CHANGELOG.md

Changelog

3.6.2

Fixed: reject retired API credentials before use

• The SDK rejects the retired API credential before storing or encoding it.

Fixed: full-scan reads wait for analysis to finish

• fullscans.stream() now requests cached results (?cached=true) and polls while the API answers 202 Processing, instead of treating the first 202 as a failed result. Polling backs off from 5s to 10s between attempts and stops when the budget runs out, raising APITimeout.
• The polling budget defaults to the SDK's configured timeout. Callers can tune it with the new keyword-only arguments poll_timeout_seconds, poll_initial_interval_seconds and poll_max_interval_seconds. Each request is bounded by the configured timeout or the remaining budget, whichever is shorter, and polling stops early once the next attempt could not start before the budget runs out.
• Transient failures (HTTP 408/502/503/504, timeouts, dropped connections) are retried within the budget. Authorization, not-found and quota errors still raise immediately.
• Invalid polling settings (zero, negative, non-finite, booleans, or an initial interval above the maximum) raise ValueError before any request is sent.
• The organization slug and full scan ID are now URL-encoded in the request path.
• API.do_request() accepts an optional keyword-only request_timeout that overrides the configured timeout for a single call.

3.6.1

Security: patched releases of certifi, uv and virtualenv

• Updated the locked versions of certifi (2025.11.12 → 2026.10.19), uv (0.11.17 → 0.13.4) and virtualenv (20.36.1 → 21.14.7) to pick up fixes for critical vulnerabilities. These versions are pinned in uv.lock, which controls the development and CI environment.
• socketdev now requires certifi>=2026.10.19, so installing it also upgrades the CA bundle requests uses. Older bundles trust the compromised eMudhra intermediate CAs.
• The release build toolchain (.github/actions/setup-hatch) now installs virtualenv==21.14.7 and hatchling==1.32.4, matching uv.lock and the [build-system] pin. Published artifacts are built with the patched versions.
• Raised the requests floor to >=2.33.0.

Changed: Python 3.10 or newer is required

• requires-python is now >=3.10 (previously >=3.9). The patched dependency releases no longer support Python 3.9, which reached end of life in October 2025. On Python 3.9, pip continues to resolve socketdev 3.6.0.

Maintenance

• Pinned the hatchling build backend to 1.32.4 and capped built distributions at core metadata 2.4 so the locked Twine can validate them.
• Raised the dev and test extras floors to hatch>=1.18.1 and pytest>=9.0.3.

3.6.0

Changed: every API-sourced enum now tolerates unknown values

• SocketIssueSeverity, SocketCategory, DiffType and SecurityAction now fall back to a documented member instead of raising ValueError when the API sends a value this release does not know about. SocketPURL_Type already behaved this way; the others did not, so each was one backend addition away from emptying a response the same way issue #78 and the unknown generic purl type did. ScanType is deliberately left strict: it is only ever urlencoded onto the create-scan request, so an unrecognized value is a caller typo rather than API drift.
• Fallbacks are deliberate rather than convenient. SocketIssueSeverity and DiffType gained an explicit UNKNOWN member because guessing an existing level would either hide a real finding or invent one, and SecurityAction falls back to DEFER because that already means "use the configured default". Every fallback logs a warning naming the unrecognized value.
• Added the 10 purl types the API defines that this SDK was missing: alpm, chrome, clawhub, edge-extension, firefox-extension, qpkg, socket, swid, vscode and vscode-extension. Artifacts with those types were being flattened to unknown.

Added: enum forward-compatibility is now an enforced invariant

• tests/unit/test_enum_forward_compat.py discovers every enum in the package, including ones added later, and fails if any raises on an unrecognized value. The two prior incidents were each fixed with a bespoke test on the single enum that happened to fire; this replaces that pattern.

Added: scheduled check for enum drift against the live API

• scripts/check_api_enum_drift.py compares the SDK's enums against https://api.socket.dev/v0/openapi. The spec is public, so the check needs no token, org or fixture data. Run by .github/workflows/api-drift-check.yml, which is manual-dispatch only for now and is not a pull request check --- it tests the API rather than the diff.

3.5.0

Changed: bound runtime dependency ranges and pin build backend

• Added version bounds to the runtime dependencies: requests>=2.32.5,<3 (previously unbounded) and typing-extensions>=4.12.2,<5 (previously no upper bound). As a library, socketdev declares bounded ranges rather than exact pins so its constraints compose with consumers that pin their own dependencies, such as the Socket Python CLI.
• Pinned the hatchling build backend used for sdist builds.

---

Entries below are imported from the auto-generated GitHub release notes.

3.4.2 (2026-08-05)

What's Changed

• ci(deps): bump pypa/gh-action-pypi-publish from ab69e431e9c9f48a3310be0a56527c679f56e04d to dc37677b2e1c63e2034f94d8a5b11f265b73ba33 by @dependabot[bot] in #91
• ci(deps): bump actions/checkout from 6.0.2 to 7.0.1 by @dependabot[bot] in #96
• chore(deps): bump the python-minor-patch group across 1 directory with 2 updates by @dependabot[bot] in #95
• Make SDK preview publication opt-in by @lelia in #100
• Add missing purl types and per-artifact parse resilience to full-scan stream by @lelia in #101
• Add cached diff-scan polling support to DiffScans.get by @lelia in #99
• fix(purl): expose fail-open batch params and harden dedupe by @lelia in #98

Full Changelog: https://github.com/SocketDev/socket-sdk-python/compare/v3.3.0...v3.4.2

3.3.0 (2026-06-10)

What's Changed

• Add transient-error classification to APIFailure by @mtorp in #93

Full Changelog: https://github.com/SocketDev/socket-sdk-python/compare/v3.2.1...v3.3.0

3.2.1 (2026-06-03)

What's Changed

• Add sfw aggregator gate to enforce required CI checks by @lelia in #89

Full Changelog: https://github.com/SocketDev/socket-sdk-python/compare/v3.2.0...v3.2.1

3.2.0 (2026-06-03)

What's Changed

• Add OTHER category to SocketCategory enum by @lelia in #85
• ci(deps): bump actions/setup-python from 5.2.0 to 6.2.0 by @dependabot[bot] in #86
• ci(deps): bump actions/github-script from 7.0.1 to 9.0.0 by @dependabot[bot] in #87
• chore(deps): bump the python-minor-patch group with 2 updates by @dependabot[bot] in #88

Full Changelog: https://github.com/SocketDev/socket-sdk-python/compare/v3.1.2...v3.2.0

3.1.2 (2026-06-02)

What's Changed

• Dependabot hardening + dependency update bundle by @lelia in #84

Full Changelog: https://github.com/SocketDev/socket-sdk-python/compare/v3.1.1...v3.1.2

3.1.1 (2026-05-22)

What's Changed

• ci(version-check): require uv.lock sync alongside pyproject changes by @flowstate in #82
• Fix stale didYouMean props by @flowstate in #81

Full Changelog: https://github.com/SocketDev/socket-sdk-python/compare/v3.1.0...v3.1.1

3.1.0 (2026-05-21)

What's Changed

• Support org-scoped batch package endpoint by @lelia in #76

Full Changelog: https://github.com/SocketDev/socket-sdk-python/compare/v3.0.33...v3.1.0

3.0.33 (2026-04-24)

What's Changed

• fix: harden GitHub Actions workflows by @reberhardt7 in #72
• fix: tolerate unknown SocketCategory values in SocketAlert.from_dict by @dc-larsen in #79

New Contributors

• @reberhardt7 made their first contribution in #72
• @dc-larsen made their first contribution in #79

Full Changelog: https://github.com/SocketDev/socket-sdk-python/compare/v3.0.32...v3.0.33

3.0.32 (2026-02-27)

What's Changed

• Fixing issue where incorrect workspace was being set as None by @dacoburn in #71

Full Changelog: https://github.com/SocketDev/socket-sdk-python/compare/v3.0.31...v3.0.32

3.0.31 (2026-02-26)

What's Changed

• Bump urllib3 from 2.6.2 to 2.6.3 by @dependabot[bot] in #67
• Bump virtualenv from 20.35.4 to 20.36.1 by @dependabot[bot] in #66
• Bump cryptography from 46.0.3 to 46.0.5 by @dependabot[bot] in #69
• Add workspace param support by @lelia in #68
• Update CODEOWNERS to reflect team ownership by @lelia in #70

New Contributors

• @dependabot[bot] made their first contribution in #67
• @lelia made their first contribution in #68

Full Changelog: https://github.com/SocketDev/socket-sdk-python/compare/v3.0.29...v3.0.31

3.0.29 (2026-01-21)

What's Changed

• Add scan_type query param to full scan API by @mtorp in #64

Full Changelog: https://github.com/SocketDev/socket-sdk-python/compare/v3.0.28...v3.0.29

3.0.28 (2026-01-05)

What's Changed

• Updating README with latest changes by @dacoburn in #63
• Updated README with new Slack bot directions by @dacoburn in #65

Full Changelog: https://github.com/SocketDev/socket-sdk-python/compare/v3.0.25...v3.0.28

3.0.25 (2026-01-01)

What's Changed

• Added option to override user agent string by @dacoburn in #62

Full Changelog: https://github.com/SocketDev/socket-sdk-python/compare/v3.0.24...v3.0.25

3.0.24 (2026-01-01)

What's Changed

• Upgraded dependencies and fixed versioning by @dacoburn in #61

Full Changelog: https://github.com/SocketDev/socket-sdk-python/compare/v3.0.23...v3.0.24

3.0.23 (2026-01-01)

What's Changed

• feat: Add comprehensive SDK enhancements and new endpoint modules by @dacoburn in #60

Full Changelog: https://github.com/SocketDev/socket-sdk-python/compare/v3.0.22...v3.0.23

3.0.22 (2025-12-10)

What's Changed

• Changed version to be optional so that if it isn't there in a diff or… by @dacoburn in #59

Full Changelog: https://github.com/SocketDev/socket-sdk-python/compare/v3.0.21...v3.0.22

3.0.21 (2025-11-27)

What's Changed

• create function for finalizing Tier 1 reachability analyses by @mtorp in #58

New Contributors

• @mtorp made their first contribution in #58

Full Changelog: https://github.com/SocketDev/socket-sdk-python/compare/v3.0.20...v3.0.21

3.0.20 (2025-11-15)

What's Changed

• Fixing versioning as didn't add project files in last branch by @dacoburn in #57

Full Changelog: https://github.com/SocketDev/socket-sdk-python/compare/v3.0.19...v3.0.20

3.0.19 (2025-11-15)

What's Changed

• Doug/add unverified option by @dacoburn in #56

Full Changelog: https://github.com/SocketDev/socket-sdk-python/compare/v3.0.17...v3.0.19

3.0.17 (2025-11-07)

What's Changed

• Fixed logic for upload manifest files to not strip the folder names f… by @dacoburn in #55

Full Changelog: https://github.com/SocketDev/socket-sdk-python/compare/v3.0.16...v3.0.17

3.0.16 (2025-11-07)

What's Changed

• Added upload manifests endpoint for reachability by @dacoburn in #54

Full Changelog: https://github.com/SocketDev/socket-sdk-python/compare/v3.0.14...v3.0.16

3.0.14 (2025-10-17)

What's Changed

• Fix the normalization for file names to work for specifying a file, p… by @dacoburn in #53

Full Changelog: https://github.com/SocketDev/socket-sdk-python/compare/v3.0.13...v3.0.14

3.0.13 (2025-10-14)

What's Changed

• Fixing workflows with pinned versions by @dacoburn in #50
• Update action versions in pr-preview.yml by @dacoburn in #51
• Update PyPI publish action version by @dacoburn in #52
• Fix dedupe logic to work with compact mode for the purl endpoint by @dacoburn in #49

Full Changelog: https://github.com/SocketDev/socket-sdk-python/compare/v3.0.6...v3.0.13

3.0.6 (2025-09-12)

What's Changed

• feat: Add support for base_paths parameter in fullscans and diffscans by @dacoburn in #48

Full Changelog: https://github.com/SocketDev/socket-sdk-python/compare/v3.0.5...v3.0.6

3.0.5 (2025-09-09)

What's Changed

• fix: Align SDK endpoints and tests with OpenAPI spec by @dacoburn in #47

Full Changelog: https://github.com/SocketDev/socket-sdk-python/compare/v3.0.4...v3.0.5

3.0.4 (2025-09-03)

What's Changed

• feat: Complete API endpoint coverage with comprehensive tests and doc… by @dacoburn in #45

Full Changelog: https://github.com/SocketDev/socket-sdk-python/compare/v3.0.2...v3.0.4

3.0.2 (2025-08-24)

What's Changed

• Fix README typos by @Planeshifter in #43
• fix: include namespace in deduplicated purl construction by @dacoburn in #44

New Contributors

• @Planeshifter made their first contribution in #43

Full Changelog: https://github.com/SocketDev/socket-sdk-python/compare/v3.0.0...v3.0.2

3.0.0 (2025-08-23)

What's Changed

• feat: migrate to socketdev 3.0.0 and switch to uv dependency management by @dacoburn in #42

Full Changelog: https://github.com/SocketDev/socket-sdk-python/compare/v2.2.3...v3.0.0

2.2.3 (2025-08-23)

What's Changed

• Adding deprecation notice by @dacoburn in #41

Full Changelog: https://github.com/SocketDev/socket-sdk-python/compare/v2.1.8...v2.2.3

2.1.8 (2025-08-22)

What's Changed

• Doug/fix diff scan license options by @dacoburn in #40

Full Changelog: https://github.com/SocketDev/socket-sdk-python/compare/v2.1.5...v2.1.8

2.1.5 (2025-06-20)

What's Changed

• Improvements to unit tests for new diff scans by @dacoburn in #39

Full Changelog: https://github.com/SocketDev/socket-sdk-python/compare/v2.1.4...v2.1.5

2.1.4 (2025-06-10)

What's Changed

• Added missing property by @dacoburn in #38

Full Changelog: https://github.com/SocketDev/socket-sdk-python/compare/v2.1.3...v2.1.4

2.1.3 (2025-06-09)

What's Changed

• Fixed logging to use logging instead of print by @dacoburn in #37

Full Changelog: https://github.com/SocketDev/socket-sdk-python/compare/v2.1.0...v2.1.3

2.1.0 (2025-06-02)

What's Changed

• Doug/add new endpoints by @dacoburn in #36

Full Changelog: https://github.com/SocketDev/socket-sdk-python/compare/v2.0.22...v2.1.0

2.0.22 (2025-04-25)

What's Changed

• Fixed the logic for dedeupe and ths missing alert fields by @dacoburn in #35

Full Changelog: https://github.com/SocketDev/socket-sdk-python/compare/v2.0.21...v2.0.22

2.0.21 (2025-04-03)

What's Changed

• Fix attributes being dropped during dedupe by @dacoburn in #34

Full Changelog: https://github.com/SocketDev/socket-sdk-python/compare/v2.0.20...v2.0.21

2.0.20 (2025-04-01)

What's Changed

• Doug/add dedupe logic to sdk by @dacoburn in #33

Full Changelog: https://github.com/SocketDev/socket-sdk-python/compare/v2.0.16...v2.0.20

2.0.16 (2025-03-31)

What's Changed

• Fixed purl logic to accept params by @dacoburn in #31

Full Changelog: https://github.com/SocketDev/socket-sdk-python/compare/v2.0.15...v2.0.16

2.0.15 (2025-03-24)

What's Changed

• Fixed deployment process to ensure the versions are being pushed to pypi by @dacoburn in #30

Full Changelog: https://github.com/SocketDev/socket-sdk-python/compare/v2.0.14...v2.0.15

2.0.14 (2025-03-24)

What's Changed

• Doug/fix api error by @dacoburn in #29

Full Changelog: https://github.com/SocketDev/socket-sdk-python/compare/v2.0.13...v2.0.14

2.0.13 (2025-03-19)

What's Changed

• Doug/make params url safe by @dacoburn in #28

Full Changelog: https://github.com/SocketDev/socket-sdk-python/compare/v2.0.11...v2.0.13

2.0.11 (2025-03-15)

What's Changed

• Add support for include_license_details for the streaming diff endpoint by @dacoburn in #27

Full Changelog: https://github.com/SocketDev/socket-sdk-python/compare/v2.0.10...v2.0.11

2.0.10 (2025-03-13)

What's Changed

• Doug/fix missing repo field by @dacoburn in #26

Full Changelog: https://github.com/SocketDev/socket-sdk-python/compare/v2.0.9...v2.0.10

2.0.9 (2025-02-28)

What's Changed

• Fix for the validation test being in the get instead of post by @dacoburn in #24

Full Changelog: https://github.com/SocketDev/socket-sdk-python/compare/v2.0.8...v2.0.9

2.0.8 (2025-02-27)

What's Changed

• Return headers on request exception by @flowstate in #23

Full Changelog: https://github.com/SocketDev/socket-sdk-python/compare/v2.0.7...v2.0.8

2.0.7 (2025-02-25)

What's Changed

• improved error handling by @flowstate in #22

Full Changelog: https://github.com/SocketDev/socket-sdk-python/compare/v2.0.6...v2.0.7

2.0.6 (2025-02-24)

What's Changed

• Fix for params already being a dict by @dacoburn in #21

Full Changelog: https://github.com/SocketDev/socket-sdk-python/compare/v2.0.5...v2.0.6

2.0.5 (2025-02-14)

What's Changed

• small fixes to support CLI bugfixes @flowstate in #20

Full Changelog: https://github.com/SocketDev/socket-sdk-python/compare/v2.0.4...v2.0.5

2.0.4 (2025-02-12)

What's Changed

• updated type definitions and logic to align with the updates to the Socket API (diff endpoint)

Full Changelog: https://github.com/SocketDev/socket-sdk-python/compare/v2.0.2...v2.0.4

2.0.2 (2025-02-06)

No release notes provided.

2.0.1 (2025-02-06, pre-release)

What's Changed

• github workflow improvements and python version compatibility updates by @flowstate in #17

Full Changelog: https://github.com/SocketDev/socket-sdk-python/compare/v2.0.0...v2.0.1

2.0.0 (2025-02-05, pre-release)

What's Changed

• Version bumped to 2 to indicate potentially breaking changes

• Typing was added to most endpoints (specifically those used by the python CLI)

• Since this is such a large change-set, we aren't suggesting everyone move to v2 immediately. If you do, and run into any bugs, please open an issue so we can address them.

Full Changelog: https://github.com/SocketDev/socket-sdk-python/compare/v1.0.15...v2.0.0

1.0.15 (2025-01-24)

What's Changed

• Initial code by @dacoburn in #1
• Orlando/add new endpoints by @obarrera in #2
• Adding code owners file by @dacoburn in #3
• Added the Purl API endpoint by @obarrera in #4
• Orgs full scans by @obarrera in #5
• Update README.rst by @obarrera in #6
• Doug/add new features by @dacoburn in #7
• Added missing endpoints and updated documentation by @dacoburn in #8
• Fixed issue in the newly added endpoints by @dacoburn in #9
• Add the missing folder to the by @dacoburn in #10
• added endpoints to python sdk by @flowstate in #11
• fixed build script and README formatting by @flowstate in #12
• hotfix - add export to socketdev and toml by @flowstate in #13
• added pr-preview and release workflows by @flowstate in #15
• updated load_files to omit the path to workspace if specified by @flowstate in #16

New Contributors

• @dacoburn made their first contribution in #1
• @obarrera made their first contribution in #2
• @flowstate made their first contribution in #11

Full Changelog: https://github.com/SocketDev/socket-sdk-python/commits/v1.0.15