Pin all Python dependencies

Pin every runtime dependency in pyproject.toml to an exact version,
replace the bs4 shim with a direct beautifulsoup4 dependency, pin the
socketdev SDK to 3.4.2, and install Docker image dependencies from the
committed uv.lock with pip hash verification so image builds no longer
resolve loose versions from PyPI at build time. Also pins the hatchling
build backend and the uv binary used in the Dockerfile.

Refs CE-359.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

Author: lelia

CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## 2.5.10
+
+### Changed: pin all Python dependencies (CE-359)
+
+- Pinned every runtime dependency in `pyproject.toml` to an exact version;
+  several were previously unpinned or open ranges.
+- Replaced the `bs4` shim package with a direct, pinned `beautifulsoup4`
+  dependency (the shim provided no version control over the actual library).
+- Pinned the bundled `socketdev` SDK to `3.4.2` (previously `>=3.3.0,<4.0.0`).
+- Docker images now install Python dependencies from the committed `uv.lock`
+  with pip hash verification (`--require-hashes`), so image builds no longer
+  resolve dependency versions from PyPI at build time. `pip check` validates
+  the environment after install.
+- Pinned the `hatchling` build backend and the `uv` binary used in the
+  Dockerfile.
+
 ## 2.5.9
 
 ### Changed: bump pinned @coana-tech/cli to 15.10.3

Dockerfile

@@ -86,7 +86,7 @@ ENV PATH="/usr/local/go/bin:/usr/lib/go/bin:/root/.cargo/bin:${PATH}"
 ENV GOPATH="/go"
 
 # Install uv
-COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv
+COPY --from=ghcr.io/astral-sh/uv:0.10.4 /uv /usr/local/bin/uv
 
 # Install pyenv
 # pyenv lets us build/install arbitrary Python versions on demand. We install
@@ -111,14 +111,21 @@ RUN curl -L https://raw.githubusercontent.com/pyenv/pyenv-installer/master/bin/p
     ln -s ~/.pyenv/bin/pyenv /bin/pyenv && \
     pyenv --version
 
+# Install Python dependencies from the lockfile with hash verification so the
+# image never resolves loose versions from PyPI at build time.
+COPY pyproject.toml uv.lock /tmp/socket-cli-lock/
+RUN uv export --directory /tmp/socket-cli-lock --frozen --no-dev --no-emit-project \
+        --format requirements-txt -o /tmp/socket-cli-lock/requirements.txt && \
+    pip install --require-hashes --no-deps -r /tmp/socket-cli-lock/requirements.txt
+
 # Install CLI based on build mode
 RUN if [ "$USE_LOCAL_INSTALL" = "true" ]; then \
         echo "Using local development install"; \
     else \
         cli_installed=false; \
         for i in $(seq 1 10); do \
             echo "Attempt $i/10: Installing socketsecurity==$CLI_VERSION"; \
-            if pip install --index-url ${PIP_INDEX_URL} --extra-index-url ${PIP_EXTRA_INDEX_URL} socketsecurity==$CLI_VERSION; then \
+            if pip install --no-deps --index-url ${PIP_INDEX_URL} --extra-index-url ${PIP_EXTRA_INDEX_URL} socketsecurity==$CLI_VERSION; then \
                 cli_installed=true; \
                 break; \
             fi; \
@@ -134,13 +141,14 @@ RUN if [ "$USE_LOCAL_INSTALL" = "true" ]; then \
         if [ ! -z "$SDK_VERSION" ]; then \
             pip install --index-url ${PIP_INDEX_URL} --extra-index-url ${PIP_EXTRA_INDEX_URL} socketdev==${SDK_VERSION}; \
         fi; \
+        pip check; \
     fi
 
 # Copy local source and install in editable mode if USE_LOCAL_INSTALL is true
 COPY . /app
 WORKDIR /app
 RUN if [ "$USE_LOCAL_INSTALL" = "true" ]; then \
-        pip install --upgrade -e .; \
+        pip install --no-deps -e . && pip check; \
     fi
 
 # Create workspace directory with proper permissions

pyproject.toml

@@ -1,26 +1,26 @@
 [build-system]
 requires = [
-  "hatchling"
+  "hatchling==1.31.0"
 ]
 build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.5.9"
+version = "2.5.10"
 requires-python = ">= 3.11"
 license = {"file" = "LICENSE"}
 dependencies = [
-    'requests',
-    'mdutils',
-    'prettytable',
-    'GitPython',
-    'packaging',
-    'python-dotenv',
-    "socketdev>=3.3.0,<4.0.0",
-    "bs4>=0.0.2",
-    "markdown>=3.10",
-    "brotli>=1.0.9; platform_python_implementation == 'CPython'",
-    "brotlicffi>=1.0.9; platform_python_implementation != 'CPython'",
+    "requests==2.34.2",
+    "mdutils==1.8.1",
+    "prettytable==3.18.0",
+    "GitPython==3.1.57",
+    "packaging==26.2",
+    "python-dotenv==1.2.2",
+    "socketdev==3.4.2",
+    "beautifulsoup4==4.14.3",
+    "markdown==3.10.2",
+    "brotli==1.2.0; platform_python_implementation == 'CPython'",
+    "brotlicffi==1.2.0.1; platform_python_implementation != 'CPython'",
 ]
 readme = "README.md"
 description = "Socket Security CLI for CI/CD"

socketsecurity/__init__.py

@@ -1,3 +1,3 @@
 __author__ = 'socket.dev'
-__version__ = '2.5.9'
+__version__ = '2.5.10'
 USER_AGENT = f'SocketPythonCLI/{__version__}'