Pin all Python dependencies

[lelia]

Summary

Pins the Python dependency chain at all three points where versions could previously resolve loose:

• pyproject.toml: every runtime dependency is now pinned to an exact version. Several entries (requests, mdutils, prettytable, GitPython, packaging, python-dotenv) were previously unpinned; the rest were open ranges. Pins use the versions already resolved and tested in uv.lock.
• bs4 → beautifulsoup4: the bs4 package is a shim that installs beautifulsoup4 unpinned underneath, so pinning the shim alone pins nothing. The dependency is now on beautifulsoup4 directly. (The bs4 import name is unaffected — it is provided by beautifulsoup4 itself.)
• socketdev: pinned to 3.5.0 (which itself bounds its own runtime ranges — Bound runtime dependency ranges and pin build backend socket-sdk-python#103) (previously >=3.3.0,<4.0.0).
• Dockerfile: image builds previously ran pip install socketsecurity==$CLI_VERSION, resolving all transitive dependencies fresh from PyPI at build time. Builds now export the committed uv.lock to a hash-pinned requirements file (uv export) and install with pip install --require-hashes --no-deps; the CLI package itself installs with --no-deps, and pip check validates the final environment. The hatchling build backend and the uv binary copied into the image are pinned as well.

Dependabot (uv + docker ecosystems, 7-day cooldown) is already configured to keep the pins current.

Notes

• Dockerfile.preview needs no changes: it resolves from the wheel's Requires-Dist metadata, which now carries the exact pins.
• Rebuilding a pre-2.6.0 CLI_VERSION with this Dockerfile will fail at pip check (older metadata expects bs4, which the lock no longer provides). Image builds for a given version should use the Dockerfile from that version's tag, as the release workflows already do.
• Possible follow-up: pin the python:3-alpine base image to a more specific tag or digest.

Testing

• uv lock regenerated cleanly; only changes were bs4 removal and socketdev 3.3.0 → 3.5.0 (all other locked versions already matched the new pins).
• Full test suite passes: 351 passed, 2 skipped (pre-existing).
• Verified the exact uv export command from the Dockerfile produces a fully hashed 22-package requirements file, with environment markers intact and socketdev==3.5.0 resolvable from PyPI.
• socketcli --version entrypoint works in the synced environment.
• Reachability E2E now retries up to three times on empty facts. After retries, only the explicit ENG-5093 signature (one manifest uploaded, zero projects returned, one orphaned component filtered) is reported as an inconclusive warning instead of blocking the PR; every other empty result still fails as a potential CLI regression. Inconclusive and failed runs upload CLI/facts/report diagnostics, including the hidden .socket.facts.json. This becomes the permanent main workflow behavior when this PR merges.

Fixes CE-359

---

Note

Medium Risk
Changes Docker image assembly and bumps the bundled socketdev SDK; older CLI versions rebuilt with this Dockerfile may fail pip check due to metadata expecting bs4.

Overview
Release 2.6.0 locks down the Python supply chain so CI and Docker builds no longer float on unpinned or range-based dependencies.

Runtime dependencies in pyproject.toml are now exact pins (including previously unpinned packages like requests and GitPython). The bs4 meta-package is replaced with beautifulsoup4==4.14.3 so the real library is version-controlled; existing from bs4 import … usage is unchanged. socketdev is pinned to 3.5.0, and hatchling is pinned for the build backend.

The Dockerfile installs deps from the committed uv.lock via uv export and pip install --require-hashes --no-deps, with explicit PyPI index URLs so preview PIP_* args do not affect the lock install. The published CLI wheel installs with --no-deps, followed by pip check; local editable installs use the same pattern. The uv image tag is pinned to 0.10.4.

^{Reviewed by Cursor Bugbot for commit fed545a. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/​socketdev@​3.3.0 ⏵ 3.5.0	+1

View full report

[lelia]

bugbot run

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

Autofix Details

Bugbot Autofix prepared a fix for the issue found in the latest run.

• ✅ Fixed: pip check failure ignored
  • Changed pip check; to pip check && so a failed dependency check fails the Docker RUN instead of being masked by the following SDK_VERSION if-block.

Or push these changes by commenting:

@cursor push 1031f03076

Preview (1031f03076)

diff --git a/Dockerfile b/Dockerfile
--- a/Dockerfile
+++ b/Dockerfile
@@ -143,7 +143,7 @@
             echo "Failed to install socketsecurity==$CLI_VERSION after 10 attempts"; \
             exit 1; \
         fi; \
-        pip check; \
+        pip check && \
         if [ ! -z "$SDK_VERSION" ]; then \
             pip install --index-url ${PIP_INDEX_URL} --extra-index-url ${PIP_EXTRA_INDEX_URL} socketdev==${SDK_VERSION}; \
         fi; \

_{You can send follow-ups to the cloud agent here.}

[lelia]

Cursor (@cursor) push 1031f03

[cursor]

Could not push Autofix changes. The PR branch may have changed since the Autofix ran, or the Autofix commit may no longer exist.

[lelia]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit fed545a. Configure here.}

[David Larsen (dc-larsen)]

Approving — validated locally end to end.

• uv build produces 2.6.0 with every pin present in the wheel metadata (requests==2.34.2, socketdev==3.4.2, beautifulsoup4==4.14.3, etc.)
• uv sync --locked clean; test suite 351 passed / 2 skipped, matching your numbers
• Replayed the Dockerfile sequence in a clean venv: the exact uv export line yields 22 requirements, all hash-pinned, markers preserved, project correctly excluded; pip install --require-hashes --no-deps then the wheel --no-deps, and pip check reports no broken requirements
• bs4 swap is correct — with the shim uninstalled, from bs4 import BeautifulSoup, Tag and from bs4.element import NavigableString both resolve from beautifulsoup4 4.14.3, and socketcli --version reports 2.6.0
• hatchling==1.31.0 needs Python >=3.10 and this package requires >=3.11, so no conflict here (worth noting it does conflict in the SDK, which still declares >=3.9)