v2.1.0

What's Changed

🚀 New Features

• feat: add diff-only scan scoping by lelia in #77

📦 Dependencies

• chore(deps): bundle Dependabot updates + harden dependency review workflows by lelia in #78

📚 Documentation

• chore(license): add nonempty license (LICENSE.md) by Chris Bailey (@ammkrn) in #79

🔧 Other Changes

• fix: warn users when socket_org is missing by David Larsen (@dc-larsen) in #23
• feat: add local ignore overrides for rule IDs + filepaths by lelia in #59
• fix: honor action 'ignore' when generating notifications by David Larsen (@dc-larsen) in #83
• fix: improve custom SAST rule activation, filtering semantics + config observability by lelia in #61
• docs: document required API token scopes for Socket Basics by David Larsen (@dc-larsen) in #68
• feat: add log statement indicating config source by David Larsen (@dc-larsen) in #18
• fix: restore standard LICENSE filename (revert .md rename from #79) by lelia in #88

New Contributors

• Chris Bailey (@ammkrn) made their first contribution in #79

Full Changelog: v2.0.3...v2.1.0

v2.0.3

What's Changed

🔧 Other Changes

• fix: Harden GHA workflows by Ryan Eberhardt (@reberhardt7) in #58
• docs: cleanup docs guidance, additional workflow hardening by lelia in #60
• fix(rules): improve precision of 4 high-FP dotnet opengrep rules by David Larsen (@dc-larsen) in #63
• chore(release): prepare v2.0.3, simplify release process by lelia in #66

New Contributors

• Ryan Eberhardt (@reberhardt7) made their first contribution in #58

Full Changelog: v2.0.2...v2.0.3

v2.0.2

What's Changed

📦 Dependencies

• Bump urllib3 from 2.5.0 to 2.6.3 by Dependabot (@dependabot)[bot] in #21

🔧 Other Changes

• Removed qualifiers by Douglas (@dacoburn) in #1
• Doug/fix trivy socket results by Douglas (@dacoburn) in #2
• Fix action.yml configuration and add GitHub token by Douglas (@dacoburn) in #3
• Update action.yml description for clarity by Douglas (@dacoburn) in #4
• docs: fix link by Ahmad Nassri (@ahmadnassri) in #5
• Added back in transitive logic and fixed format of integration messages by Douglas (@dacoburn) in #6
• Fixed documentation and version checks by Douglas (@dacoburn) in #7
• Added action inputs by Douglas (@dacoburn) in #8
• Updated examples with PR check and pinning to commit hashes by Douglas (@dacoburn) in #9
• Fixing issue of the git detection logic not using the workspace or GI… by Douglas (@dacoburn) in #10
• Doug/add node and socket back into container by Douglas (@dacoburn) in #11
• Fix for caching result by Douglas (@dacoburn) in #12
• Doug/improve default sast ruleset by Douglas (@dacoburn) in #13
• Fixed hard coded detection for golang by Douglas (@dacoburn) in #14
• Fixing regression in rule name by Douglas (@dacoburn) in #15
• Remove non-existent install options from local-installation.md by Graydon Hope (@graydonhope) in #16
• Fix: Empty CLI string defaults no longer override env/API config by David Larsen (@dc-larsen) in #17
• Bump version to 1.0.26 by David Larsen (@dc-larsen) in #20
• docs: add Dockerfile auto-discovery workflow pattern by David Larsen (@dc-larsen) in #25
• Add scan_type parameter to full scan API calls by Martin Torp (@mtorp) in #24
• Upgrade 1.0.28 by Martin Torp (@mtorp) in #27
• feat: add SKIP_SOCKET_REACH and SKIP_SOCKET_SUBMISSION env vars for Node.js Socket CLI integration by John-David Dalton (@jdalton) in #29
• Remove CODEOWNERS entry for @SocketDev/eng by Jake Verbaten (@Raynos) in #31
• Improve usefulness of generic output by Trevor Norris (@trevnorris) in #28
• Pin trufflehog to known-good version tag by lelia in #32
• Fix notifiers reading repo/branch from wrong source by David Larsen (@dc-larsen) in #30
• Fix: Jira dashboard config params not reaching notifier by David Larsen (@dc-larsen) in #22
• Update CODEOWNERS to reference GitHub Enterprise team name by lelia in #33
• Enhance GitHub PR comment experience by lelia in #26
• Fix CODEOWNERS syntax by lelia in #35
• Fix webhook notifier not reading URL from dashboard config by David Larsen (@dc-larsen) in #34
• Final CODEOWNERS update with new team name by lelia in #36
• Bump Trivy from v0.67.2 to v0.69.2 by David Larsen (@dc-larsen) in #39
• Bump version to prep for release by lelia in #40
• Pin opengrep version, add Docker smoketest by lelia in #41
• Add GitHub workflow for pytest by lelia in #42
• Fix Slack and MS Teams notifiers not reading URL from dashboard config by David Larsen (@dc-larsen) in #37
• Add structured findings to webhook payload by David Larsen (@dc-larsen) in #38
• feat: 🐳 multi-stage Docker builds, immutable release pipeline, CHANGELOG automation by lelia in #46
• fix(ci): add conventional commit prefixes to Dependabot config by lelia in #53
• fix(ci): support breaking change indicator (!) in commit-lint pattern by lelia in #54
• fix(ci): accept full tag name in workflow_dispatch, drop auto-v-prefix by lelia in #55
• feat!: switch to pre-built GHCR images by lelia in #48
• fix: remove trivy from Docker build while assessing compromise impact by Douglas (@dacoburn) in #56
• chore: fix release and updater script by lelia in #57

New Contributors

• Douglas (@dacoburn) made their first contribution in #1
• Ahmad Nassri (@ahmadnassri) made their first contribution in #5
• Graydon Hope (@graydonhope) made their first contribution in #16
• David Larsen (@dc-larsen) made their first contribution in #17
• Martin Torp (@mtorp) made their first contribution in #24
• John-David Dalton (@jdalton) made their first contribution in #29
• Jake Verbaten (@Raynos) made their first contribution in #31
• Dependabot (@dependabot)[bot] made their first contribution in #21
• Trevor Norris (@trevnorris) made their first contribution in #28
• lelia made their first contribution in #32

Full Changelog: https://github.com/SocketDev/socket-basics/commits/v2.0.2