, the action pulls a pre-built image from GHCR rather than
-building from source on every run. Pinning to a specific version tag (e.g. `@v3.4.1`)
+building from source on every run. Pinning to a specific version tag (e.g. `@v3.5.0`)
 means the action starts in seconds — the image is built, integration-tested, and
 published before the release tag is ever created.
 
@@ -87,7 +87,7 @@ If you run socket-basics in other CI systems (Jenkins, GitLab, CircleCI, etc.) o
 as a standalone `docker run`, pull the pre-built image directly:
 
 ```bash
-docker pull ghcr.io/socketdev/socket-basics:3.4.1
+docker pull ghcr.io/socketdev/socket-basics:3.5.0
 ```
 
 See [Local Docker Installation](local-install-docker.md) for usage examples.
@@ -103,7 +103,7 @@ is immediately affected. We've seen this happen across the ecosystem:
   publish `:latest`/`:latest-heavy` Docker aliases as an onboarding
   convenience, but treat them as exactly that — production pipelines should
   pin an exact version or digest.)
-- **Version tags** (`@v3.4.1`) are better, but tags are mutable by default.
+- **Version tags** (`@v3.5.0`) are better, but tags are mutable by default.
   A tag can be deleted and recreated pointing at a different commit. There are
   documented cases of this happening — maliciously and accidentally.
 - **Commit SHAs** are the only truly immutable reference. A SHA cannot be
@@ -128,14 +128,14 @@ The only truly immutable reference. Dependabot keeps it current automatically.
 ```yaml
 - name: Run Socket Basics
   # Dependabot keeps this SHA up to date — see .github/dependabot.yml setup below.
-  uses: SocketDev/socket-basics@<sha>  # v3.4.1
+  uses: SocketDev/socket-basics@<sha>  # v3.5.0
   with:
     socket_security_api_key: ${{ secrets.SOCKET_SECURITY_API_KEY }}
 ```
 
 Get the SHA for any release:
 ```bash
-git ls-remote https://github.com/SocketDev/socket-basics refs/tags/v3.4.1
+git ls-remote https://github.com/SocketDev/socket-basics refs/tags/v3.5.0
 ```
 
 ---
@@ -147,7 +147,7 @@ enforces tag protection rules). SHA pinning is still preferable for defence
 in depth.
 
 ```yaml
-- uses: SocketDev/socket-basics@v3.4.1
+- uses: SocketDev/socket-basics@v3.5.0
   with:
     socket_security_api_key: ${{ secrets.SOCKET_SECURITY_API_KEY }}
 ```
@@ -168,7 +168,7 @@ updates:
 ```
 
 Dependabot opens a PR for each new release, updating the SHA or version tag
-and keeping the `# v3.4.1` comment in sync. You review, approve, and merge
+and keeping the `# v3.5.0` comment in sync. You review, approve, and merge
 on your own schedule — automated upgrades with a human gate.
 
 ---
@@ -178,7 +178,7 @@ on your own schedule — automated upgrades with a human gate.
 | Strategy | Immutable? | Auto-updates | Review gate |
 |---|---|---|---|
 | `@v2` floating tag | ❌ (not published) | — | — |
-| `@v3.4.1` + Dependabot | ✅ (tag protection enforced) | Yes (weekly PR) | Yes |
+| `@v3.5.0` + Dependabot | ✅ (tag protection enforced) | Yes (weekly PR) | Yes |
 | `@<sha>` + Dependabot | ✅ always | Yes (weekly PR) | Yes |
 
 ## Basic Configuration
@@ -219,7 +219,7 @@ Include these in your workflow's `jobs.<job_id>.permissions` section.
 
 **SAST (Static Analysis):**
 ```yaml
-- uses: SocketDev/socket-basics@v3.4.1
+- uses: SocketDev/socket-basics@v3.5.0
   with:
     github_token: ${{ secrets.GITHUB_TOKEN }}
     # Enable SAST for specific languages
@@ -233,7 +233,7 @@ Include these in your workflow's `jobs.<job_id>.permissions` section.
 
 **Secret Scanning:**
 ```yaml
-- uses: SocketDev/socket-basics@v3.4.1
+- uses: SocketDev/socket-basics@v3.5.0
   with:
     github_token: ${{ secrets.GITHUB_TOKEN }}
     secret_scanning_enabled: 'true'
@@ -253,7 +253,7 @@ Include these in your workflow's `jobs.<job_id>.permissions` section.
 
 **Container Scanning:**
 ```yaml
-- uses: SocketDev/socket-basics@v3.4.1
+- uses: SocketDev/socket-basics@v3.5.0
   with:
     github_token: ${{ secrets.GITHUB_TOKEN }}
     # Listing images or Dockerfiles auto-enables the matching Trivy scan.
@@ -280,7 +280,7 @@ path that does not exist is skipped with a `Dockerfile not found` warning.
 
 **Socket Tier 1 Reachability:**
 ```yaml
-- uses: SocketDev/socket-basics@v3.4.1
+- uses: SocketDev/socket-basics@v3.5.0
   with:
     github_token: ${{ secrets.GITHUB_TOKEN }}
     socket_tier_1_enabled: 'true'
@@ -295,7 +295,7 @@ path that does not exist is skipped with a `Dockerfile not found` warning.
 ### Output Configuration
 
 ```yaml
-- uses: SocketDev/socket-basics@v3.4.1
+- uses: SocketDev/socket-basics@v3.5.0
   with:
     github_token: ${{ secrets.GITHUB_TOKEN }}
     python_sast_enabled: 'true'
@@ -333,7 +333,7 @@ jobs:
           fetch-depth: 0
 
       - name: Run Socket Basics (changed files only)
-        uses: SocketDev/socket-basics@v3.4.1
+        uses: SocketDev/socket-basics@v3.5.0
         env:
           GITHUB_PR_NUMBER: ${{ github.event.pull_request.number }}
         with:
@@ -462,7 +462,7 @@ Configure Socket Basics centrally from the [Socket Dashboard](https://socket.dev
 
 **Enable in workflow:**
 ```yaml
-- uses: SocketDev/socket-basics@v3.4.1
+- uses: SocketDev/socket-basics@v3.5.0
   env:
     GITHUB_PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
   with:
@@ -475,7 +475,7 @@ Configure Socket Basics centrally from the [Socket Dashboard](https://socket.dev
 > [!NOTE]
 > You can also pass credentials using environment variables instead of the `with:` section:
 > ```yaml
-> - uses: SocketDev/socket-basics@v3.4.1
+> - uses: SocketDev/socket-basics@v3.5.0
 >   env:
 >     SOCKET_SECURITY_API_KEY: ${{ secrets.SOCKET_SECURITY_API_KEY }}
 >   with:
@@ -546,7 +546,7 @@ directly as a step:
   run: docker build -t myapp:${{ github.sha }} .
 
 - name: Run Socket Basics
-  uses: docker://ghcr.io/socketdev/socket-basics:3.4.1
+  uses: docker://ghcr.io/socketdev/socket-basics:3.5.0
   env:
     SOCKET_SECURITY_API_KEY: ${{ secrets.SOCKET_SECURITY_API_KEY }}
     GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -565,7 +565,7 @@ the dashboard. Running the image directly differs from the action in two ways:
   for some languages.
 - The step isn't tied to an action version, so update the image tag yourself
   when you upgrade. To pin by digest, append `@sha256:<digest>` to the image.
-  `docker buildx imagetools inspect ghcr.io/socketdev/socket-basics:3.4.1`
+  `docker buildx imagetools inspect ghcr.io/socketdev/socket-basics:3.5.0`
   prints the digest.
 
 See the [Parameters Reference](parameters.md) for every CLI flag.
@@ -576,7 +576,7 @@ All notification integrations require Socket Enterprise.
 
 **Slack Notifications:**
 ```yaml
-- uses: SocketDev/socket-basics@v3.4.1
+- uses: SocketDev/socket-basics@v3.5.0
   with:
     github_token: ${{ secrets.GITHUB_TOKEN }}
     socket_org: ${{ secrets.SOCKET_ORG }}
@@ -588,7 +588,7 @@ All notification integrations require Socket Enterprise.
 
 **Jira Issue Creation:**
 ```yaml
-- uses: SocketDev/socket-basics@v3.4.1
+- uses: SocketDev/socket-basics@v3.5.0
   with:
     github_token: ${{ secrets.GITHUB_TOKEN }}
     socket_org: ${{ secrets.SOCKET_ORG }}
@@ -603,7 +603,7 @@ All notification integrations require Socket Enterprise.
 
 **Microsoft Teams:**
 ```yaml
-- uses: SocketDev/socket-basics@v3.4.1
+- uses: SocketDev/socket-basics@v3.5.0
   with:
     github_token: ${{ secrets.GITHUB_TOKEN }}
     socket_org: ${{ secrets.SOCKET_ORG }}
@@ -615,7 +615,7 @@ All notification integrations require Socket Enterprise.
 
 **Generic Webhook:**
 ```yaml
-- uses: SocketDev/socket-basics@v3.4.1
+- uses: SocketDev/socket-basics@v3.5.0
   with:
     github_token: ${{ secrets.GITHUB_TOKEN }}
     socket_org: ${{ secrets.SOCKET_ORG }}
@@ -627,7 +627,7 @@ All notification integrations require Socket Enterprise.
 
 **SIEM Integration:**
 ```yaml
-- uses: SocketDev/socket-basics@v3.4.1
+- uses: SocketDev/socket-basics@v3.5.0
   with:
     github_token: ${{ secrets.GITHUB_TOKEN }}
     socket_org: ${{ secrets.SOCKET_ORG }}
@@ -663,7 +663,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Run Socket Basics
-        uses: SocketDev/socket-basics@v3.4.1
+        uses: SocketDev/socket-basics@v3.5.0
         env:
           GITHUB_PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
         with:
@@ -705,7 +705,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Run Full Security Scan
-        uses: SocketDev/socket-basics@v3.4.1
+        uses: SocketDev/socket-basics@v3.5.0
         env:
           GITHUB_PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
         with:
@@ -771,7 +771,7 @@ jobs:
         run: docker build -t myapp:${{ github.sha }} .
 
       - name: Run Socket Basics (image + Dockerfile scan)
-        uses: SocketDev/socket-basics@v3.4.1
+        uses: SocketDev/socket-basics@v3.5.0
         env:
           GITHUB_PR_NUMBER: ${{ github.event.pull_request.number }}
         with:
@@ -796,7 +796,7 @@ For repositories with multiple Dockerfiles across different directories, you can
 >
 > ```yaml
 > - name: Run Socket Basics
->   uses: docker://ghcr.io/socketdev/socket-basics:3.4.1
+>   uses: docker://ghcr.io/socketdev/socket-basics:3.5.0
 >   env:
 >     SOCKET_SECURITY_API_KEY: ${{ secrets.SOCKET_SECURITY_API_KEY }}
 >     GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -853,7 +853,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Run Socket Basics
-        uses: SocketDev/socket-basics@v3.4.1
+        uses: SocketDev/socket-basics@v3.5.0
         env:
           GITHUB_PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
         with:
@@ -911,7 +911,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Run Socket Basics
-        uses: SocketDev/socket-basics@v3.4.1
+        uses: SocketDev/socket-basics@v3.5.0
         env:
           GITHUB_PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
         with:
@@ -1076,7 +1076,7 @@ in the [name mapping](parameters.md#name-mapping).
 ```yaml
 steps:
   - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - Must be first
-  - uses: SocketDev/socket-basics@v3.4.1
+  - uses: SocketDev/socket-basics@v3.5.0
 ```
 
 ### PR Comments Not Appearing