Pin all Python dependencies

CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## 2.6.0
+
+### Changed: pin all Python dependencies
+
+- Pinned every runtime dependency in `pyproject.toml` to an exact version;
+  several were previously unpinned or open ranges.
+- Replaced the `bs4` shim package with a direct, pinned `beautifulsoup4`
+  dependency (the shim provided no version control over the actual library).
+- Pinned the bundled `socketdev` SDK to `3.4.2` (previously `>=3.3.0,<4.0.0`).
+- Docker images now install Python dependencies from the committed `uv.lock`
+  with pip hash verification (`--require-hashes`), so image builds no longer
+  resolve dependency versions from PyPI at build time. `pip check` validates
+  the environment after install.
+- Pinned the `hatchling` build backend and the `uv` binary used in the
+  Dockerfile.
+
 ## 2.5.9
 
 ### Changed: bump pinned @coana-tech/cli to 15.10.3

Dockerfile

@@ -86,7 +86,7 @@ ENV PATH="/usr/local/go/bin:/usr/lib/go/bin:/root/.cargo/bin:${PATH}"
 ENV GOPATH="/go"
 
 # Install uv
-COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv
+COPY --from=ghcr.io/astral-sh/uv:0.10.4 /uv /usr/local/bin/uv
 
 # Install pyenv
 # pyenv lets us build/install arbitrary Python versions on demand. We install
@@ -111,14 +111,26 @@ RUN curl -L https://raw.githubusercontent.com/pyenv/pyenv-installer/master/bin/p
     ln -s ~/.pyenv/bin/pyenv /bin/pyenv && \
     pyenv --version
 
+# Install Python dependencies from the lockfile with hash verification so the
+# image never resolves loose versions from PyPI at build time.
+COPY pyproject.toml uv.lock /tmp/socket-cli-lock/
+# Index flags are passed explicitly (always production PyPI) so the
+# PIP_INDEX_URL/PIP_EXTRA_INDEX_URL ARGs used to point CLI/SDK preview installs
+# at TestPyPI don't leak into the locked dependency install via pip's env vars.
+RUN uv export --directory /tmp/socket-cli-lock --frozen --no-dev --no-emit-project \
+        --format requirements-txt -o /tmp/socket-cli-lock/requirements.txt && \
+    pip install --require-hashes --no-deps \
+        --index-url https://pypi.org/simple --extra-index-url https://pypi.org/simple \
+        -r /tmp/socket-cli-lock/requirements.txt
+
 # Install CLI based on build mode
 RUN if [ "$USE_LOCAL_INSTALL" = "true" ]; then \
         echo "Using local development install"; \
     else \
         cli_installed=false; \
         for i in $(seq 1 10); do \
             echo "Attempt $i/10: Installing socketsecurity==$CLI_VERSION"; \
-            if pip install --index-url ${PIP_INDEX_URL} --extra-index-url ${PIP_EXTRA_INDEX_URL} socketsecurity==$CLI_VERSION; then \
+            if pip install --no-deps --index-url ${PIP_INDEX_URL} --extra-index-url ${PIP_EXTRA_INDEX_URL} socketsecurity==$CLI_VERSION; then \
                 cli_installed=true; \
                 break; \
             fi; \
@@ -131,6 +143,7 @@ RUN if [ "$USE_LOCAL_INSTALL" = "true" ]; then \
             echo "Failed to install socketsecurity==$CLI_VERSION after 10 attempts"; \
             exit 1; \
         fi; \
+        pip check || exit 1; \
         if [ ! -z "$SDK_VERSION" ]; then \
             pip install --index-url ${PIP_INDEX_URL} --extra-index-url ${PIP_EXTRA_INDEX_URL} socketdev==${SDK_VERSION}; \
         fi; \
@@ -140,7 +153,7 @@ RUN if [ "$USE_LOCAL_INSTALL" = "true" ]; then \
 COPY . /app
 WORKDIR /app
 RUN if [ "$USE_LOCAL_INSTALL" = "true" ]; then \
-        pip install --upgrade -e .; \
+        pip install --no-deps -e . && pip check; \
     fi
 
 # Create workspace directory with proper permissions

pyproject.toml

@@ -1,26 +1,26 @@
 [build-system]
 requires = [
-  "hatchling"
+  "hatchling==1.31.0"
 ]
 build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.5.9"
+version = "2.6.0"
 requires-python = ">= 3.11"
 license = {"file" = "LICENSE"}
 dependencies = [
-    'requests',
-    'mdutils',
-    'prettytable',
-    'GitPython',
-    'packaging',
-    'python-dotenv',
-    "socketdev>=3.3.0,<4.0.0",
-    "bs4>=0.0.2",
-    "markdown>=3.10",
-    "brotli>=1.0.9; platform_python_implementation == 'CPython'",
-    "brotlicffi>=1.0.9; platform_python_implementation != 'CPython'",
+    "requests==2.34.2",
+    "mdutils==1.8.1",
+    "prettytable==3.18.0",
+    "GitPython==3.1.57",
+    "packaging==26.2",
+    "python-dotenv==1.2.2",
+    "socketdev==3.4.2",
+    "beautifulsoup4==4.14.3",
+    "markdown==3.10.2",
+    "brotli==1.2.0; platform_python_implementation == 'CPython'",
+    "brotlicffi==1.2.0.1; platform_python_implementation != 'CPython'",
 ]
 readme = "README.md"
 description = "Socket Security CLI for CI/CD"

socketsecurity/__init__.py

@@ -1,3 +1,3 @@
 __author__ = 'socket.dev'
-__version__ = '2.5.9'
+__version__ = '2.6.0'
 USER_AGENT = f'SocketPythonCLI/{__version__}'