chore(release): 3.0.0

[lelia]

Self-contained release PR: the four version refs (socket_basics/version.py, socket_basics/__init__.py, pyproject.toml, action.yml image tag) bumped 2.2.1 → 3.0.0, plus the CHANGELOG entry. No other changes.

Why major: Trivy-backed scanning — intentionally disabled in the 2.x images after the upstream supply-chain incident — is deliberately re-enabled (via the Socket-built distribution, see #100). Configs with Trivy parameters will produce findings again, so gating pipelines may see new results on first run.

After merge: push tag v3.0.0 → publish-docker builds/publishes (first live validation of the environment-scoped Docker Hub secrets and the latest/latest-heavy aliases against the immutable-tag rule) → verify → delete the repo-level DOCKERHUB_* secrets.

---

Note

Medium Risk
No runtime code in the diff, but the Action image tag change immediately points consumers at 3.0.0 behavior, including re-enabled Trivy scanning that can alter CI gate results.

Overview
Release 3.0.0 — bumps the package and GitHub Action from 2.2.1 to 3.0.0 in pyproject.toml, socket_basics/version.py, socket_basics/__init__.py, and the action.yml Docker image (ghcr.io/socketdev/socket-basics:3.0.0).

Adds a CHANGELOG entry for the major: Trivy container/Dockerfile scanning is back in the pre-built images via Socket’s rebuilt distribution; configs using Trivy options may see new findings after upgrade. The notes also cover latest/latest-heavy tags, toolchain bumps, publish-env changes, and fixes called out for 3.0.0.

^{Reviewed by Cursor Bugbot for commit 4f0a393. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issue.}

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 4f0a393. Configure here.}

[cursor]

Lockfile stale after version bump

Medium Severity

The pyproject.toml version was updated to 3.0.0, but uv.lock still records socket-basics at 2.2.1. This version mismatch will cause the python-tests CI workflow to fail because the uv lock --locked check expects consistency.

 

^{Reviewed by Cursor Bugbot for commit 4f0a393. Configure here.}