chore(deps): bump SocketDev/socket-basics to v3.1.0 - #2
Merged
Conversation
Bumps the pinned digest from 6b71cdf (v3.0.0) to 5b615c8 (v3.1.0). v3.1.0 is a minor, backwards-compatible release. Notable fixes relevant to how this workflow invokes the action: - changed_files resolved to zero files inside the Docker container action because of a git dubious-ownership error (SocketDev/socket-basics#105) - changed_files was not honored from every config source, and failed silently when it was not (SocketDev/socket-basics#98) Both bugs could cause the scan to silently cover no files, so this is a correctness fix for PR-scoped scanning, not just a version refresh. Digest verified against the v3.1.0 tag via the GitHub API.
william-u10d
marked this pull request as ready for review
September 3, 2026 14:14
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
No issues found across 1 file
Shadow auto-approve: would not auto-approve. This PR does not meet the repository auto-approval settings.
Re-trigger cubic
lawrence-u10d
approved these changes
Sep 3, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the pinned Socket Basics digest from
6b71cdf(v3.0.0) to5b615c8(v3.1.0).Why now
v3.1.0 shipped 2026-09-03. It is a minor, backwards-compatible release, but two of its fixes bear directly on how this workflow invokes the action:
changed_filesresolved to zero files inside the Docker container action due to a git dubious-ownership error.changed_fileswas not honored from every config source, and failed silently when it wasn't.Both bugs can cause a scan to quietly cover nothing while still reporting success. Because this workflow runs
continue-on-error: trueand is informational-only, a silent no-op scan would be invisible here. That makes this a correctness fix for PR-scoped scanning, not just a version refresh.Also included upstream:
pr_comment_enabled/pr_comment_collapse_allPR-comment controls (#97) — not adopted in this PR, no input changes.Full upstream diff: SocketDev/socket-basics@v3.0.0...v3.1.0
Verification
5b615c89d17764ab46de2f2de63122ca2ef6a4beconfirmed via the GitHub API to be thechore(release): 3.1.0commit carrying thev3.1.0tag inSocketDev/socket-basics.with:block is unchanged.Scope
One line. No change to triggers, permissions, the fork-PR guard, or the audit-logging step.