Pin all Python dependencies

[lelia]

Summary

Pins the Python dependency chain at all three points where versions could previously resolve loose (CE-359):

• pyproject.toml: every runtime dependency is now pinned to an exact version. Several entries (requests, mdutils, prettytable, GitPython, packaging, python-dotenv) were previously unpinned; the rest were open ranges. Pins use the versions already resolved and tested in uv.lock.
• bs4 → beautifulsoup4: the bs4 package is a shim that installs beautifulsoup4 unpinned underneath, so pinning the shim alone pins nothing. The dependency is now on beautifulsoup4 directly. (The bs4 import name is unaffected — it is provided by beautifulsoup4 itself.)
• socketdev: pinned to 3.4.2 (previously >=3.3.0,<4.0.0).
• Dockerfile: image builds previously ran pip install socketsecurity==$CLI_VERSION, resolving all transitive dependencies fresh from PyPI at build time. Builds now export the committed uv.lock to a hash-pinned requirements file (uv export) and install with pip install --require-hashes --no-deps; the CLI package itself installs with --no-deps, and pip check validates the final environment. The hatchling build backend and the uv binary copied into the image are pinned as well.

Dependabot (uv + docker ecosystems, 7-day cooldown) is already configured to keep the pins current.

Bumps version to 2.5.10 with a changelog entry.

Notes

• Dockerfile.preview needs no changes: it resolves from the wheel's Requires-Dist metadata, which now carries the exact pins.
• Rebuilding a pre-2.5.10 CLI_VERSION with this Dockerfile will fail at pip check (older metadata expects bs4, which the lock no longer provides). Image builds for a given version should use the Dockerfile from that version's tag, as the release workflows already do.
• Possible follow-up: pin the python:3-alpine base image to a more specific tag or digest.

Testing

• uv lock regenerated cleanly; only changes were bs4 removal and socketdev 3.3.0 → 3.4.2 (all other locked versions already matched the new pins).
• Full test suite passes: 351 passed, 2 skipped (pre-existing).
• Verified the exact uv export command from the Dockerfile produces a fully hashed 22-package requirements file, with environment markers intact and socketdev==3.4.2 resolvable from PyPI.
• socketcli --version entrypoint works in the synced environment.

Refs CE-359.

🤖 Generated with Claude Code

---

Note

Medium Risk
Changes how dependencies are resolved in production Docker builds and bumps the socketdev SDK; misaligned lock/metadata could fail builds or pip check, but scan logic is untouched.

Overview
Release 2.5.10 locks down the Python supply chain: every runtime dependency in pyproject.toml is pinned to an exact version (including socketdev==3.4.2), bs4 is replaced by a direct beautifulsoup4 pin, and hatchling is pinned for builds.

Docker image builds no longer resolve transitive deps from PyPI at build time. They export the committed uv.lock to a hashed requirements file, install with pip install --require-hashes --no-deps, install socketsecurity with --no-deps, run pip check, and pin the copied uv image to 0.10.4.

uv.lock and changelog are updated accordingly; no application code behavior changes beyond the version string.

^{Reviewed by Cursor Bugbot for commit 51ca456. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/​socketdev@​3.3.0 ⏵ 3.4.2	+1

View full report

[socket-security-staging]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/​socketdev@​3.3.0 ⏵ 3.4.2	+1

View full report

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

^{Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issues.}

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 51ca456. Configure here.}

[cursor]

Pip index ARG leaks into lock install

Medium Severity

The new hash-pinned lockfile pip install has no --index-url, so it inherits PIP_INDEX_URL from the Docker ARG (BuildKit exposes ARGs as env vars). Test image builds set that ARG to TestPyPI (build_container.sh, deploy-test-docker.sh), so lockfile packages resolve against TestPyPI instead of production PyPI. This violates the Docker ARG / pip-recognized env var names rule; CLI/SDK installs already pass index flags explicitly.

Additional Locations (1)

• Dockerfile#L11-L13

 

^{Triggered by learned rule: Docker ARG with pip-recognized env var names leaks into pip}

^{Reviewed by Cursor Bugbot for commit 51ca456. Configure here.}

[lelia]

Fixed in 33d6897 — the locked dependency install now passes explicit production PyPI index flags, so the TestPyPI ARGs no longer leak in via pip's env vars.

[cursor]

SDK override fails pip check

Medium Severity

SDK_VERSION still overlays socketdev, but the new pip check runs afterward while socketsecurity now requires socketdev==3.4.2 exactly. Any override other than 3.4.2 makes pip check fail and aborts the image build. deploy-test-docker.sh always supplies a TestPyPI SDK version, so that path breaks.

Additional Locations (1)

• pyproject.toml#L18-L19

 

^{Reviewed by Cursor Bugbot for commit 51ca456. Configure here.}

[lelia]

Fixed in 33d6897 — pip check now runs before the SDK_VERSION override, so preview SDK builds that deviate from the exact pin still work.