chore(deps): bundle Dependabot updates + harden dependency review workflows

[lelia]

What this does

Bundles the open Dependabot updates and hardens the Dependabot config + dependency-review workflow — mirroring socket-sdk-python#84 and socket-python-cli#207 / #217 / #224 — and adds a supply-chain watch for the four core OSS tools Dependabot can't track (OpenGrep / TruffleHog / Trivy / socketdev).

Changes

• Deps — bundles the 11 open Dependabot PRs below in one verified change (targeted uv lock, no unrelated churn).
• dependabot.yml — adds the missing uv ecosystem; groups every ecosystem into a minor/patch bundle + a separate major PR.
• dependency-review.yml (was dependabot-review.yml) — Socket Firewall on every dependency PR: enterprise for all in-repo PRs (maintainers and Dependabot), free for forks, report artifacts, and one always-on required gate. Token is environment-scoped for maintainer runs and mirrored into the Dependabot secret store for Dependabot runs (see "After merge"); no approval rule on the environment.
• core-tool-watch.yml + scripts/check_core_tools.py — discovers and Socket-scores the four core tools; fails a build on a malware-class or high/critical alert on a pinned version. The scan's Python env is synced from main's lockfile (.scan-env checkout), so the token-holding step never imports packages bumped by the PR under review. OpenGrep has no Socket coverage, so it falls back to a report-only Semgrep-lineage proxy.

Bundled Dependabot PRs

PR	Bump
#72	idna 3.10 → 3.18 (CVE-2026-45409)
#71	pygments 2.19.2 → 2.20.0
#70	urllib3 2.6.3 → 2.7.0
#67	pytest 8.4.2 → 9.0.3
#87	requests 2.31.0 → 2.34.2
#76 / #81	docker/metadata-action → 6.1.0
#75	docker/login-action → 4.2.0
#74	docker/build-push-action → 7.2.0
#73 / #86	docker/setup-buildx-action → 4.1.0
#86	actions/setup-python → 6.3.0

After merge

1. Mark dependency-review-gate as the single required status check on main — but only after this merges (requiring a check that doesn't yet exist on main strands every open PR). Don't add a required-reviewers rule to the socket-firewall environment.
2. Mirror the SFW token into the Dependabot secret store so Dependabot's own bump PRs get enterprise scoring pre-merge (until then, its runs degrade to free/skipped-scoring with a warning and auto-upgrade once set):

   gh secret set SOCKET_SFW_API_TOKEN --app dependabot
   

Design notes (rationale)

• Why Dependabot gets enterprise: dependency bumps are exactly where org-policy enforcement matters most. Dependabot-triggered runs read secrets from the Dependabot store only — handed exclusively to runs actually triggered by dependabot[bot], still in the unprivileged read-only pull_request context. This is not the pull_request_target footgun: fork PRs from external contributors can never read these secrets.
• Why one gate: the enterprise SFW job is skipped on fork PRs, so it can't itself be required (a never-created required check blocks merge forever). dependency-review-gate runs if: always(), needs every conditional job, and fails on any failure/cancelled — so it's always reported and requiring just this one check is safe.
• Environment, no rule: environment: socket-firewall scopes the token to the enterprise job. A required-reviewers rule on it would be self-approvable yet skippable — friction with no protection — so it's deliberately omitted:

  gh api -X PUT repos/SocketDev/socket-basics/environments/socket-firewall \
    --input - <<<'{"wait_timer":0,"prevent_self_review":false,"reviewers":null,"deployment_branch_policy":null}'
  

• Degrade-to-free: the enterprise path falls back to free when the token is absent, so secretless contexts never hard-error.
• Scan-env isolation (core-tool-watch): the sfw smoke jobs necessarily install the PR's bumped packages — screening that install is the job, and sfw is the control. check_core_tools.py has no such control (plain uv sync + SDK import), so its env comes from the default branch's already-scored lockfile while the script only reads the PR's pins. That's what makes handing its job the token on Dependabot PRs safe.
• Strict fail thresholds: --fail-on-malware intentionally trips on more than literal malware (install scripts, obfuscation, telemetry, typosquat hints, plus any high/critical alert) — for four tools baked into the image, false positives are preferred over silent risk.
• OpenGrep proxy: Socket has no data for pkg:github/opengrep/opengrep; since OpenGrep is a hard fork of Semgrep, the watcher scores pkg:pypi/semgrep as a project-health proxy — labeled and never build-failing (it doesn't analyze OpenGrep's own artifacts).

---

Note

Medium Risk
Touches branch-protection-critical CI (new required gate pattern, API token handling on PRs) and bumps several runtime deps including a CVE-related idna fix; misconfiguration of secrets or enabling the gate before merge could block PRs.

Overview
Bundles multiple open Dependabot bumps into pyproject.toml / uv.lock (including requests>=2.33.0 and transitive updates such as idna, urllib3, pytest, pygments, light-s3-client) and refreshes Docker GitHub Actions pins in _docker-pipeline.yml.

Dependabot gains a uv ecosystem entry, minor/patch vs major groups for uv/docker/actions, directories so composite actions under .github/actions/* are scanned, and a 7-day cooldown documented in config comments.

dependabot-review.yml is removed in favor of dependency-review.yml: classifies PRs (Python deps, app_tests Docker, workflow sensitivity, fork vs in-repo trust), runs sfw uv sync via new .github/actions/setup-sfw (enterprise with token degrade-to-free, free for forks), uploads SFW artifacts, smoke-builds app_tests only when its Dockerfile changes, and adds always-on dependency-review-gate as the intended required check.

Adds core-tool-watch.yml and scripts/check_core_tools.py to discover/score OpenGrep, TruffleHog, Trivy, and socketdev pins (watch drift + upsert issues; build mode --fail-on-malware on pinned versions), syncing the scan SDK env from main’s lockfile via a .scan-env checkout.

python-tests.yml switches installs/tests to uv sync --locked and adds uv lock --locked. .gitignore drops the !LICENSE.md exception.

^{Reviewed by Cursor Bugbot for commit cdbfdce. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/​pytest@​8.4.2 ⏵ 9.0.3	-3	+2
	pypi/​requests@​2.31.0 ⏵ 2.34.2	+1	+4
	pypi/​light-s3-client@​0.0.30 ⏵ 0.0.40			+2

View full report

[socket-security-staging]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/​pytest@​8.4.2 ⏵ 9.0.3	-3	+2
	pypi/​requests@​2.31.0 ⏵ 2.34.2	+1	+4
	pypi/​light-s3-client@​0.0.30 ⏵ 0.0.40

View full report

[lelia]

bugbot run

[lelia]

bugbot run

[lelia]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 18a01d8. Configure here.}

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 425165e. Configure here.}

[Eric Hibbs (flowstate)]

one future-looking nit; LGTM

[lelia]

bugbot run

[lelia]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit cdbfdce. Configure here.}