SocketDev · lelia · Sep 15, 2026 · Sep 15, 2026
@@ -8,19 +8,27 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [3.3.0] - 2026-09-15
+
+Small release pairing a CLI parity addition with a notification fix. The fix
+changes behavior for anyone who configured a GitHub token through the Socket
+dashboard: PR comments that were silently never posted will start posting.
+
 ### Added
 - `--scan-all` / `--no-scan-all` CLI flags, the command-line equivalent of the
   `scan_all` action input, `INPUT_SCAN_ALL` and the `scan_all` JSON/dashboard
   key. `scan_all` was the one scope setting the 3.2.0 parity pass missed, so
   the remediation the unresolvable-scope error recommends was not reachable
   from the CLI at all. `--no-scan-all` forces the fail-closed behavior back on
   for a single run when `scan_all` is already set elsewhere; passing neither
-  flag leaves the configured value untouched.
+  flag leaves the configured value untouched. (#115)
 
 ### Changed
 - The unresolvable `changed_files` error now names the remediation for each
   interface (`--scan-all`, the `scan_all` action input, `INPUT_SCAN_ALL`, a
   `--config` JSON or dashboard key) instead of saying only "set scan_all".
+  (#115)
+- Socket Python CLI 2.8.0 -> 2.9.0 in the heavy and app-tests images.
 
 ### Fixed
 - **GitHub PR notifier now reads the `github_token` notifier parameter.** The
@@ -31,7 +39,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
   reaching the GitHub API call, so the run logged `no GitHub token available`
   and posted nothing. Environment-variable configuration was unaffected, since
   the notifier fell back to reading `GITHUB_TOKEN` directly. `token` is still
-  accepted for callers that construct the notifier themselves.
+  accepted for callers that construct the notifier themselves. (#114)
 
 ## [3.2.0] - 2026-09-10
 

@@ -4,7 +4,7 @@ ARG TRUFFLEHOG_VERSION=3.96.0
 ARG UV_VERSION=0.12.1
 ARG OPENGREP_VERSION=v1.26.0
 ARG SOCKET_NPM_CLI_VERSION=1.1.165
-ARG SOCKET_PYTHON_CLI_VERSION=2.8.0
+ARG SOCKET_PYTHON_CLI_VERSION=2.9.0
 # Socket-built Trivy, pinned by digest — see the note in ./Dockerfile.
 ARG TRIVY_IMAGE=ghcr.io/socketdev/trivy:0.73.0@sha256:e3d9d5f10250cb73b0ea9446ae1191c0f2da2f5e6173eac08a840b1812f02e0b
 

@@ -35,7 +35,7 @@ jobs:
       - name: Run Socket Basics
         # Pin to a commit SHA for supply-chain safety.
         # Dependabot will keep this up to date automatically — see docs/github-action.md.
-        uses: SocketDev/socket-basics@<sha>  # v3.2.0
+        uses: SocketDev/socket-basics@<sha>  # v3.3.0
         env:
           GITHUB_PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
         with:
@@ -179,10 +179,10 @@ For GitHub Actions, see the [Quick Start](#-quick-start---github-actions) above
 
 ```bash
 # Pull the pre-built image (recommended — no build step required)
-docker pull ghcr.io/socketdev/socket-basics:3.2.0
+docker pull ghcr.io/socketdev/socket-basics:3.3.0
 
 # Run scan
-docker run --rm -v "$PWD:/workspace" ghcr.io/socketdev/socket-basics:3.2.0 \
+docker run --rm -v "$PWD:/workspace" ghcr.io/socketdev/socket-basics:3.3.0 \
   --workspace /workspace \
   --python \
   --secrets \

@@ -4,7 +4,7 @@ author: "Socket"
 
 runs:
   using: "docker"
-  image: "docker://ghcr.io/socketdev/socket-basics:3.2.0"
+  image: "docker://ghcr.io/socketdev/socket-basics:3.3.0"
   env:
     # Core GitHub variables (these are automatically available, but we explicitly pass GITHUB_TOKEN)
     GITHUB_TOKEN: ${{ inputs.github_token }}

@@ -13,7 +13,7 @@ ARG UV_VERSION=0.12.1
 ARG GOSEC_VERSION=v2.28.0
 ARG OPENGREP_VERSION=v1.26.0
 ARG SOCKET_NPM_CLI_VERSION=1.1.165
-ARG SOCKET_PYTHON_CLI_VERSION=2.8.0
+ARG SOCKET_PYTHON_CLI_VERSION=2.9.0
 #
 # NOT Dependabot-trackable — Socket-built Trivy, pinned by digest; updated by
 # Socket's trivy-dist release process. See the note in the root ./Dockerfile.

@@ -43,7 +43,7 @@ jobs:
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Run Socket Basics
-        uses: SocketDev/socket-basics@v3.2.0
+        uses: SocketDev/socket-basics@v3.3.0
         env:
           GITHUB_PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
         with:
@@ -57,7 +57,7 @@ With just your `SOCKET_SECURITY_API_KEY`, all scanning configurations are manage
 
 ### How the action is currently built
 
-When you reference `uses: SocketDev/socket-basics@v3.2.0`, GitHub Actions pulls the
+When you reference `uses: SocketDev/socket-basics@v3.3.0`, GitHub Actions pulls the
 pre-built image referenced by [`action.yml`](../action.yml). The historical multi-stage
 Docker build still matters for maintainers because it determines what lands in the
 published image:
@@ -75,7 +75,7 @@ Socket Basics from source in every workflow run.
 ### Pre-built image
 
 Starting with v2, the action pulls a pre-built image from GHCR rather than
-building from source on every run. Pinning to a specific version tag (e.g. `@v3.2.0`)
+building from source on every run. Pinning to a specific version tag (e.g. `@v3.3.0`)
 means the action starts in seconds — the image is built, integration-tested, and
 published before the release tag is ever created.
 
@@ -85,7 +85,7 @@ If you run socket-basics in other CI systems (Jenkins, GitLab, CircleCI, etc.) o
 as a standalone `docker run`, pull the pre-built image directly:
 
 ```bash
-docker pull ghcr.io/socketdev/socket-basics:3.2.0
+docker pull ghcr.io/socketdev/socket-basics:3.3.0
 ```
 
 See [Local Docker Installation](local-install-docker.md) for usage examples.
@@ -101,7 +101,7 @@ is immediately affected. We've seen this happen across the ecosystem:
   publish `:latest`/`:latest-heavy` Docker aliases as an onboarding
   convenience, but treat them as exactly that — production pipelines should
   pin an exact version or digest.)
-- **Version tags** (`@v3.2.0`) are better, but tags are mutable by default.
+- **Version tags** (`@v3.3.0`) are better, but tags are mutable by default.
   A tag can be deleted and recreated pointing at a different commit. There are
   documented cases of this happening — maliciously and accidentally.
 - **Commit SHAs** are the only truly immutable reference. A SHA cannot be
@@ -126,14 +126,14 @@ The only truly immutable reference. Dependabot keeps it current automatically.
 ```yaml
 - name: Run Socket Basics
   # Dependabot keeps this SHA up to date — see .github/dependabot.yml setup below.
-  uses: SocketDev/socket-basics@<sha>  # v3.2.0
+  uses: SocketDev/socket-basics@<sha>  # v3.3.0
   with:
     socket_security_api_key: ${{ secrets.SOCKET_SECURITY_API_KEY }}
 ```
 
 Get the SHA for any release:
 ```bash
-git ls-remote https://github.com/SocketDev/socket-basics refs/tags/v3.2.0
+git ls-remote https://github.com/SocketDev/socket-basics refs/tags/v3.3.0
 ```
 
 ---
@@ -145,7 +145,7 @@ enforces tag protection rules). SHA pinning is still preferable for defence
 in depth.
 
 ```yaml
-- uses: SocketDev/socket-basics@v3.2.0
+- uses: SocketDev/socket-basics@v3.3.0
   with:
     socket_security_api_key: ${{ secrets.SOCKET_SECURITY_API_KEY }}
 ```
@@ -166,7 +166,7 @@ updates:
 ```
 
 Dependabot opens a PR for each new release, updating the SHA or version tag
-and keeping the `# v3.2.0` comment in sync. You review, approve, and merge
+and keeping the `# v3.3.0` comment in sync. You review, approve, and merge
 on your own schedule — automated upgrades with a human gate.
 
 ---
@@ -176,7 +176,7 @@ on your own schedule — automated upgrades with a human gate.
 | Strategy | Immutable? | Auto-updates | Review gate |
 |---|---|---|---|
 | `@v2` floating tag | ❌ (not published) | — | — |
-| `@v3.2.0` + Dependabot | ✅ (tag protection enforced) | Yes (weekly PR) | Yes |
+| `@v3.3.0` + Dependabot | ✅ (tag protection enforced) | Yes (weekly PR) | Yes |
 | `@<sha>` + Dependabot | ✅ always | Yes (weekly PR) | Yes |
 
 ## Basic Configuration
@@ -217,7 +217,7 @@ Include these in your workflow's `jobs.<job_id>.permissions` section.
 
 **SAST (Static Analysis):**
 ```yaml
-- uses: SocketDev/socket-basics@v3.2.0
+- uses: SocketDev/socket-basics@v3.3.0
   with:
     github_token: ${{ secrets.GITHUB_TOKEN }}
     # Enable SAST for specific languages
@@ -231,7 +231,7 @@ Include these in your workflow's `jobs.<job_id>.permissions` section.
 
 **Secret Scanning:**
 ```yaml
-- uses: SocketDev/socket-basics@v3.2.0
+- uses: SocketDev/socket-basics@v3.3.0
   with:
     github_token: ${{ secrets.GITHUB_TOKEN }}
     secret_scanning_enabled: 'true'
@@ -251,7 +251,7 @@ Include these in your workflow's `jobs.<job_id>.permissions` section.
 
 **Container Scanning:**
 ```yaml
-- uses: SocketDev/socket-basics@v3.2.0
+- uses: SocketDev/socket-basics@v3.3.0
   with:
     github_token: ${{ secrets.GITHUB_TOKEN }}
     # Listing images or Dockerfiles auto-enables the matching Trivy scan.
@@ -271,7 +271,7 @@ Include these in your workflow's `jobs.<job_id>.permissions` section.
 
 **Socket Tier 1 Reachability:**
 ```yaml
-- uses: SocketDev/socket-basics@v3.2.0
+- uses: SocketDev/socket-basics@v3.3.0
   with:
     github_token: ${{ secrets.GITHUB_TOKEN }}
     socket_tier_1_enabled: 'true'
@@ -280,7 +280,7 @@ Include these in your workflow's `jobs.<job_id>.permissions` section.
 ### Output Configuration
 
 ```yaml
-- uses: SocketDev/socket-basics@v3.2.0
+- uses: SocketDev/socket-basics@v3.3.0
   with:
     github_token: ${{ secrets.GITHUB_TOKEN }}
     python_sast_enabled: 'true'
@@ -318,7 +318,7 @@ jobs:
           fetch-depth: 0
 
       - name: Run Socket Basics (changed files only)
-        uses: SocketDev/socket-basics@v3.2.0
+        uses: SocketDev/socket-basics@v3.3.0
         env:
           GITHUB_PR_NUMBER: ${{ github.event.pull_request.number }}
         with:
@@ -447,7 +447,7 @@ Configure Socket Basics centrally from the [Socket Dashboard](https://socket.dev
 
 **Enable in workflow:**
 ```yaml
-- uses: SocketDev/socket-basics@v3.2.0
+- uses: SocketDev/socket-basics@v3.3.0
   env:
     GITHUB_PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
   with:
@@ -460,7 +460,7 @@ Configure Socket Basics centrally from the [Socket Dashboard](https://socket.dev
 > [!NOTE]
 > You can also pass credentials using environment variables instead of the `with:` section:
 > ```yaml
-> - uses: SocketDev/socket-basics@v3.2.0
+> - uses: SocketDev/socket-basics@v3.3.0
 >   env:
 >     SOCKET_SECURITY_API_KEY: ${{ secrets.SOCKET_SECURITY_API_KEY }}
 >   with:
@@ -478,7 +478,7 @@ All notification integrations require Socket Enterprise.
 
 **Slack Notifications:**
 ```yaml
-- uses: SocketDev/socket-basics@v3.2.0
+- uses: SocketDev/socket-basics@v3.3.0
   with:
     github_token: ${{ secrets.GITHUB_TOKEN }}
     socket_org: ${{ secrets.SOCKET_ORG }}
@@ -490,7 +490,7 @@ All notification integrations require Socket Enterprise.
 
 **Jira Issue Creation:**
 ```yaml
-- uses: SocketDev/socket-basics@v3.2.0
+- uses: SocketDev/socket-basics@v3.3.0
   with:
     github_token: ${{ secrets.GITHUB_TOKEN }}
     socket_org: ${{ secrets.SOCKET_ORG }}
@@ -505,7 +505,7 @@ All notification integrations require Socket Enterprise.
 
 **Microsoft Teams:**
 ```yaml
-- uses: SocketDev/socket-basics@v3.2.0
+- uses: SocketDev/socket-basics@v3.3.0
   with:
     github_token: ${{ secrets.GITHUB_TOKEN }}
     socket_org: ${{ secrets.SOCKET_ORG }}
@@ -517,7 +517,7 @@ All notification integrations require Socket Enterprise.
 
 **Generic Webhook:**
 ```yaml
-- uses: SocketDev/socket-basics@v3.2.0
+- uses: SocketDev/socket-basics@v3.3.0
   with:
     github_token: ${{ secrets.GITHUB_TOKEN }}
     socket_org: ${{ secrets.SOCKET_ORG }}
@@ -529,7 +529,7 @@ All notification integrations require Socket Enterprise.
 
 **SIEM Integration:**
 ```yaml
-- uses: SocketDev/socket-basics@v3.2.0
+- uses: SocketDev/socket-basics@v3.3.0
   with:
     github_token: ${{ secrets.GITHUB_TOKEN }}
     socket_org: ${{ secrets.SOCKET_ORG }}
@@ -565,7 +565,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Run Socket Basics
-        uses: SocketDev/socket-basics@v3.2.0
+        uses: SocketDev/socket-basics@v3.3.0
         env:
           GITHUB_PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
         with:
@@ -607,7 +607,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Run Full Security Scan
-        uses: SocketDev/socket-basics@v3.2.0
+        uses: SocketDev/socket-basics@v3.3.0
         env:
           GITHUB_PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
         with:
@@ -666,7 +666,7 @@ jobs:
         run: docker build -t myapp:${{ github.sha }} .
 
       - name: Run Socket Basics (image + Dockerfile scan)
-        uses: SocketDev/socket-basics@v3.2.0
+        uses: SocketDev/socket-basics@v3.3.0
         env:
           GITHUB_PR_NUMBER: ${{ github.event.pull_request.number }}
         with:
@@ -727,7 +727,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Run Socket Basics
-        uses: SocketDev/socket-basics@v3.2.0
+        uses: SocketDev/socket-basics@v3.3.0
         env:
           GITHUB_PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
         with:
@@ -785,7 +785,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Run Socket Basics
-        uses: SocketDev/socket-basics@v3.2.0
+        uses: SocketDev/socket-basics@v3.3.0
         env:
           GITHUB_PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
         with:
@@ -946,7 +946,7 @@ in the [name mapping](parameters.md#name-mapping).
 ```yaml
 steps:
   - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - Must be first
-  - uses: SocketDev/socket-basics@v3.2.0
+  - uses: SocketDev/socket-basics@v3.3.0
 ```
 
 ### PR Comments Not Appearing

@@ -315,7 +315,7 @@ PR. This is for teams who want to review finding quality in the Socket dashboard
 first, without every PR growing a comment that developers have to scroll past.
 
 ```yaml
-- uses: SocketDev/socket-basics@v3.2.0
+- uses: SocketDev/socket-basics@v3.3.0
   with:
     socket_security_api_key: ${{ secrets.SOCKET_SECURITY_API_KEY }}
     github_token: ${{ secrets.GITHUB_TOKEN }}