chore(deps): refresh bundled scanner and CLI pins

Moves every bundled tool to its latest release: OpenGrep v1.33.1,
TruffleHog 3.99.8, Socket npm CLI 1.13.1, Socket Python CLI 2.11.11
(previously proposed in #134), uv 0.13.7, and in the app-tests image
gosec v2.30.0 and Go 1.27.3. Trivy is already current on main.

OpenGrep moves seven minors, so the Java rule set was re-measured on
OWASP BenchmarkJava at the pinned corpus commit. 1.30.0 and 1.33.1
produce the same findings, so docs/java-sast-benchmark.md records
1.33.1 without new numbers.

Author: lelia

Dockerfile

@@ -4,12 +4,12 @@
 #
 # Dependabot-trackable (each has a corresponding FROM <image>:<ARG> stage):
 ARG PYTHON_VERSION=3.12
-ARG TRUFFLEHOG_VERSION=3.96.0
-ARG UV_VERSION=0.12.1
+ARG TRUFFLEHOG_VERSION=3.99.8
+ARG UV_VERSION=0.13.7
 #
 # NOT Dependabot-trackable (no official Docker image with a stable binary path):
-ARG OPENGREP_VERSION=v1.26.0
-ARG SOCKET_NPM_CLI_VERSION=1.1.165
+ARG OPENGREP_VERSION=v1.33.1
+ARG SOCKET_NPM_CLI_VERSION=1.13.1
 #
 # NOT Dependabot-trackable — Socket-built Trivy, rebuilt from unmodified upstream
 # source and published by Socket's own release pipeline. Pinned by digest; both

Dockerfile.heavy

@@ -1,10 +1,10 @@
 # Heavy POC image: socket-basics plus a pinned stable Python Socket CLI.
 ARG PYTHON_VERSION=3.12
-ARG TRUFFLEHOG_VERSION=3.96.0
-ARG UV_VERSION=0.12.1
-ARG OPENGREP_VERSION=v1.26.0
-ARG SOCKET_NPM_CLI_VERSION=1.1.165
-ARG SOCKET_PYTHON_CLI_VERSION=2.11.3
+ARG TRUFFLEHOG_VERSION=3.99.8
+ARG UV_VERSION=0.13.7
+ARG OPENGREP_VERSION=v1.33.1
+ARG SOCKET_NPM_CLI_VERSION=1.13.1
+ARG SOCKET_PYTHON_CLI_VERSION=2.11.11
 # Socket-built Trivy, pinned by digest — see the note in ./Dockerfile.
 ARG TRIVY_IMAGE=ghcr.io/socketdev/trivy:0.76.1@sha256:883da3593a60e311b2ed87c3a55241051b27bba15ffc3ce041ae570cd0f00915
 

app_tests/Dockerfile

@@ -3,17 +3,17 @@
 # To override at build time: docker build --build-arg TRUFFLEHOG_VERSION=3.93.8 .
 #
 # Dependabot-trackable (each has a corresponding FROM <image>:<ARG> stage):
-ARG GOLANG_VERSION=1.26.5
+ARG GOLANG_VERSION=1.27.3
 ARG NODE_VERSION=22
 ARG PYTHON_VERSION=3.12
-ARG TRUFFLEHOG_VERSION=3.96.0
-ARG UV_VERSION=0.12.1
+ARG TRUFFLEHOG_VERSION=3.99.8
+ARG UV_VERSION=0.13.7
 #
 # NOT Dependabot-trackable (no official Docker image with a stable binary path):
-ARG GOSEC_VERSION=v2.28.0
-ARG OPENGREP_VERSION=v1.26.0
-ARG SOCKET_NPM_CLI_VERSION=1.1.165
-ARG SOCKET_PYTHON_CLI_VERSION=2.11.3
+ARG GOSEC_VERSION=v2.30.0
+ARG OPENGREP_VERSION=v1.33.1
+ARG SOCKET_NPM_CLI_VERSION=1.13.1
+ARG SOCKET_PYTHON_CLI_VERSION=2.11.11
 #
 # NOT Dependabot-trackable — Socket-built Trivy, pinned by digest; updated by
 # Socket's trivy-dist release process. See the note in the root ./Dockerfile.

docs/java-sast-benchmark.md

@@ -36,10 +36,10 @@ Alert volume there is the number that maps to triage burden.
 
 Pin both the engine and the corpus, or the numbers below will not reproduce.
 
-- **Engine.** Measured with **opengrep 1.26.0**, the release the images pin
+- **Engine.** Measured with **opengrep 1.33.1**, the release the images pin
   (`OPENGREP_VERSION` in `Dockerfile` and `Dockerfile.heavy`). Rule behaviour
-  was identical on 1.19.0, 1.25.0 and 1.26.0 everywhere it was checked, but
-  re-measure if you change the pin.
+  was identical on 1.19.0, 1.25.0, 1.26.0, 1.30.0 and 1.33.1 everywhere it was
+  checked, but re-measure if you change the pin.
 - **Corpus.** BenchmarkJava at commit
   [`51f0a7c`](https://github.com/OWASP-Benchmark/BenchmarkJava/commit/51f0a7cf8bb9d17ce1f6d72598c1d1c6ce90f661)
   (2026-08-31). A `--depth 1` clone of `main` moves, and both the test cases and
@@ -104,7 +104,9 @@ Four behaviours worth knowing when editing these:
 
 ## Results
 
-Measured with opengrep 1.26.0.
+Measured with opengrep 1.33.1. Every number below is unchanged from the
+1.26.0 measurement; 1.30.0 and 1.33.1 produce the same findings on
+BenchmarkJava, finding for finding.
 
 Scan time on BenchmarkJava went from 6s to 11s, roughly +70%. The extra cost is
 the taint-mode conversions and the wider sink lists. It is small in absolute

docs/local-install-docker.md

@@ -50,8 +50,8 @@ docker inspect ghcr.io/socketdev/socket-basics:3.4.1 \
   | jq '.[0].Config.Labels'
 # {
 #   "com.socket.trivy-version": "0.76.1",
-#   "com.socket.trufflehog-version": "3.96.0",
-#   "com.socket.opengrep-version": "v1.26.0",
+#   "com.socket.trufflehog-version": "3.99.8",
+#   "com.socket.opengrep-version": "v1.33.1",
 #   "org.opencontainers.image.version": "3.4.1",
 #   ...
 # }
@@ -204,8 +204,8 @@ The image pins the bundled tools to specific versions. You can override them at
 
 ```bash
 docker build \
-  --build-arg TRUFFLEHOG_VERSION=3.96.0 \
-  --build-arg OPENGREP_VERSION=v1.26.0 \
+  --build-arg TRUFFLEHOG_VERSION=3.99.8 \
+  --build-arg OPENGREP_VERSION=v1.33.1 \
   -t socket-basics:3.4.1 .
 ```
 

docs/local-installation.md

@@ -278,16 +278,16 @@ OpenGrep works with the bundled Socket Basics SAST rules. No additional configur
 brew install trufflehog
 
 # Using Docker (alternative; pin explicitly — Docker Hub tags have no "v" prefix):
-docker pull trufflesecurity/trufflehog:3.96.0
+docker pull trufflesecurity/trufflehog:3.99.8
 
 # Manual installation (Linux):
-wget https://github.com/trufflesecurity/trufflehog/releases/download/v3.96.0/trufflehog_3.96.0_linux_amd64.tar.gz
-tar -xzf trufflehog_3.96.0_linux_amd64.tar.gz
+wget https://github.com/trufflesecurity/trufflehog/releases/download/v3.99.8/trufflehog_3.99.8_linux_amd64.tar.gz
+tar -xzf trufflehog_3.99.8_linux_amd64.tar.gz
 sudo mv trufflehog /usr/local/bin/
 
 # Manual installation (macOS):
-wget https://github.com/trufflesecurity/trufflehog/releases/download/v3.96.0/trufflehog_3.96.0_darwin_arm64.tar.gz
-tar -xzf trufflehog_3.96.0_darwin_arm64.tar.gz
+wget https://github.com/trufflesecurity/trufflehog/releases/download/v3.99.8/trufflehog_3.99.8_darwin_arm64.tar.gz
+tar -xzf trufflehog_3.99.8_darwin_arm64.tar.gz
 sudo mv trufflehog /usr/local/bin/
 
 # Verify installation